16 April 2003 Source: http://www.access.gpo.gov/su_docs/aces/fr-cont.html ----------------------------------------------------------------------- [Federal Register: April 16, 2003 (Volume 68, Number 73)] [Rules and Regulations] [Page 18538-18544] From the Federal Register Online via GPO Access [wais.access.gpo.gov] [DOCID:fr16ap03-5] ======================================================================= ----------------------------------------------------------------------- DEPARTMENT OF ENERGY Federal Energy Regulatory Commission 18 CFR Parts 4, 16, 141, 157 [Docket No. RM03-6-000] Amendments To Conform Regulations With Order No. 630 (Critical Energy Infrastructure Information Final Rule) April 9, 2003. AGENCY: Federal Energy Regulatory Commission. ACTION: Notice of proposed rulemaking. ----------------------------------------------------------------------- SUMMARY: The Federal Energy Regulatory Commission is proposing to revise its regulations requiring that companies make information directly [[Page 18539]] available to the public under certain circumstances. The revisions are necessary to conform these regulations to Order No. 630, which established guidelines for the handling of Critical Energy Infrastructure Information (CEII). In order to restrict availability of information that could be used in a terrorist attack against the nation's energy infrastructure, Order No. 630 explained that the Commission believed CEII would be exempt from disclosure under the Freedom of Information Act (FOIA). The order set out a definition of CEII and established procedures for persons with a legitimate need for such information to follow in seeking access to it. Order No. 630 only covered information submitted to or prepared by the Commission. The revisions proposed in this rulemaking address instances in which the Commission's rules and regulations require companies to make information available directly to the public. Revisions will be necessary to ensure that protection of CEII is consistent in both contexts. DATES: Comments are due May 16, 2003. ADDRESSES: Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC, 20426. FOR FURTHER INFORMATION CONTACT: Wilbur T. Miller, Office of General Counsel, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426. (202) 502-8953. SUPPLEMENTARY INFORMATION: I. Introduction 1. In this Notice of Proposed Rulemaking (NOPR), the Commission proposes specific changes to its regulations that require companies to make certain information available directly to the public. The changes are necessary to reconcile those regulations with Order No. 630, which established standards and procedures for the handling of Critical Energy Infrastructure Information (CEII) submitted to or created by the Commission.\1\ Because Order No. 630 addressed only situations in which a person might seek access to CEII that is in the Commission's possession, further changes to ensure consistent treatment and protection of CEII are needed where companies possess CEII and are required by the Commission's regulations to make it available to the public unconditionally. --------------------------------------------------------------------------- \1\ 68 FR 9857 (Mar. 3, 2003); III FERC Stats. & Regs. ] 31,140 (Feb. 21, 2003). [Copy below] --------------------------------------------------------------------------- 2. The Commission is proposing to revise its regulations in several areas. These include 18 CFR part 4, which requires that applicants for hydropower licenses, permits and exemptions make various types of information available to the public. Another area proposed for revision is 18 CFR part 16, which requires that applicants for projects subject to sections 14 and 15 of the Federal Power Act \2\ make specified information available to the public. A third area is 18 CFR 141.300, which establishes requirements for filing FERC Form No. 715, Annual Transmission Planning and Evaluation Report. The instructions to Form No. 715 in turn require that portions of the form be made available to the public by the public utility upon request. Finally, 18 CFR part 157 governs applications for certificates of public convenience and necessity, and for orders permitting and approving abandonment under section 7 of the Natural Gas Act. Several sections in part 157 require that certain information, some of which may be CEII, be made available by applicants to landowners or other members of the public. --------------------------------------------------------------------------- \2\ 16 U.S.C. 807-808. --------------------------------------------------------------------------- A. Order No. 630 3. Order No. 630 arose from the Commission's concern that CEII could be employed by terrorists to engineer attacks against the nation's energy facilities. In the wake of the September 11, 2001, tragedy, the Commission removed from easy public access various categories of documents that might contain CEII.\3\ The Commission issued a notice of inquiry \4\ on January 16, 2002, followed by a NOPR \5\ on September 5, 2002, seeking comments on the best procedures for protecting CEII. On February 21, 2003, the Commission issued a final rule in Order No. 630.\6\ --------------------------------------------------------------------------- \3\ See 67 FR 3129 (Jan. 23, 2002), IV FERC Stats. & Regs. ]35,542 (Jan. 16, 2002). \4\ Id. \5\ See 67 FR 57994 (Sept. 13, 2002), IV FERC Stats. & Regs. ] 32,564, (Sept. 5, 2002). \6\ See note 1. --------------------------------------------------------------------------- 4. In issuing the final rule, the Commission found that concerns for the safety of the public and the nation's energy systems compelled it to ensure that CEII is not readily available to the public.\7\ The Commission had previously taken steps to remove various categories of documents that were likely to contain CEII from public availability through the Internet, the Federal Energy Regulatory Records Information System (FERRIS), and the Commission's public reference room.\8\ Apart from reaffirming that decision, Order No. 630 stated the Commission's conclusion that, in light of the heightened appreciation for security concerns in the wake of the September 11 attack, information constituting CEII would be exempt from disclosure under one or more of the exemptions to FOIA.\9\ The Commission emphasized that Order No. 630 did not constitute a determination of the applicability of any FOIA exemption to any specific situation, but rather reflected the Commission's understanding of the exemptions' applicability to CEII, an understanding that informed the Commission's choices in the rulemaking. FOIA requests still must be processed on an individual basis as required by statute.\10\ --------------------------------------------------------------------------- \7\ 68 FR 9857, at pp. 9858-59. \8\ Id. at p. 9858. \9\ 5 U.S.C. 552; see 68 FR 9857 at pp. 9859-61, 9871-73 (Appendix B). \10\ 68 FR 9857, at pp. 9859-60. --------------------------------------------------------------------------- 5. Order No. 630 defined CEII in Sec. 388.113(c)(1) of the Commission's regulations as ``information about proposed or existing critical infrastructure that'': (i) Relates to the production, generation, transportation, transmission, or distribution of energy; (ii) Could be useful to a person in planning an attack on critical infrastructure; (iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552; and (iv) Does not simply give the location of the critical infrastructure.\11\ \11\ Id. at p. 9870. --------------------------------------------------------------------------- The order defined ``critical infrastructure'' in Sec. 388.113(c)(2) of the Commission's regulations as: existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters.