E6-15820. Critical Energy Infrastructure Information

Issued September 21, 2006.

AGENCY:

Federal Energy Regulatory Commission.

ACTION:

Final rule.

SUMMARY:

The Federal Energy Regulatory Commission (Commission) is issuing this final rule amending its regulations for gaining access to Critical Energy Infrastructure Information (CEII). The definition of CEII is being clarified to exclude information that the Commission never intended to be deemed as containing critical infrastructure information. In addition, procedural changes are being made based on over three years experience processing CEII requests. These changes simplify the procedures for obtaining access to CEII without increasing vulnerability of the energy infrastructure.

DATES:

Effective Date: The rule will become effective November 2, 2006.

FOR FURTHER INFORMATION CONTACT:

Teresina A. Stasko, Office of the General Counsel, GC-13, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426; 202-502-8317.

SUPPLEMENTARY INFORMATION:

Before Commissioners: Joseph T. Kelliher, Chairman; Suedeen G. Kelly, Marc Spitzer, Philip D. Moeller, and Jon Wellinghoff.

1. It has been over three years since the Commission issued its final order on Critical Energy Infrastructure Information (CEII). See Critical Energy Infrastructure Information, Order No. 630, 68 FR 9857 (Mar. 3, 2003), FERC Stats. & Regs. ¶ 31,140 (2003); order on reh'g, Order No. 630-A, 68 FR 46456 (Aug. 6, 2003), FERC Stats. & Regs. ¶ 31,147 (2003). Since the issuance of Order No. 630, the Commission has continually monitored and evaluated the effectiveness of the CEII process. The most recent review indicates that changes are needed to assure the rules work in the manner intended.

2. As explained below, the Commission makes strictly procedural changes in this instant and final rule. In a notice of proposed rulemaking in Docket No. RM06-23-000, which is being issued concurrently with this final rule, the Commission proposes other changes, which require notice and comment. See 5 U.S.C. 553 (2000).

3. In this final rule the Commission clarifies and limits the definition of CEII to minimize the amount of information which qualifies as CEII, and makes the following changes to its regulations: (1) The definition of CEII is clarified; and (2) requesters are required to submit executed non-disclosure agreements (NDA) with their requests. In addition, the Commission is providing notice that, for CEII requests, the notice and opportunity to comment on a request will be combined with the notice of release. The Commission further takes this opportunity to reiterate its requirement that submitters segregate CEII from other information and file as CEII only information which truly warrants being kept from public access. Accordingly, this rule is being issued as an instant and final rule because it only concerns procedural matters. See 5 U.S.C. 553(b)(3)(A) (2000).

4. In a notice of proposed rulemaking in Docket No. RM06-23-000 issued concurrently with this final rule, the Commission seeks comments on, among other things: (1) Revisions to its regulations regarding CEII requests; (2) the limited portions of various forms and reports the Commission now defines as containing CEII; and (3) its proposal to abolish the non-Internet public (NIP) designation.

Background

5. The Commission began its efforts with respect to CEII shortly after the attacks of September 11, 2001. See Statement of Policy on Treatment of Previously Public Documents, 66 FR 52917 (Oct. 18, 2001), 97 FERC ¶ 61,130 (2001). The Commission's initial step was to remove from its public files and Internet page documents such as oversized maps that were likely to contain detailed specifications of facilities licensed or certified by the Commission, directing the public to request such information pursuant to the Freedom of Information Act (FOIA) process detailed in 5 U.S.C. 552 (2000) and in the Commission's regulations at 18 CFR 388.108 (2001). In September 2002, the Commission issued a notice of proposed rulemaking regarding CEII, which proposed an expanded definition of CEII to include detailed information about proposed facilities as well as those already licensed or certificated by the Commission. See Notice of Rulemaking and Revised Statement of Policy, 67 FR 57994 (Sept. 13, 2002); FERC Stats. & Regs. ¶ 32,564 (2002). The Commission issued its final rule on CEII on February 21, 2003, defining CEII to include information about proposed facilities, and to exclude information that simply identified the location of the infrastructure. See Order No. 630, 68 FR 9857, FERC Stats. & Regs. ¶ 31,140. After receiving a request for rehearing on Order No. 630, the Commission issued Order No. 630-A on July 23, 2003, denying the request for rehearing, but amending the rule in several respects. See Order No. 630-A, 68 FR 46456, FERC Stats. & Regs. ¶ 31,147. Specifically, the order on rehearing made several minor procedural changes and clarifications, added a reference in the regulation regarding the filing of NIP information, a term first described in Order No. 630, and added a commitment to review the effectiveness of the new process after six months. Also on July 23, 2003, the Commission issued Order No. 643, which revised the Commission's regulations to require companies to make certain information available directly to the public under certain circumstances. These revisions were necessary to conform the regulations to Order No. 630. See Order No. 643, 68 FR 52089, FERC Stats. & Regs. ¶ 31,149 (2003). In Order No. 662, the Commission modified its CEII regulations to ease the burden on agents of owners or operators of energy facilities that are seeking CEII relating to the owner/operator's own facility. The rule also simplified federal agencies' access to CEII. See Order No. 662, 70 FR 37031, FERC Stats. & Regs. ¶ 31,189 (2005).

