§ 388.113 - Critical Energy/Electric Infrastructure Information (CEII).

§ 388.113 Critical Energy/Electric Infrastructure Information (CEII).

(a) Scope. This section governs the procedures for submitting, designating, handling, sharing, and disseminating Critical Energy/Electric Infrastructure Information (CEII) submitted to or generated by the Commission. The Commission reserves the right to restrict access to previously filed information as well as Commission-generated information containing CEII. Nothing in this section limits the ability of any other Federal agency to take all necessary steps to protect information within its custody or control that is necessary to ensure the safety and security of the electric grid. To the extent necessary, such agency may consult with the CEII Coordinator regarding the treatment or designation of such information.

(b) Purpose. The procedures in this section implement section 215A of the Federal Power Act, and provide a comprehensive overview of the manner in which the Commission will implement the CEII program.

(c) Definitions. For purposes of this section:

(1) Critical electric infrastructure information means information related to critical electric infrastructure, or proposed critical electrical infrastructure, generated by or provided to the Commission or other Federal agency other than classified national security information, that is designated as critical electric infrastructure information by the Commission or the Secretary of the Department of Energy pursuant to section 215A(d) of the Federal Power Act. Such term includes information that qualifies as critical energy infrastructure information under the Commission's regulations. Critical Electric Infrastructure Information is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552(b)(3) and shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records pursuant to section 215A(d)(1)(A) and (B) of the Federal Power Act.

(2) Critical energy infrastructure information means specific engineering, vulnerability, or detailed design information about proposed or existing critical infrastructure that:

(i) Relates details about the production, generation, transportation, transmission, or distribution of energy;

(ii) Could be useful to a person in planning an attack on critical infrastructure;

(iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552; and

(iv) Does not simply give the general location of the critical infrastructure.

(3) Critical electric infrastructure means a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.

(4) Critical infrastructure means existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters.

(d) Criteria and procedures for determining what constitutes CEII. The following criteria and procedures apply to information labeled as CEII:

(1) For information submitted to the Commission:

(i) A person requesting that information submitted to the Commission be treated as CEII must include with its submission a justification for such treatment in accordance with the filing procedures posted on the Commission's Web site at http://www.ferc.gov. The justification must provide how the information, or any portion of the information, qualifies as CEII, as the terms are defined in paragraphs (c)(1) and (2) of this section. The submission must also include a clear statement of the date the information was submitted to the Commission, how long the CEII designation should apply to the information and support for the period proposed. Failure to provide the justification or other required information could result in denial of the designation and release of the information to the public.

(ii) In addition to the justification required by paragraph (d)(1)(i) of this section, a person requesting that information submitted to the Commission be treated as CEII must clearly label the cover page and pages or portions of the information for which CEII treatment is claimed in bold, capital lettering, indicating that it contains CEII, as appropriate, and marked “DO NOT RELEASE.” The submitter must also segregate those portions of the information that contain CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) wherever feasible. The submitter must also submit to the Commission a public version with the information where CEII is redacted, to the extent practicable.

(iii) If a person files material as CEII in a complaint proceeding or other proceeding to which a right to intervention exists, that person must include a proposed form of protective agreement with the filing, or identify a protective agreement that has already been filed in the proceeding that applies to the filed material.

(iv) The information for which CEII treatment is claimed will be maintained in the Commission's files as non-public until such time as the Commission may determine that the information is not entitled to the treatment sought. By treating the information as CEII, the Commission is not making a determination on any claim of CEII status. The Commission retains the right to make determinations with regard to any claim of CEII status at any time, and the discretion to release information as necessary to carry out its jurisdictional responsibilities. Although unmarked information may be eligible for CEII treatment, the Commission will treat unmarked information as CEII only if it is properly designated as CEII pursuant to Commission regulations.

(v) The CEII Coordinator will evaluate whether the submitted information or portions of the information are covered by the definitions in paragraphs (c)(1) and (2) of this section prior to making a designation as CEII.