\12\ --------------------------------------------------------------------------- \12\ Id. 6. Of particular concern to the Commission in defining CEII was location information. Such information is particularly relevant, for example, to participants in the National Environmental Policy Act (NEPA) process. Consequently, the Commission concluded that the --------------------------------------------------------------------------- following types of location information would not be considered CEII: (1) USGS 7.5-minutes topographic maps showing the location of pipelines, dams, or other aboveground facilities; (2) alignment sheets showing the location of pipeline and aboveground facilities, right of way dimensions, and extra work areas; (3) drawings showing site or project boundaries, footprints, building locations and reservoir extent; and (4) general location maps.\13\ --------------------------------------------------------------------------- \13\ Id. at p. 9862. The Commission stated, however, that it would not place this information on the Internet. Id. 7. For submission of CEII to the Commission, Order No. 630 adopted a [[Page 18540]] process that largely parallels the process for submission of confidential materials. The order revised section 388.112 of the Commission's regulations to provide that an entity submitting CEII to the Commission is responsible for identifying and marking CEII with the legend ``Contains Critical Energy Infrastructure Information-Do Not Release.'' Information identified as CEII is placed in a nonpublic file, with the Commission retaining the right to make a determination whether CEII treatment has been properly claimed. The submitter is notified in the event any person or entity requests release of the CEII, and also prior to any release of the information being made.\14\ --------------------------------------------------------------------------- \14\ Id. at p. 9870. --------------------------------------------------------------------------- 8. In reaching the conclusion that it could and should protect CEII, the Commission recognized that, in many instances, individuals and entities would have a legitimate need to obtain CEII. The Commission recognized, for instance, that interveners, landowners and other persons retained an interest in participating meaningfully in Commission proceedings. Order No. 630 also recognized other legitimate users of CEII, including state agencies and market participants seeking to develop new or expanded energy resources.\15\ --------------------------------------------------------------------------- \15\ Id. at pp. 9863, 9865. --------------------------------------------------------------------------- 9. In order to protect the legitimate interests of these and other users of CEII, Order No. 630 established the position of CEII Coordinator to consider requests for release of CEII. The order added Sec. 375.313 to the Commission's regulations to delegate authority to that official to consider such requests, and also added Sec. 388.113 to create procedures for requesting access to CEII.\16\ A person desiring access to CEII must file a written request with the CEII Coordinator containing the following information: --------------------------------------------------------------------------- \16\ Id. at pp. 9869-70. Requester's name, date and place of birth, title, address, and telephone number; the name, address, and telephone of the person or entity on whose behalf the information is requested; a detailed statement explaining the particular need for and intended use of the information; and a statement as to the requester's willingness to adhere to limitations on the use and disclosure of the information requested. Requesters are also requested to include their social security number for identification purposes.\17\ --------------------------------------------------------------------------- \17\ Id. at pp. 9870-71. In determining whether to grant a request for CEII, the CEII Coordinator is required to balance the requester's need for the information against the information's sensitivity. In the event the request is granted, the CEII Coordinator is authorized to impose conditions upon the requester's use of the information, including the requirement that the requester sign a non-disclosure agreement. Determinations by the CEII Coordinator are subject to rehearing under section 385.713 of the Commission's regulations.\18\ --------------------------------------------------------------------------- \18\ Id. at p. 9870. --------------------------------------------------------------------------- B. CEII Made Available Directly to the Public 10. During the comment process, some commenters noted that the Commission requires companies to make certain information available directly to the public and that such information, if it contained CEII, would not be covered by the rulemaking that culminated in Order No. 630. The Commission agreed with the need to eliminate this inconsistent treatment and stated that it would address the matter in future modifications to its regulations.\19\ The Commission has identified several such portions of its regulations. --------------------------------------------------------------------------- \19\ Id. at p. 9868. --------------------------------------------------------------------------- 1. Electric Transmission Provisions 11. One provision proposed for revision relates to FERC Form No. 715, the Annual Transmission Plan and Evaluation Report. The Commission's regulations, at 18 CFR 141.300, require the filing of Form No. 715. The form itself, in its instructions, states that ``[r]espondents must also make available to the public, upon request, in hard copy, the above items (Parts 1-6 of Form No. 715), and, in electronic form, items 1, 2, 4, 5, and 6.'' Some of the information that Form No. 715 calls for may include CEII.\20\ For example, part 2 requires ``regional or subregional case base power flow data.'' Part 3 requires ``transmission system maps and diagrams used by the Respondent for transmission planning.'' Part 4 requires detailed transmission planning reliability critieria. Part 5 requires transmission planning assessment practices. --------------------------------------------------------------------------- \20\ See ``New Reporting Requirements Implementing Section 213(b) of the Federal Power Act,'' 100 FERC ]61,141 (2002). In this order, the Commission modified its practice of making Form 715 available to the public. Due to national security considerations, it determined that certain portions of Form 715 would no longer be made available on the Commission's Web site or through its public databases. This change in policy was to remain in effect until the Commission took final action in Docket No. RM02-4-000. As explained above, a final rule was issued in Order No. 630, which is now pending rehearing. --------------------------------------------------------------------------- 2. Natural Gas Provisions 12. Another instance is the Commission's regulations governing applications for certificates of public convenience and necessity and for orders permitting abandonment. Under Sec. 157.10(b), copies of applications, supplements and amendments under part 157 of the Commission's regulations, including exhibits required by Sec. Sec. 157.14, 157.16 and 157.18, must be supplied on request to interveners.\21\ Complete copies of the filings must be made available in central locations in each county throughout the project area.\22\ The required exhibits include material that might be CEII, such as flow diagrams and related data,\23\ and total gas supply data.