Summary and Discussion

I. Regulatory Changes

A. Clarification of What Constitutes CEII

6. The CEII regulations were designed to restrict unfettered general public access to critical energy infrastructure information, but still permit those with a need for the information to obtain it in an efficient manner. In other words, CEII reflects a delicate balance between the due process rights of interested persons to participate fully in Commission proceedings and the Commission's responsibility to protect public safety by ensuring that access to CEII does not facilitate acts of terrorism. Although CEII was intended only to protect detailed information that would aid a terrorist attack, many submitters overutilize the designation. Therefore, the Commission is specifically clarifying and refining the definition to better inform companies of what constitutes CEII to limit the amount of material which constitutes CEII. CEII is clarified as specific engineering, vulnerability, or detailed design information about proposed or existing critical infrastructure that: (1) Relates details about the production, generation, transportation, transmission, or distribution of energy; (2) could be useful to a person in planning an attack on critical infrastructure; (3) is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552 (2000); and (4) does not simply give the general location of the critical infrastructure. The particular clarifications consist of adding the words “specific engineering, vulnerability, or detailed design” at the beginning of § 388.113(c)(1) and adding the words “details about” at the beginning of § 388.113(c)(1)(i).

7. The Commission further clarifies that narratives such as the descriptions of facilities and processes are generally not CEII unless they describe specific engineering and design details of critical infrastructure.

B. Requirement To Provide an Executed Non-Disclosure Agreement With a CEII Request

8. Requesters will now be required to submit an executed non-disclosure agreement with their signed requests. As CEII contains information that may be used to harm the critical infrastructure of the United States, it is only fitting to require that a requester execute an agreement not to disclose the information, and provide that agreement with his or her request. Often processing of a request is delayed because the requester does not promptly submit an executed non-disclosure agreement upon request. Posted on the Commission's Web site at http://www.ferc.gov are the various non-disclosure agreements that pertain to various types of requesters. For example, a member of the media should submit the non-disclosure agreement entitled Media NDA. If a requester does not know the appropriate non-disclosure agreement to submit with his or her request, he or she may contact the Office of External Affairs at [phone]. Including an executed non-disclosure agreement with an executed request will help to expedite processing of requests. A CEII request will not be accepted until the Commission receives an executed NDA.

II. Reiteration of Current Regulatory Standards

A. Notice and Opportunity To Comment and Notice Prior To Release

9. Section 388.112(d) of the Commission's regulations provides that, among other things, when a CEII requester seeks a document for which CEII status has been claimed, or when the Commission itself is considering releasing such a document, the Commission will provide the submitter of the document notice and an opportunity to comment. 18 CFR 388.112(d) (2006). Section 388.112(e) of the Commission's regulations provides that, among other things, the Commission or an appropriate official will give notice to the submitter prior to release of a document for which CEII status has been claimed. 18 CFR 388.112(e) (2006). In processing CEII requests, it has been the practice of the Commission to issue these notifications separately. Henceforth, the Commission will provide the notice and opportunity to comment in the same document as the notice of release.

10. The Commission acknowledges that the notice and comment process affords the Commission the opportunity to get information on the requester from the submitter, who may be most familiar with the requester, and the opportunity to get the submitter's input into potential harm from release of the information. However, experience has shown that only in a limited number of requests has the submitter provided information about the requester. In many instances, the submitter provides a boilerplate response that does not address release of information to a particular requester. In an effort to increase the efficiency of processing CEII requests, the Commission will combine the notice of release with an opportunity to comment. Submitters may still provide comments or input upon notice of release. The release would proceed as scheduled unless the CEII Coordinator or her designee receives opposition to release, in which case the CEII Coordinator or his or her designee will issue a revised notice. The vast majority of submitters support release with a properly executed NDA. Only in extremely rare instances would a submitter's comments be the determinative factor in not releasing CEII. These rare instances should not impede an efficient CEII process. In the event a submitter provides comments opposing release, the information would not be released until the submitter receives a revised notice of release.

B. Requirement To Segregate and Justify CEII

11. The CEII process was not intended as a mechanism for companies to withhold from public access information that does not pose a risk of attack on the energy infrastructure. Therefore, in an effort to achieve proper designation while avoiding misuse of the CEII designation, the Commission reiterates its requirement that submitters segregate public information from CEII and file as CEII only information which truly warrants being kept from ready public access.

12. To this end, the Commission emphasizes that the Commission's regulation at 18 CFR 388.112(b)(1) requires that submitters provide a justification for CEII treatment. The way to properly justify CEII treatment is by describing the information for which CEII treatment is requested and explaining the legal justification for such treatment.