(vi) Subject to the exceptions set forth in paragraph (f)(5) of this section, when a CEII requester seeks information for which CEII status has been claimed, or when the Commission itself is considering release of such information, the CEII Coordinator or any other appropriate Commission official will notify the person who submitted the information and give the person an opportunity (at least five business days) in which to comment in writing on the request. A copy of this notice will be sent to the requester. Notice of a decision by the Commission, or the CEII Coordinator to make a release of CEII, will be given to any person claiming that the information is CEII no less than five business days before disclosure. The notice will respond to any objections to disclosure from the submitter that are not sustained. Where applicable, a copy of this notice will be sent to the CEII requester.

(2) For Commission-generated information:

(i) After consultation with the Office Director for the office that created the information, or the Office Director's designee, the CEII Coordinator will designate Commission-generated information as CEII after determining that the information or portions of the information are covered by the definitions in paragraphs (c)(1) and (2) of this section. Commission-generated CEII shall include clear markings to indicate the information is CEII and the date of the designation.

(ii) The Commission will segregate non-CEII from Commission-generated CEII or information that reasonably could be expected to lead to the disclosure of CEII wherever feasible.

(e) Duration of the CEII designation. All CEII designations will be subject to the following conditions:

(1) A designation may last for up to a five-year period, unless re-designated. In making a determination as to whether the designation should be extended, the CEII Coordinator will take into account information provided in response to paragraph (d)(1)(i) of this section, and any other information, as appropriate.

(2) A designation may be removed at any time, in whole or in part, if the Commission determines that the unauthorized disclosure of CEII could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities or any other form of energy infrastructure.

(3) The Commission will treat CEII or documents marked as CEII as non-public after the designation has lapsed until the CEII Coordinator determines to un-designate the information.

(4) If a CEII designation is removed, the submitter will receive notice and an opportunity to comment. The CEII Coordinator will notify the submitter of the information and give the submitter an opportunity (at least five business days) in which to comment in writing prior to the removal of the designation. Notice of a removal decision will be given to any submitter claiming that the information is CEII no less than five business days before disclosure. The notice will briefly explain why the submitter's objections to the removal of the designation are not sustained by the Commission

(f) Voluntary sharing of CEII. The Commission, taking into account standards of the Electric Reliability Organization, will facilitate voluntary sharing of CEII with, between, and by Federal, state, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers established pursuant to Presidential Decision Directive 63; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate by the Commission. The process will be as follows:

(1) The Director of any Office of the Commission or his designee that wishes to voluntarily share CEII shall consult with the CEII Coordinator prior to the Office Director or his designee making a determination on whether to voluntarily share the CEII.

(2) Consistent with paragraph (d) of this section, the Commission retains the discretion to release information as necessary to carry out its jurisdictional responsibilities in facilitating voluntary sharing or, in the case of information provided to other federal agencies, the Commission retains the discretion to release information as necessary for those agencies to carry out their jurisdictional responsibilities.

(3) All entities receiving CEII must execute either a non-disclosure agreement or an acknowledgement and agreement. A copy of each agreement will be maintained by the Office Director with a copy to the CEII Coordinator.

(4) When the Commission voluntarily shares CEII pursuant to this subsection, the Commission may impose additional restrictions on how the information may be used and maintained.

(5) Submitters of CEII shall receive notification of a limited release of CEII no less than five business days before disclosure, except in instances where voluntary sharing is necessary for law enforcement purposes, to maintain infrastructure security, to address potential threats, when notice would not be practicable, and where there is an urgent need to quickly disseminate the information. When prior notice is not given, the Commission will provide submitters of CEII notice of a limited release of the CEII as soon as practicable.

(g) Accessing CEII.

(1) An owner/operator of a facility, including employees and officers of the owner/operator, may obtain CEII relating to its own facility, excluding Commission-generated information except inspection reports/operation reports and any information directed to the owner-operators, directly from Commission staff without going through the procedures outlined in paragraph (g)(5) of this section. Non-employee agents of an owner/operator of such facility may obtain CEII relating to the owner/operator's facility in the same manner as owner/operators as long as they present written authorization from the owner/operator to obtain such information. Notice of such requests must be given to the CEII Coordinator, who shall track this information.