\24\ In addition to Sec. 157.10, Sec. Sec. 157.6(d), 157.22(e)(3)-(4) and 157.203(d) may also on occasion require that CEII be made available to certain persons. --------------------------------------------------------------------------- \21\ 18 CFR 157.10(b). Materials that are voluminous or difficult to reproduce may be made available in an accessible central location in each county in the project area. 18 CFR 157.10(b)(1). \22\ 18 CFR 157.10(c). \23\ 18 CFR 157.14(a)(7)-(9). \24\ 18 CFR 157.14(a)(10). --------------------------------------------------------------------------- 3. Hydropower Provisions 13. Part 4 of the Commission's regulations, which governs licenses, permits, exemptions and other applications under the Federal Power Act, contains a number of provisions that require applicants to make information about their projects available to the public. Under 18 CFR 4.32(a)(3), an applicant for a preliminary license, permit or exemption must provide notification to affected property owners. The notification must include Exhibit G to the application.\25\ 18 CFR 4.32(b)(3) and (b)(4) require the applicant to make information, including a copy of the application and all exhibits, available to the public for inspection and reproduction at specified locations.\26\ Under 18 CFR 4.34(i)(4)(i) and (i)(6)(iii), an applicant using alternative procedures must distribute an information package and maintain a public file of all relevant documents, including scientific studies. Finally, 18 CFR 4.38(g), which provides for pre-filing consultation in the case of an original license, requires the applicant to make available for public inspection various items, including detailed maps \27\ and a general engineering design.\28\ All of these provisions likely will require the public disclosure of CEII. --------------------------------------------------------------------------- \25\ 18 CFR 4.32(a)(3)(ii). \26\ 18 CFR 4.32(b)(3)(i), (b)(4)(ii)-(iv). \27\ 18 CFR 4.38(b)(1)(i). \28\ 18 CFR 4.38(b)(1)(ii). --------------------------------------------------------------------------- 14. Part 16, which specifies procedures for the takeover and relicensing of existing projects, also [[Page 18541]] contains public notification requirements. An applicant for a new license, at the time it notices its intention to apply for relicensing, must make available for public inspection \29\ a number of items, including the original application, as-built drawings, diagrams, emergency action plans, and operation and maintenance reports.\30\ In addition, the provisions regarding pre-filing consultation require that items including detailed maps and a general engineering design be made available for public inspection.\31\ These regulations would require the disclosure of CEII. --------------------------------------------------------------------------- \29\ See 18 CFR 16.7(e). \30\ 18 CFR 16.7(d)(1)-(2). \31\ 18 CFR 16.8(i); see 18 CFR 16.8(b)(1)(i)-(ii). --------------------------------------------------------------------------- 15. Parts 4 and 16, apart from containing provisions requiring that CEII be made available to the public, also in several instances require applicants to serve CEII on Indian tribes, resource agencies and other government offices. Such provisions are found at 18 CFR 4.32(b)(1)-(2); 4.38(b)(1), (c)(4), (d); 16.8(b)(1), (c)(4), (d). In Order No. 630, the Commission noted that the Federal Records Act \32\ effectively requires a Federal agency receiving information from another Federal agency to treat it in the same manner that the originating agency would have treated it.\33\ This requirement would not apply to the provisions listed above, however, because the resource agency would be receiving the CEII directly from the applicant, not from the Commission. Consequently, to ensure consistent treatment of CEII, the Commission proposes to add provisions for instances where information must be provided to other agencies and to tribes that would parallel the proposed provisions applicable to information made available to the public. The Commission notes that neither the proposals contained in this NOPR nor Order No. 630 is intended to require companies to withhold CEII. Instead, they are intended to ensure that the Commission's regulations do not require companies to reveal CEII. Consequently, the Commission anticipates that, in most instances, companies will share CEII with other Federal agencies without requiring other agencies to request access to CEII. --------------------------------------------------------------------------- \32\ 44 U.S.C. 3510(b). \33\ 68 FR 9857, at p. 9866. --------------------------------------------------------------------------- II. Discussion 16. The Commission in this NOPR proposes to reconcile the requirements for making information available to the public with Order No. 630 by providing that companies subject to the disclosure requirements of Form No. 715 and parts 4, 16 and 157 omit CEII from the information made available. Instead, the company would include a statement briefly describing the omitted information, without revealing CEII, and referring the reader to the procedures for challenging CEII claims and for requesting CEII. Such challenges and requests would take place under the procedures adopted in Order No. 630 and found in 18 CFR 388.112 and 388.113, employing the definition of CEII found at 18 CFR 388.113(c). Therefore, a member of the public could still obtain the information, but would have to follow procedures different from those applicable now. 17. The treatment of CEII under the proposed procedures should largely parallel the treatment of the same information filed with the Commission. Form No. 715 and parts 4, 16 and 157 require that companies make available certain portions of information that they are submitting to the Commission. Consequently, the company should simply omit, from the information made available to the public, all materials designated as CEII in its submission to the Commission. The proposed revisions require that the company adhere to any previous determinations by the Commission or the CEII Coordinator as to the status of any information claimed to constitute CEII.\34\ Thus, if information designated as CEII in the submission to the Commission is later determined not to constitute CEII, the company should make that information available as specified in the pertinent regulation. This approach should be relatively simple and straightforward. The Commission invites comments, however, on any other approach that might function better. --------------------------------------------------------------------------- \34\ Sections 157.6(d)(3)(iv), 157.22(e)(4), and 157.203(d) require information to be made available that would not necessarily be identical to information submitted to the Commission. For example, 18 CFR 157.6(d)(3)(iv) requires that an applicant include in a notice to landowners a description of the proposed project. This description would not necessarily be contained in the application submitted to the Commission. As explained below, the Commission believes that, as a practical matter, these three provisions will seldom if ever require an applicant to make CEII available. Should such a situation arise, it would be the applicant's responsibility to determine what information constituted CEII and omit it from the information made available. --------------------------------------------------------------------------- 18. Besides Sec. 157.10, other provisions in part 157 could conceivably be interpreted as requiring the disclosure by a company of CEII. Section 157.6(d) requires notification to affected landowners, including a description of ``the proposed project [and] its location (including a general location map).''