04-4096. Critical Energy Infrastructure Information; Notice Soliciting Public Comment

February 13, 2004.

1. On July 23, 2003, the Federal Energy Regulatory Commission (the Commission) issued two final rules—Order Nos. 630-A and 643—involving critical energy infrastructure information (CEII).^[1] Order No. 630-A, the order on rehearing of Order No. 630, which was issued on February 21, 2003,^[2] provided further instruction on filing, handling, and processing requests for CEII found in Commission records. Order No. 643 was a companion rule that addressed then-existing requirements that companies make certain information publicly available that the Commission itself treated as non-public under newly-issued Order No. 630. The intent of Order No. 643 was to revise requirements that applied to the companies' release of CEII to be consistent with the way in which the Commission was treating that same information. No one sought rehearing of Order No. 643, and no one appealed either rule.

2. In each of the orders, the Commission noted that the two rules “represent[ed] the Commission's best efforts to achieve a delicate balance between the due process rights of interested persons to participate fully in its proceedings and its responsibility to protect public safety by ensuring that access to CEII does not facilitate acts of terrorism.” Order No. 630-A, 68 FR 46456 at P 18; Order No. 643, 68 FR 52089 at P 25. At the same time, the Commission committed to solicit public comment after six months in order to identify any potential problems with the treatment of CEII under the two orders. Id. This notice provides an opportunity for those with experience under Order Nos. 630, 630-A, and 643 to comment on their experiences under those orders. Such comments are due within 30 days of the date of issuance of this notice.

Background

3. The final rule issued in Order No. 630 was the result of over a year of consideration and discussion at the Commission. The effort began shortly after the attacks of September 11, 2001 with the issuance of a policy statement in PL02-1-000 (the Policy Statement), which discussed the recent removal of certain previously-public records from public access through the Public Reference Room, the Commission's document retrieval system, and the Internet. See Statement of Policy on Treatment of Previously Public Documents, 66 FR 52917 (Oct. 18, 2001), 97 FERC ¶ 61,130 (2001). The documents affected by the Policy Statement were documents including oversized maps that detailed the specifications of facilities licensed or certified by the Commission. The Policy Statement advised the public to request such information pursuant to the Freedom of Information Act (FOIA) process that is detailed in 5 U.S.C. 552 and in the Commission's regulations at 18 CFR 388.108.

4. Within a few months, the Commission issued a notice of inquiry (the NOI) as the next step in the process. In this same issuance, the Commission provided guidance to those filing information that might warrant non-public treatment under the Policy Statement. See Notice of Inquiry and Guidance for Filings in the Interim, 67 FR 3129 (Jan. 23, 2002), FERC Stats. & Regs. ¶ 35,542 (2002). The NOI labeled the information the Commission was seeking to protect as “critical energy infrastructure information, or CEII,” but asked for public comment on how to define the scope of the term. In addition, the NOI invited comment on the legal authority to protect CEII (including applicability of FOIA exemptions), requester verification and access issues, use of non-disclosure agreements, and the process for requesting CEII.

5. In September 2002, the Commission issued a notice of proposed rulemaking regarding CEII (the NOPR). 67 FR 57994 (Sept. 13, 2002); FERC Stats. & Regs. ¶ 32,564 (2002). The NOPR proposed an expanded definition of CEII to include detailed information about proposed facilities as well as those already licensed or certificated. In addition, it proposed a new process that would enable the Commission to restrict general public access to CEII while at the same time permitting those with a need for the information to obtain it in a timely manner. To that end, the NOPR proposed a supplement to the FOIA request process that would enable requesters to get access to CEII that was otherwise exempt from mandatory disclosure under the FOIA. Under the proposed process, requesters would have to provide limited personal information about themselves and their need for the information. This information would be considered in determining whether or not to grant the request. In addition, release would generally be contingent upon the requester agreeing to abide by the terms of an appropriate non-disclosure agreement.

6. On February 21, 2003, the Commission issued Order No. 630, the final rule on CEII. The final rule defined CEII to include information about proposed facilities, and to exclude information that simply identified the location of the infrastructure. In addition, the Commission's related definition of “critical infrastructure” was broad enough to cover virtually all facilities within its jurisdiction. The Commission declined to limit protection to “high risk” projects or facilities, opting instead to include virtually all facilities and components, including computer systems that control or form part of the energy infrastructure.

7. After receiving a request for rehearing on Order No. 630, the Commission issued Order No. 630-A on July 23, 2003, denying the request for rehearing, but amending the rule in several respects. Specifically, the order on rehearing made several minor procedural changes and clarifications, added a reference in the regulation regarding the filing of non-Internet public (NIP) information, a term first described in Order No. 630, and added a commitment to review the effectiveness of the new process after six months. This notice is intended to facilitate such a review.

8. As a separate but related matter, shortly after the Commission issued Order No. 630, it issued a notice of proposed rulemaking in RM03-6 that identified portions of the Commission's regulations that might require companies to disclose information that would be deemed CEII under the standards set forth in Order No. 630. See 68 FR 18538, (Apr. 21, 2003), FERC Stats. & Regs. ¶ 32,569 (2003). The goal in RM03-6 was to identify and implement any regulatory changes necessary to reconcile regulations requiring companies' disclosure of information with the standards and procedures in Order No. 630 for handling CEII that is submitted to or created by the Commission. In that way, the Commission attempted to ensure that protection of CEII was consistent whether the information was being sought through the Commission or through the company.