(2) An employee of a federal agency acting within the scope of his or her federal employment may obtain CEII directly from Commission staff without following the procedures outlined in paragraph (g)(5) of this section. Any Commission employee at or above the level of division director or its equivalent may rule on requests for access to CEII by a representative of a federal agency. To obtain access to CEII, an agency employee must sign an acknowledgement and agreement, which states that the agency will protect the CEII in the same manner as the Commission and will refer any requests for the information to the Commission. Notice of each such request also must be given to the CEII Coordinator, who shall track this information.

(3) A landowner whose property is crossed by or in the vicinity of a project may receive detailed alignment sheets containing CEII directly from Commission staff without submitting a non-disclosure agreement as outlined in paragraph (g)(5) of this section. A landowner must provide Commission staff with proof of his or her property interest in the vicinity of a project.

(4) Any person who is a participant in a proceeding or has filed a motion to intervene or notice of intervention in a proceeding may make a written request to the filer for a copy of the complete CEII version of the document without following the procedures outlined in paragraph (g)(5) of this section. The request must include an executed copy of the applicable protective agreement and a statement of the person's right to party or participant status or a copy of the person's motion to intervene or notice of intervention. Any person may file an objection to the proposed form of protective agreement. A filer, or any other person, may file an objection to disclosure, generally or to a particular person or persons who have sought intervention. If no objection to disclosure is filed, the filer must provide a copy of the complete, non-public document to the requesting person within five business days after receipt of the written request that is accompanied by an executed copy of the protective agreement. If an objection to disclosure is filed, the filer shall not provide the non-public document to the person or class of persons identified in the objection until ordered by the Commission or a decisional authority.

(5) If any requester not described above in paragraphs (g)(1) through (4) of this section has a particular need for information designated as CEII, the requester may request the information using the following procedures:

(i) File a signed, written request with the Commission's CEII Coordinator. The request must contain the following:

(A) Requester's name (including any other name(s) which the requester has used and the dates the requester used such name(s)), title, address, and telephone number; and the name, address, and telephone number of the person or entity on whose behalf the information is requested;

(B) A detailed Statement of Need, which must state: The extent to which a particular function is dependent upon access to the information; why the function cannot be achieved or performed without access to the information; an explanation of whether other information is available to the requester that could facilitate the same objective; how long the information will be needed; whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and an explanation of whether the information is needed expeditiously.

(C) An executed non-disclosure agreement as described in paragraph (h)(2) of this section;

(D) A signed statement attesting to the accuracy of the information provided in the request; and

(E) A requester shall provide his or her date and place of birth upon request, if it is determined by the CEII Coordinator that this information is necessary to process the request.

(ii) A requester who seeks the information on behalf of all employees of an organization should clearly state that the information is sought for the organization, that the requester is authorized to seek the information on behalf of the organization, and that all individuals in the organization that have access to the CEII will agree to be bound by a non-disclosure agreement that must be executed.

(iii) After the request is received, the CEII Coordinator will determine if the information is CEII, and, if it is, whether to release the CEII to the requester. The CEII Coordinator will balance the requester's need for the information against the sensitivity of the information. If the requester is determined to be eligible to receive the information requested, the CEII Coordinator will determine what conditions, if any, to place on release of the information.

(iv) If the CEII Coordinator determines that the CEII requester has not demonstrated a valid or legitimate need for the CEII or that access to the CEII should be denied for other reasons, this determination may be appealed to the General Counsel pursuant to § 388.110. The General Counsel will decide whether the information is properly classified as CEII, which by definition is exempt from release under FOIA, and whether the Commission should in its discretion make such CEII available to the CEII requester in view of the requester's asserted legitimacy and need.

(v) Once a CEII requester has been verified by Commission staff as a legitimate requester who does not pose a security risk, his or her verification will be valid for the remainder of that calendar year. Such a requester is not required to provide detailed information about himself or herself with subsequent requests during the calendar year. He or she is also not required to file a non-disclosure agreement with subsequent requests during the calendar year because the original non-disclosure agreement will apply to all subsequent releases of CEII.