\35\ Where the Commission approves a pre-filing collaborative process, the applicant must maintain a public file of all relevant documents.\36\ Finally, in the case of blanket certificates, an applicant must provide notice to landowners, including a brief description of facilities to be constructed or replaced.\37\ In each of these cases, the Commission believes it should ordinarily be unnecessary for the applicant to release CEII. Where maps or other descriptions are required, it should be possible for the applicant to meet the requirement without including information so detailed or sensitive that it would require the inclusion of CEII, particularly given that Order No. 630 omitted location information from the definition of CEII. Where a NEPA Pre-Filing process or collaborative process is approved, there are no specific requirements that should lead to the disclosure of CEII. The regulation simply requires that the applicant make available all ``relevant documents.'' The Commission does not interpret this provision as requiring the disclosure of CEII. Nevertheless, in the interest of caution the Commission is proposing to amend all three provisions to provide for the protection of CEII. --------------------------------------------------------------------------- \35\ 18 CFR 157.6(d)(3)(iv). \36\ 18 CFR 157.22(e)(4). \37\ 18 CFR 157.203(d). --------------------------------------------------------------------------- 19. The Commission invites comment on provisions in its rules and regulations other than those specifically discussed in this NOPR that may require revisions to ensure consistency with Order No. 630. 20. The Commission notes that it does not intend to revisit issues already addressed in Order No. 630. Such issues include the need for protecting CEII, the definition of CEII, and the procedures for submitting and obtaining access to CEII.\38\ The Commission also notes that FOIA has no bearing on the matters discussed in this NOPR, as it concerns only requirements that companies make information available, not requests to obtain information from the Commission. --------------------------------------------------------------------------- \38\ Those issues are still subject to rehearing as part of Docket No. RM02-4-000. That proceeding remains the appropriate forum for their resolution. --------------------------------------------------------------------------- III. Information Collection Statement 21. Office of Management and Budget (OMB) regulations require OMB to approve certain information collection requirements imposed by agency rule.\39\ The public disclosure of information originally supplied by an agency to the recipient is, however, excluded from the [[Page 18542]] coverage of the regulations.\40\ The only information collection requirement contained in this proposed rulemaking is a requirement that companies include a statement outlining the procedures for seeking access to CEII. Because that statement would be supplied by the Commission, the information collection regulations do not apply to this proposed rulemaking. --------------------------------------------------------------------------- \39\ 5 CFR 1320.12. \40\ 5 CFR 1320.3(c)(2). --------------------------------------------------------------------------- IV. Environmental Analysis 22. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment.\41\ The Commission has categorically excluded certain actions from this requirement as not having a significant effect on the human environment. Included in the exclusion are rules that are clarifying, corrective, or procedural or that do not substantially change the effect of the regulations being amended.\42\ This proposed rule, if finalized, is procedural in nature and therefore falls under this exception; consequently, no environmental consideration would be necessary. --------------------------------------------------------------------------- \41\ Order No. 486, Regulations Implementing the National Environmental Policy Act, 52 FR 47897 (Dec. 17, 1987), FERC Stats. & Regs. Preambles 1986-1990 ]30,783 (1987). \42\ 18 CFR 380.4(a)(2)(ii). --------------------------------------------------------------------------- V. Regulatory Flexibility Act Certification 23. The Regulatory Flexibility Act of 1980 (RFA) \43\ generally requires a description and analysis of final rules that will have significant economic impact on a substantial number of small entities. The Commission is not required to make such analyses if a rule would not have such an effect. The Commission certifies that this proposed rule, if finalized, would not have such an impact on small entities. --------------------------------------------------------------------------- \43\ 5 U.S.C. 601-612. --------------------------------------------------------------------------- VI. Comment Procedure 24. The Commission invites interested persons to submit written comments on the matters and issues proposed in this notice to be adopted, including any related matters or alternative proposals that commenters may wish to discuss. Comments are due May 16, 2003. Comments must refer to Docket No. RM03-6-000, and may be filed either in electronic or paper format. Those filing electronically do not need to make a paper filing. 25. Documents filed electronically via the Internet can be prepared in a variety of formats, including WordPerfect, MS Word, Portable Document Format, Rich Text Format, or ASCII format, as listed on the Commission's Web site at http://ferc.gov, under the e-Filing link. The e-Filing link provides instructions for how to Login and complete an electronic filing. First time users will have to establish a user name and password. The Commission will send an automatic acknowledgment to the sender's E-Mail address upon receipt of comments. User assistance for electronic filing is available at 202-502-8258 or by E-Mail to efiling@ferc.gov. Comments should not be submitted to the E-Mail address. 26. For paper filings, the original and 14 copies of such comments should be submitted to the Office of the Secretary, Federal Energy Regulatory Commission, 888 First Street, NE., Washington DC 20426. 27. All comments will be placed in the Commission's public files and will be available for inspection in the Commission's Public Reference Room at 888 First Street, NE., Washington DC 20426, during regular business hours. Additionally, all comments may be viewed, printed, or downloaded remotely via the Internet through FERC's home page using the FERRIS link. VII. Document Availability 28. In addition to publishing the full text of this document in the Federal Register, the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the Internet through FERC's home page (http://www.ferc.gov) and in FERC's Public Reference Room during normal business hours (8:30 a.m. to 5 p.m. eastern time) at 888 First Street, NE., Room 2A, Washington, DC 20426. 29. From FERC's home page on the Internet, this information is available in the Federal Energy Regulatory Records Information System (FERRIS). The full text of this document is available on FERRIS in PDF and WordPerfect format for viewing, printing, and/or downloading. To access this document in FERRIS, type the docket number excluding the last three digits of this document in the docket number field. 30. User assistance is available for FERRIS and the FERC's Web site during normal business hours by contacting, FERC Online Support at FERCOnlineSupport@ferc.gov or toll-free at (866) 208-3676, for TTY (202) 502-8659. List of Subjects 18 CFR Part 4 Administrative practice and procedure, Electric power, Reporting and recordkeeping requirements. 18 CFR Part 16 Administrative practice and procedure, Electric power, Reporting and recordkeeping requirements. 