C. Enforcement of Proper Designation and Justification

13. The Commission retains its concern for filing abuses and will take action against applicants or parties who knowingly misfile information as CEII, including rejection of an application where information is mislabeled as CEII or where a legal justification is not provided. Further, concurrent with this order, the Commission is issuing a notice of proposed rulemaking in Docket No. RM06-23-000 seeking comments on its proposal to, among other things, clarify what specific portions of various forms and reports submitted to the Commission contain CEII.

Information Collection Statement

14. The Office of Management and Budget's (OMB's) regulations require that OMB approve certain information collection requirements imposed by agency rule. See 5 CFR 1320.12 (2006). This final rule does not impose any additional information collection requirements. Therefore, the information collection regulations do not apply to this final rule.

Environmental Analysis

15. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment. See Order No. 486, Regulations Implementing the National Environmental Policy Act, 52 FR 47897 (Dec. 17, 1987), FERC Stats. & Regs. Preambles 1986-1990 ¶ 30,783 (1987). The Commission has categorically excluded certain actions from this requirement as not having a significant effect on the human environment. Included in the exclusions are rules that are clarifying, corrective, or procedural or that do not substantially change the effect of the regulations being amended. See 18 CFR 380.4(a)(2)(ii) (2006). This rule is procedural in nature and therefore falls under this exception; consequently, no environmental consideration is necessary.

Regulatory Flexibility Act Certification

16. The Regulatory Flexibility Act of 1980 (RFA) generally requires a description and analysis of final rules that will have significant economic impact on a substantial number of small entities. 5 U.S.C. 601-612 (2000). The Commission is not required to make such analyses if a rule would not have such an effect. The Commission certifies that this rule will not have such an impact on small entities.

Document Availability

17. In addition to publishing the full text of this document in the Federal Register, the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the Internet through FERC's Home Page (http://www.ferc.gov) and in FERC's Public Reference Room during normal business hours (8:30 a.m. to 5 p.m. eastern time) at 888 First Street, NE., Room 2A, Washington, DC 20426.

18. From FERC's Home Page on the Internet, this information is available in the Commission's document management system, eLibrary. The full text of this document is available on eLibrary in PDF and Microsoft Word format for viewing, printing, and/or downloading. To access this document in eLibrary, type the docket number excluding the last three digits of this document in the docket number field.

19. User assistance is available for eLibrary and the FERC's Web site during normal business hours. For assistance, please contact FERC Online Support at 1-866-208-3676 (toll free) or 202-502-6652 (e-mail at [e-mail]), or the Public Reference Room at 202-502-8371, TTY 202-502-8659 (e-mail at [e-mail]).

Effective Date

20. These regulations are effective November 2, 2006. The provisions of 5 U.S.C. 801 (2000) regarding Congressional review of final rules do not apply to this final rule, because the rule concerns agency procedure and practice and will not substantially affect the rights of non-agency parties.

List of Subjects in 18 CFR Part 388

• Confidential business information
• Freedom of information

By the Commission.

Magalie R. Salas,

Secretary.

In consideration of the foregoing, the Commission amends Part 388, Chapter I, Title 18, Code of Federal Regulations, as follows:

PART 388—INFORMATION AND REQUESTS

1. The authority citation for part 388 continues to read as follows:

Authority: 5 U.S.C. 301-305, 551, 552 (as amended), 553-557; 42 U.S.C. 7101-7352.

2. In § 388.113, paragraphs (c)(1), (d)(3)(i), and (d)(3)(ii) are revised to read as follows:

§ 388.113

Accessing critical energy infrastructure information.

* * * * *

(c) * * *

(1) Critical energy infrastructure information means specific engineering, vulnerability, or detailed design information about proposed or existing critical infrastructure that:

(i) Relates details about the production, generation, transportation, transmission, or distribution of energy;

(ii) Could be useful to a person in planning an attack on critical infrastructure;

(iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552; and

(iv) Does not simply give the general location of the critical infrastructure.

* * * * *

(d) * * *

(3) * * *

(i) File a signed, written request with the Commission's CEII Coordinator. The request must contain the following: Requester's name (including any other name(s) which the requester has used and the dates the requester used such name(s)), date and place of birth, title, address, and telephone number; the name, address, and telephone number of the person or entity on whose behalf the information is requested; a detailed statement explaining the particular need for and intended use of the information; and a statement as to the requester's willingness to adhere to limitations on the use and disclosure of the information requested. A requester must also file an executed non-disclosure agreement. Requesters are also requested to include their social security number for identification purposes.

(ii) Once the request is received, the CEII Coordinator will determine if the information is CEII, and, if it is, whether to release the CEII to the requester. The CEII Coordinator will balance the requester's need for the information against the sensitivity of the information. If the requester is determined to be eligible to receive the information requested, the CEII Coordinator will determine what conditions, if any, to place on release of the information. The CEII Coordinator's decisions regarding release of CEII are subject to rehearing as provided in § 385.713 of this chapter. Copies of requests for rehearing of the CEII Coordinator's decision must be served on the CEII Coordinator and the Associate General Counsel for General Law.

* * * * *