(vi) An organization that is granted access to CEII pursuant to paragraph (g)(5)(ii) of this section may seek to add additional individuals to the non-disclosure agreement within one (1) year of the date of the initial CEII request. Such an organization must provide the names of the added individuals to the CEII Coordinator and certify that notice of each added individual has been given to the submitter. Any newly added individuals must execute a supplement to the original non-disclosure agreement indicating their acceptance of its terms. If there is no written opposition within five business days of notifying the CEII Coordinator and the submitter concerning the addition of any newly added individuals, the CEII Coordinator will issue a standard notice accepting the addition of these names to the non-disclosure agreement. If the submitter files a timely opposition with the CEII Coordinator, the CEII Coordinator will issue a formal determination addressing the merits of such opposition. If an organization that is granted access to CEII pursuant to paragraph (g)(5)(ii) of this section wants to add new individuals to its non-disclosure agreement more than one year after the date of its initial CEII request, the organization must submit a new CEII request pursuant to paragraph (g)(5)(ii) of this section and a new non-disclosure agreement for each new individual added.

(vii) The CEII Coordinator will attempt to respond to the requester under this section according to the timing required for responses under the FOIA in § 388.108(c).

(viii) Fees for processing CEII requests will be determined in accordance with § 388.109.

(ix) Nothing in this section should be construed as requiring the release of proprietary information, personally identifiable information, cultural resource information, information on rare species of plants and animals, and other comparable data protected by statute or any privileged information, including information protected by the deliberative process privilege.

(h) Duty to protect CEII. Unauthorized disclosure of CEII is prohibited.

(1) To ensure that the Commissioners, Commission employees, and Commission contractors protect CEII from unauthorized disclosure, internal controls will describe the handling, marking, and security controls for CEII.

(2) Any individual who requests information pursuant to paragraph (g)(5) of this section must sign and execute a non-disclosure agreement, which indicates the individual's willingness to adhere to limitations on the use and disclosure of the information requested. The non-disclosure agreement will, at a minimum, require the following: CEII will only be used for the purpose for which it was requested; CEII may only be discussed with authorized recipients; CEII must be kept in a secure place in a manner that would prevent unauthorized access; CEII must be destroyed or returned to the Commission upon request; the Commission may audit the recipient's compliance with the non-disclosure agreement; CEII provided pursuant to the agreement is not subject to release under either FOIA or Sunshine Laws; a recipient is obligated to protect the CEII even after a designation has lapsed until the CEII Coordinator determines the information should no longer be designated as CEII under paragraph (e)(2) of this section; and a recipient is required to promptly report all unauthorized disclosures of CEII to the Commission.

(i) Sanctions. Any officers, employees, or agents of the Commission who knowingly and willfully disclose CEII in a manner that is not authorized under this section will be subject to appropriate sanctions, such as removal from the federal service, or possible referral for criminal prosecution. Commissioners who knowingly and willfully disclose CEII without authorization may be referred to the Department of Energy Inspector General. The Commission will take responsibility for investigating and, as necessary, imposing sanctions on its employees and agents.

(j) Administrative appeals of CEII determinations.

(1) Submitters who receive a determination that the Commission intends to remove a CEII designation may appeal that determination. The submitter must file notice of its intent to appeal that determination within five business days of the determination. The notice of intent to file an appeal must be sent to the General Counsel, with a copy to the CEII Coordinator. A statement in support of the notice of appeal must be submitted to the General Counsel within 20 business days of the date of the determination. The appeal will be considered received upon receipt of the statement in support of the notice of appeal.

(2) Individuals who receive a determination denying a request for the release of CEII, in whole or in part, or a determination denying a request to change the designation of CEII may appeal such determinations. Such appeals must be submitted to the General Counsel within 20 business days of the date of the determination.

(3) The Commission's General Counsel or the General Counsel's designee will make a determination with respect to any appeal within 20 business days after the receipt of the appeal. If, on appeal, the General Counsel or the General Counsel's designee upholds the determination in whole or in part, then the General Counsel or the General Counsel's designee will notify the person submitting the appeal of the availability of judicial review.

(4) The time limits prescribed for the General Counsel or his designee to act on an appeal may be extended pursuant to § 388.110(b)(1).

(5) Prior to seeking judicial review in federal district court pursuant to section 215A(d)(11) of the Federal Power Act, a person who received a determination from the Commission concerning a CEII designation must first appeal the determination to the Commission's General Counsel.

[Order 833, 81 FR 93749, Dec. 21, 2016]