18 CFR Part 141 Electric power, Reporting and recordkeeping requirements. 18 CFR Part 157 Administrative practice and procedure, Natural Gas, Reporting and recordkeeping requirements. By direction of the Commission. Magalie R. Salas, Secretary. 0 In consideration of the foregoing, the Commission proposes to amend parts 4, 16, 141 and 157, chapter I, title 18, Code of Federal Regulations, as follows. PART 4--LICENSES, PERMITS, EXEMPTIONS AND DETERMINATION OF PROJECT COSTS 0 1. The authority citation for part 141 continues to read as follows: Authority: 16 U.S.C. 791a-825r, 2601-2645; 42 U.S.C. 7101-7352. 0 2. Section 4.32 is amended by adding paragraph (k) as follows: Sec. 4.32 Acceptance for filing or rejection; information to be made available to the public; requests for additional studies. * * * * * (k) Critical Energy Infrastructure Information. (1) If this section requires an applicant to reveal Critical Energy Infrastructure Information (CEII), as defined in Sec. 388.113(c) of this chapter, to any person, the applicant shall omit the CEII from the information made available and insert the following in its place: (i) A statement that CEII is being withheld; (ii) A brief description of the omitted information that does not reveal any CEII; and (iii) This statement: ``Procedures for obtaining access to Critical Energy Infrastructure Information (CEII) may be found at 18 CFR Sec. 388.113. Requests for access to CEII should be made to the Commission's CEII Coordinator.'' (2) The applicant, in determining whether information constitutes CEII, shall treat the information in a manner consistent with any filings that applicant has made with the [[Page 18543]] Commission and shall adhere to any previous determinations by the Commission or the CEII Coordinator involving the same or like information. (3) The procedures contained in Sec. Sec. 388.112 and 388.113 of this chapter regarding designation of, and access to, CEII, shall apply in the event of a challenge to a CEII designation or a request for access to CEII. If it is determined that information is not CEII or that a requester should be granted access to CEII, the applicant will be directed to make the information available to the requester. 0 3. Section 4.34 is amended by adding paragraph (i)(10) as follows: Sec. 4.34 Hearings on applications; consultation on terms and conditions; motions to intervene; alternative procedures. * * * * * (i) Alternative procedures. * * * (10) If this section requires an applicant to reveal Critical Energy Infrastructure Information (CEII), as defined by Sec. 388.113(c) of this chapter, to the public, the applicant shall follow the procedures set out in Sec. 4.32(k). 0 4. Section 4.38 is amended by adding paragraph (i) as follows: Sec. 4.38 Consultation requirements. * * * * * (i) Critical Energy Infrastructure Information. If this section requireS an applicant to reveal Critical Energy Infrastructure Information (CEII), as defined by Sec. 388.113(c) of this chapter, to any person, the applicant shall follow the procedures set out in Sec. 4.32(k) of this subpart. PART 16--PROCEDURES RELATING TO TAKEOVER AND RELICENSING OF LICENSED PROJECTS 0 5. The authority citation for part 16 continues to read as follows: Authority: 16 U.S.C. 791a-825r; 42 U.S.C. 7101-7352. 0 6. Section 16.7 is amended by adding paragraph (d)(7) as follows: Sec. 16.7 Information to be made available to the public at the time of notification of intent under section 15(b) of the Federal Power Act. * * * * * (d) Information to be made available. * * * (7) If paragraph (d) of this section requires an applicant to reveal Critical Energy Infrastructure Information (CEII), as defined in Sec. 388.113(c) of this chapter, to the public, the applicant shall omit the CEII from the information made available and insert the following in its place: (i) A statement that CEII is being withheld; (ii) A brief description of the omitted information that does not reveal any CEII; and (iii) This statement: ``Procedures for obtaining access to Critical Energy Infrastructure Information (CEII) may be found at 18 CFR Sec. 388.113. Requests for access to CEII should be made to the Commission's CEII Coordinator.'' (A) The applicant, in determining whether information constitutes CEII, shall treat the information in a manner consistent with any filings that applicant has made with the Commission and shall adhere to any previous determinations by the Commission or the CEII Coordinator involving the same or like information. (B) The procedures contained in Sec. Sec. 388.112 and 388.113 of this chapter regarding designation of, and access to, CEII, shall apply in the event of a challenge to a CEII designation or a request for access to CEII. If it is determined that information is not CEII or that a requester should be granted access to CEII, the applicant will be directed to make the information available to the requester. * * * * * 0 7-8. Section 16.8 is amended by adding paragraph (k) as follows: Sec. 16.8 Consultation requirements. * * * * * (k) Critical Energy Infrastructure Information. If this section requires an applicant to reveal Critical Energy Infrastructure Information (CEII), as defined by Sec. 388.113(c) of this chapter, to any person, the applicant shall follow the procedures set out in Sec. 16.7(d)(7) of this subpart. PART 141--STATEMENTS AND REPORTS (SCHEDULES) 0 9. The authority citation for part 141 continues to read as follows: Authority: 15 U.S.C. 79; 16 U.S.C. 791a-828c, 2601-2645; 31 U.S.C. 9701; 42 U.S.C. 7101-7352. 0 10. Section 141.300 is amended by adding paragraph (d) as follows: Sec. 141.300 FERC Form No. 715, Annual Transmission Planning and Evaluation Report. * * * * * (d) Critical Energy Infrastructure Information. (1) If the instructions in Form No. 715 require a utility to reveal Critical Energy Infrastructure Information (CEII), as defined in Sec. 388.113(c) of this chapter, to the public, the utility shall omit the CEII from the information made available and insert the following in its place: (i) A statement that CEII is being withheld; (ii) A brief description of the omitted information that does not reveal any CEII; and (iii) This statement: ``Procedures for obtaining access to Critical Energy Infrastructure Information (CEII) may be found at 18 CFR Sec. 388.113. Requests for access to CEII should be made to the Commission's CEII Coordinator.'' (2) The utility completing Form No. 715, in determining whether information constitutes CEII, shall treat the information in a manner consistent with any filings that utility has made with the Commission and shall adhere to any previous determinations by the Commission or the CEII Coordinator involving the same or like information. (3) The procedures contained in Sec. Sec. 388.112 and 388.113 of this chapter regarding designation of, and access to, CEII, shall apply in the event of a challenge to a CEII designation or a request for access to CEII. If it is determined that information is not CEII or that a requester should be granted access to CEII, the utility will be directed to make the information available to the requester. PART 157--APPLICATIONS FOR CERTIFICATES OF PUBLIC CONVENIENCE AND NECESSITY AND FOR ORDERS PERMITTING AND APPROVING ABANDONMENT UNDER SECTION 7 OF THE NATURAL GAS ACT 0 11. The authority citation for part 157 continues to read as follows: Authority: 15 U.S.C. 717-717w, 3301-3432; 42 U.S.C. 7101-7352. 0 12. Section 157.6 is amended by adding paragraph (d)(6) as follows: Sec. 157.6 Applications; general requirements. * * * * * (d) Landowner notification. * * * (6) If paragraph (d)(3) of this section requires an applicant to reveal Critical Energy Infrastructure Information (CEII), as defined by Sec. 388.113(c) of this chapter, to a landowner, the applicant shall follow the procedures set out in Sec. 157.10(d). 