9. On July 23, 2003, the Commission issued Order No. 643, Amendments to Conform Regulations with Order No. 630 (Critical Energy Infrastructure Information Final Rule), 68 FR 52089 (Sept. 2, 2003), FERC Stats. & Regs. ¶ 31,149 (2003). The provisions in Order No. 643 were not intended to require that companies withhold CEII, rather they were intended to eliminate existing requirements to disclose information that may qualify for CEII treatment by the Commission. Order No. 643 explicitly stated that “[t]here is nothing in these revisions that affects one entity's ability to reach appropriate arrangements for sharing CEII and the Commission in fact encourages such arrangements.” 68 FR 52089 at P 16. The final rule made necessary revisions to provisions in 18 CFR Parts 4, 16, 141 and 157, and made the same commitment as in Order No. 630-A to review the effectiveness of the changes after six months. This notice is intended to facilitate the required “public comment to determine whether submitters or requesters of CEII are experiencing any problems with the new processes.” Id. at P 25.

Experience To Date

Order Nos. 630, 630-A, and 643 became effective on April 2, 2003, September 5, 2003, and October 23, 2003, respectively. Since April 2003, the Commission has received many filings where the submitters have requested non-public treatment of documents as containing CEII. At the same time, the Commission's staff has designated certain internally generated documents as CEII. Nevertheless, the Commission has received no complaints that any participant in a Commission proceeding could not get access to a document in order to participate meaningfully in the proceeding. Likewise, the Commission has received no complaints from other members of the public with a demonstrated need for a document containing CEII.^[3] As the Commission indicated in Order No. 630, it intended to process requests for CEII as expeditiously as possible. That goal, in large part, as set out below, has been accomplished.^[4]

10. Staff follows several steps in processing requests for CEII. Once a request is received, the appropriate staff searches for the document requested and provides the document to legal staff with a recommendation regarding whether or not the information qualifies as CEII. In cases where the requested document was submitted to the Commission with a request for CEII treatment, the Associate General Counsel for General Law notifies the submitter that the Commission has received a request for the document, and gives the submitter a period of at least five days in which to comment both on release to the particular requester and the non-public nature of the document itself. Each time a document is requested, the submitter receives a notice and opportunity to comment on release to that particular requester. With all requests, Commission staff reviews the document to determine whether it qualifies as CEII, verifies the requester's identity and need for the information requested, and seeks to obtain an appropriate non-disclosure agreement from the requester. Where the submitter of the document provides information regarding the request or requester, the staff factors such information into its recommendation to the CEII Coordinator. When the request involves a Commission-generated document, the CEII Coordinator releases the document to the requester at the time the decision to release is made. In cases where the document has been submitted to the Commission, the CEII Coordinator renders a decision on release, but release of the document is delayed by at least five days to give the submitter notice prior to release of the document. Because of the required notice and comment period and the notice prior to release, it usually takes staff more time to process requests for documents submitted to the Commission than those that are internally generated.

11. As of January 23, 2004, the Commission had received 126 requests for CEII filed under the procedures laid out in Section 388.113 of the Commission's regulations. See 18 CFR 388.113. These requests encompassed 2,230 documents. As of February 4, 2004, the Commission has granted or otherwise closed out 119 of these requests.^[5] None of the remaining requests has exceeded the suggested time limits for responding to such requests. The Commission has denied only seven requests, either in whole or in part. In three instances, the Commission denied the request in whole or in part because the information was subject to the attorney-client, attorney work product or deliberative process privileges. The Commission generally does not intend to release such information, regardless of whether or not it falls within the definition of CEII. The Commission denied four other requests because the requester did not agree to the terms of an appropriate non-disclosure agreement. In addition to formal requests for CEII under 18 CFR 388.113, Commission staff also received 171 direct requests from owners or operators of facilities for 282 documents containing CEII relating to their own facilities. Staff satisfied those requests, generally within a few days of receipt.

12. As noted, Order Nos. 630-A and 643 committed to examine the functioning of the new rules after six months, and specified that the Commission would seek public comments regarding the processes at that time. This notice invites the public to comment on any problems they have experienced under the new procedures, or to suggest ways to improve the processes.

The Commission orders:

Comments regarding the processes established in Order Nos. 630, 630-A, and 643 should be filed with the Office of the Secretary within 30 days of the issuance of this order.

By direction of the Commission.

Magalie R. Salas,

Secretary.

Footnotes

1.  Critical Energy Infrastructure Information, Order No. 630-A, 68 FR 46456 (Aug. 6, 2003), FERC Stats. & Regs. ¶ 31,147 (2003); Amendments to Conform Regulations with Order No. 630, Order No. 643, 68 FR 52089 (Sept. 2, 2003), FERC Stats. & Regs. ¶ 31,149 (2003).

2.  Critical Energy Infrastructure Information, Order No. 630, 68 FR 9857 (Mar. 3, 2003), FERC Stats. & Regs. ¶ 31,140 (2003).

3.  Commission action on CEII requests is delegated to the CEII Coordinator, whose decisions are subject to rehearing. No one has filed a request for rehearing of any of the decisions rendered to date.

4.  In the early months of processing CEII requests, the Commission experienced some technical difficulties, in particular with respect to the reproduction of Form No. 715. Those difficulties, which have now been resolved, caused some delay in responding to the initial requests for that form.

5.  In thirteen instances, the requested information was not CEII, and could be made public. In twelve other cases, the requesters and submitters dealt directly with each other, and the requests were subsequently withdrawn.