0 13. Section 157.10 is amended by adding paragraph (d) as follows: Sec. 157.10 Interventions and protests. * * * * * (d) Critical Energy Infrastructure Information. (1) If this section requires an applicant to reveal Critical Energy Infrastructure Information (CEII), as [[Page 18544]] defined in Sec. 388.113(c) of this chapter, to the public, the applicant shall omit the CEII from the information made available and insert the following in its place: (i) A statement that CEII is being withheld; (ii) A brief description of the omitted information that does not reveal any CEII; and (iii) This statement: ``Procedures for obtaining access to Critical Energy Infrastructure Information (CEII) may be found at 18 CFR Sec. 388.113. Requests for access to CEII should be made to the Commission's CEII Coordinator.'' (2) The applicant, in determining whether information constitutes CEII, shall treat the information in a manner consistent with any filings that applicant has made with the Commission and shall adhere to any previous determinations by the Commission or the CEII Coordinator involving the same or like information. (3) The procedures contained in Sec. Sec. 388.112 and 388.113 of this chapter regarding designation of, and access to, CEII, shall apply in the event of a challenge to a CEII designation or a request for access to CEII. If it is determined that information is not CEII or that a requester should be granted access to CEII, the applicant will be directed to make the information available to the requester. 0 14. Section 157.14 is amended by revising paragraph (a) to read as follows: Sec. 157.14 Exhibits. (a) To be attached to each application. All exhibits specified must accompany each application when tendered for filing. Together with each exhibit applicant must provide a full and complete explanation of the data submitted, the manner in which it was obtained, and the reasons for the conclusions derived from the exhibits. If the Commission determines that a formal hearing upon the application is required or that testimony and hearing exhibits should be filed, the Secretary will promptly notify the applicant that submittal of all exhibits and testimony of all witnesses to be sponsored by the applicant in support of his case-in-chief is required. Submittal of these exhibits and testimony must be within 20 days from the date of the Secretary's notice, or any other time as the Secretary will specify. Exhibits, except exhibits F, F-1, G, G-I, G-II, and H(iv), must be submitted to the Commission on electronic media as prescribed in Sec. 385.2011 of this chapter. Interveners and persons becoming interveners after the date of the Secretary's notice must be advised by the applicant of the afore-specified exhibits and testimony, and must be furnished with copies upon request. If this section requires an applicant to reveal Critical Energy Infrastructure Information (CEII), as defined by Sec. 388.113(c) of this chapter, to an intervener, the applicant shall follow the procedures set out in Sec. 157.10(d). * * * * * 0 15. Section 157.16 is amended by revising the introductory text to read as follows: Sec. 157.16 Exhibits relating to acquisitions. In addition to the exhibits required by Sec. 157.14, every application involving acquisition of facilities must be accompanied by the exhibits listed below. Together with each exhibit applicant must provide a full and complete explanation of the data submitted, the manner in which it was obtained, and the reasons for the conclusions derived from the exhibits, unless the applicant includes a statement identifying the schedule and rate containing the required information and data filed as prescribed in Sec. 385.2011 of this chapter. If the Commission determines that a formal hearing upon the application is required or that testimony and hearing exhibits should be filed, the Secretary will promptly notify the applicant that submittal of all the exhibits and testimony of all witnesses to be sponsored by the applicant in support of his case-in-chief is required. Submittal of these exhibits and testimony must be within 20 days from the date of the Secretary's notice, or any other time specified by the Secretary in the notice. Sections 157.6(a) and 385.2011 of this chapter will govern the submissions required to be furnished to the Commission. Interveners and persons becoming interveners after the date of the Secretary's notice must be advised by the applicant of the afore-specified exhibits and testimony, and must be furnished with copies upon request. If this section requires an applicant to reveal Critical Energy Infrastructure Information (CEII), as defined by Sec. 388.113(c) of this chapter, to an intervener, the applicant shall follow the procedures set out in Sec. 157.10(d). * * * * * 0 16. Section 157.22 is amended by adding paragraph (e)(9) as follows: Sec. 157.22 Collaborative procedures for applications for certificates of public convenience and necessity and for orders permitting and approving abandonment. * * * * * (e) * * * (9) If paragraph (e)(3) or (e)(4) requires an applicant to reveal Critical Energy Infrastructure Information (CEII), as defined by Sec. 388.113(c) of this chapter, to the public, the applicant shall follow the procedures set out in Sec. 157.10(d) of this subpart. * * * * * 15. Section 157.203 is amended by adding paragraph (d)(4) as follows: Sec. 157.203 Blanket certification. * * * * * (d) Landowner notification. * * * (4) If paragraph (d)(1) or (d)(2) of this section require an applicant to reveal Critical Energy Infrastructure Information (CEII), as defined by Sec. 388.113(c) of this chapter, to landowners, the applicant shall follow the procedures set out in Sec. 157.10(d). [FR Doc. 03-9267 Filed 4-15-03; 8:45 am] BILLING CODE 6717-01-P ---------------------------------------------------------------------- [Federal Register: March 3, 2003 (Volume 68, Number 41)] [Rules and Regulations] [Page 9857-9873] From the Federal Register Online via GPO Access [wais.access.gpo.gov] [DOCID:fr03mr03-4] ======================================================================= ----------------------------------------------------------------------- DEPARTMENT OF ENERGY Federal Energy Regulatory Commission 18 CFR Parts 375 and 388 [Docket Nos. RM02-4-000, PL02-1-000; Order No. 630] Critical Energy Infrastructure Information February 21, 2003. AGENCY: Federal Energy Regulatory Commission, DOE. ACTION: Final rule. ----------------------------------------------------------------------- SUMMARY: The Federal Energy Regulatory Commission (Commission) is issuing this final rule establishing a procedure for gaining access to critical energy infrastructure information (CEII) that would otherwise not be available under the Freedom of Information Act (FOIA). These restrictions and the final rule were necessitated by the terrorist acts committed on September 11, 2001, and the ongoing terrorism threat. The final rule adopts a definition of critical infrastructure that explicitly covers proposed facilities, and does not distinguish among projects or portions of projects. The rule also details which location information is excluded from the definition of CEII and which is included. The rule addresses some issues that are specific to state agencies, and clarifies that energy market consultants should be able to get access to the CEII they need. Finally, the rule modifies the proposed CEII process and delegates responsibility to the CEII Coordinator to process requests for CEII and to determine what information qualifies as CEII. The final rule will affect the way in which companies submit some information, and will add a new process in addition to the FOIA for requesters to use to request information that is not already publicly available. These new steps will help keep sensitive infrastructure information out of the public domain, decreasing the likelihood that such information could be used to plan or execute terrorist attacks. EFFECTIVE DATE: The rule will become effective April 2, 2003. FOR FURTHER INFORMATION CONTACT: Carol C. Johnson, Wilbur T. Miller, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426. (202) 502-6457. SUPPLEMENTARY INFORMATION: 1. In this final rule, the Federal Energy Regulatory Commission (Commission) amends its regulations to address the appropriate treatment of critical energy infrastructure information (CEII) in the aftermath of the September 11, 2001, terrorist attacks on the United States of America. Under the Policy Statement issued in Docket No. PL02-1-000 on October 11, 2001 (Policy Statement), the Commission removed from easy public access certain documents that previously had been public.\1\ In order to accomplish this step quickly, staff identified categories of document types that were likely to contain CEII, and those documents were removed from unrestricted public access. Persons seeking removed documents were directed to request the records using the Freedom of Information Act.\2\ --------------------------------------------------------------------------- \1\ See 67 FR 3129 (Jan. 23, 2002), IV FERC Stats. & Regs. ] 35,542. \2\ 5 U.S.C. 552. --------------------------------------------------------------------------- 2. On January 16, 2002, the Commission issued a Notice of Inquiry (NOI) in RM02-4-000 to determine what changes, if any, should be made to its regulations to restrict unfettered general public access to critical energy infrastructure information, but still permit those with a need for the information to obtain it in an efficient manner.\3\ On September 5, 2002, the Commission issued a Notice of Proposed Rulemaking and Revised Statement of Policy (NOPR) in Docket Nos. RM02- 4-000 and PL02-1-000.\4\ The NOPR proposed procedures for submitting and requesting CEII, and proposed the creation of a new position of CEII Coordinator. The final rule adopts most of the procedures proposed in the NOPR and creates the new position. --------------------------------------------------------------------------- \3\ See 67 FR 3129, IV FERC Stats. & Regs. ] 35,542. \4\ See 67 FR 57994 (Sept. 13, 2002), IV FERC Stats. & Regs. ] 32,564. --------------------------------------------------------------------------- 3. The process adopted in the final rule offers a more efficient alternative to handling requests for previously public documents than does the FOIA, which the Policy Statement established as the short-term method for requesting previously public documents. The FOIA was useful in the short term where a great deal of information had been removed from public access, some of which the Commission ultimately ascertained did not actually contain CEII. As discussed in the NOPR, however, the FOIA process is not well suited for handling CEII requests.\5\ The FOIA mandates disclosure of agency records unless the record falls within one of several specifically enumerated exemptions. Therefore, in order for CEII to be protected from disclosure, it must qualify for a FOIA exemption. For this reason, it is unlikely that requesters will obtain CEII through the FOIA process, although they could use the FOIA to obtain non-CEII portions of documents. In addition, under the FOIA, an agency may not distinguish among requesters based on their particular need for the information. Information given to one FOIA requester must be given to all requesters. The agency also may not restrict the recipient's use or dissemination of the information. All these factors make FOIA an unsatisfactory tool for the agency to use if it wishes to afford requesters with a specific need for information access to exempt and potentially dangerous information. Therefore, the Commission is adding Sec. 375.313 to its regulations to authorize a Critical Energy Infrastructure Information Coordinator to process non-FOIA requests for CEII and make determinations regarding such requests.\6\ --------------------------------------------------------------------------- \5\ Id. at p. 57995, ] 32,564 at p. 34,539. \6\ Of course, the Commission emphasizes that requesters always retain the option of seeking information under the FOIA. --------------------------------------------------------------------------- [[Page 9858]] 4. The NOPR revised the Policy Statement to restrict public access to documents containing detailed specifications of proposed facilities as well as existing facilities, while at the same time determining that basic location information should not be treated as CEII.\7\ The final rule formalizes these policies in the regulations. --------------------------------------------------------------------------- \7\ 67 FR 57994 at p. 57995, FERC Stats. & Regs. ] 32,564 at p. 34,539. --------------------------------------------------------------------------- 5. The Commission is issuing this rule under the authority of the Federal Power Act \8\ and the Natural Gas Act \9\ as the rule establishes a procedure for gaining access to documents collected or created pursuant to those acts that would not otherwise be available under the Freedom of Information Act, 5 U.S.C. 552. Accordingly, this order is subject to rehearing under section 313(b) of the Federal Power Act, 16 U.S.C. 824l(b), and section 19(b) of the Natural Gas Act, 15 U.S.C. 717r(b), and jurisdiction to review the order lies in the United States Courts of Appeals as provided in those sections. --------------------------------------------------------------------------- \8\ 15 U.S.C. 717, et seq. \9\ 16 U.S.C. 791a, et seq. --------------------------------------------------------------------------- I. Background A. The Policy Statement 6. The September 11, 2001, terrorist attacks prompted the Commission to issue a policy statement on October 11, 2001, in PL02-1- 000, addressing the treatment of previously public documents.\10\ The Commission announced there that it would no longer make available to the public through its Internet site, the Records and Information Management System (RIMS), which has been replaced by the Federal Energy Regulatory Records Information System (FERRIS), or the Public Reference Room, documents such as oversized maps that detail the specifications of energy facilities already licensed or certificated under Part I of the Federal Power Act \11\ and section 7(c) of the Natural Gas Act,\12\ respectively. Rather, anyone requesting such documents was directed to follow the procedures set forth in section 388.108 of the Commission's regulations (Requests for Commission records not available through the Public Reference Room (FOIA Requests)).\13\ The Policy Statement also instructed staff to report back to the Commission within 90 days on the impact of this newly announced policy on the agency's business. --------------------------------------------------------------------------- \10\ See 66 FR 52917 (Oct. 18, 2001), 97 FERC ] 61,030. Shortly after the attacks, the Commission issued another policy statement in Docket No. PL01-6-000, in which it provided guidance to regulated companies regarding extraordinary expenditures necessary to safeguard national energy supplies. See 96 FERC ] 61,299 (2001). The Commission recognized there that electric, gas, and oil companies may need to adopt new procedures, update existing procedures, and install facilities to further safeguard their systems, and that these efforts might result in extraordinary expenditures. The Commission assured these companies that it would give its highest priority to processing any filing made for the recovery of such expenditures. See, e.g., Colonial Pipeline Co., 100 FERC ] 61,035 (2002) (approving Colonial's security surcharge mechanism). \11\ 16 U.S.C. 719a, et seq. \12\ 15 U.S.C. 717f(c). \13\ 18 CFR 388.108 (2002). --------------------------------------------------------------------------- B. Implementation of the Policy Statement 7. To implement the policy, the Commission's staff first disabled RIMS access to all oversized documents, which frequently contain detailed infrastructure information, and also removed them from the Public Reference Room.\14\ Staff next identified and disabled or denied access to other categories of documents dealing with licensed or exempt hydropower projects, certificated natural gas pipelines, and electric transmission lines that appeared likely to include critical energy infrastructure information. This effort, which was undertaken as cautiously and methodically as possible, affected tens of thousands of documents. --------------------------------------------------------------------------- \14\ OMB Watch has misunderstood what was meant by oversized documents, stating ``[c]learly file size was used as a criterion for removal of information,'' terming this a ``blunt and clumsy approach.'' OMB Watch at p. 3. As explained in the Policy Statement, the Commission removed ``documents, such as oversized maps.'' ``Oversized'' refers to the size of the page itself, not the length of the document. Oversized documents generally contain maps and detailed diagrams, both of which were deemed likely to contain CEII, keeping in mind that location information of existing facilities was being protected at that time. --------------------------------------------------------------------------- 8. From the issuance of the Policy Statement until mid-January 2003, the Commission received 212 FOIA requests for documents that were not available to the public because of the Policy Statement. The Commission has responded to or otherwise resolved all of these requests. To date, only two CEII requesters have filed timely administrative appeals of the decisions to withhold documents, both of which involved requests for FERC Form No. 715. Nothing is pending in court. C. The Notice of Inquiry 9. Three months after the Commission issued the Policy Statement, it issued the Notice of Inquiry (NOI).\15\ The NOI set forth the Commission's general views on how it intended to treat previously public documents, and asked specific questions on the scope and implications of maintaining the confidentiality of certain previously public documents. The NOI advised infrastructure owners that they could seek confidential treatment of filings or parts of filings that, in their opinion, contain CEII, following the existing procedures in Sec. 388.112 of the Commission's regulations,\16\ and by referencing Docket No. PL02-1-000 on the first page of the filing. Approximately 50 entities responded to the NOI, with a handful of commenters filing some portion of their filing nonpublic. --------------------------------------------------------------------------- \15\ See 67 FR 3129, IV FERC Stats. & Regs. ] 35,542. \16\ 18 CFR 388.112. --------------------------------------------------------------------------- D. The Notice of Proposed Rulemaking and Revised Policy Statement 10. On September 5, 2002, the Commission issued the Notice of Proposed Rulemaking and Revised Statement of Policy (NOPR) in Docket Nos. RM02-4-000 and PL02-1-000.\17\ The NOPR proposed to establish a CEII Coordinator with delegated authority to process requests for CEII, and proposed regulations governing submission of CEII and requests for CEII.\18\ It also revised the Policy Statement to extend CEII protection to information regarding proposed facilities and eliminate CEII protection for information that only reveals the location of the facility.\19\ The Commission received more than forty comments in response to the NOPR. A list of commenters is attached as Appendix A. --------------------------------------------------------------------------- \17\ See 67 FR 57994, IV FERC Stats. & Regs. ] 32,564. \18\ Id. at p. 58001, ] 32,564 at p. 34,550. \19\ Id. at p. 58000, ] 32,564 at pp. 34,547-48. --------------------------------------------------------------------------- II. Discussion A. The Need for Action 11. As was the case with the NOI, most commenters agree that security considerations make it advisable for the Commission to continue to protect CEII. A few commenters, however, maintain that such protection is either unnecessary to protect the public or outweighed by the benefits of making the information available. Some contend that CEII will be of little use to terrorists,\20\ an assertion with which some commenters specifically disagree.\21\ Some commenters believe that the NOPR did not adequately take into account the value of making information such as CEII available to the public, and specifically the media.\22\ [[Page 9859]] One commenter contends, for example, that the media has used such information to expose safety hazards in pipelines.\23\ --------------------------------------------------------------------------- \20\ E.g., American Library Association at p. 2; Lydia Olchoff at p. 1; Reporters Committee for Freedom of the Press and the Society of Environmental Journalists (Reporters Committee) at p. 3. \21\ E.g., GE Power Systems Energy Consulting (GE) at pp. 2-3. \22\ E.g., American Library Association at p. 1; OMB Watch at p. 1, 4. \23\ Reporters Committee at p. 3-4. The Commission does not, however, have jurisdiction over pipeline safety issues, which belongs to the Department of Transportation. See 49 U.S.C. Chapter 601. --------------------------------------------------------------------------- 12. The Commission remains convinced that the responsible course is for it to protect CEII. The arguments that such protection is unnecessary are speculative and unconvincing. For instance, one commenter points to an estimate that seventy percent of infrastructure attacks come from insiders as evidence that CEII is unlikely to aid an attack,\24\ while another states that ``the possibility that terrorists will study government records and take advantage of perceived weaknesses is speculative.''\25\ The Commission is not prepared to stake the public's safety on this reasoning. According to the National Infrastructure Protection Center, the energy sector is considered one of the most attractive terrorist targets.\26\ According to media reports, the FBI identified ``multiple casings of sites'' where users routed through switches in Saudi Arabia, Indonesia, and Pakistan examined ``emergency phone systems, electrical generation and transmission, water storage and distribution, nuclear power plants and gas facilities.''\27\ Where vulnerable areas exist, the Commission believes its responsibility is to reduce risks rather than to wait for proof that an attack is imminent or even likely. --------------------------------------------------------------------------- \24\ American Library Association at p. 2. \25\ Reporters Committee at p. 3. \26\ See National Infrastructure Protection Center Advisory 02- 007 (September 10, 2002) (identifying most attractive targets as transportation and energy sectors and ``[f]acilities or gatherings that would be recognized worldwide as symbols of American power or security.'') The National Infrastructure Protection Center's mission is to serve as the United States government's focal point for threat assessment, warning, investigation and response for threats or attacks against critical infrastructures, including energy and water systems. \27\ See The Washington Post, Cyber-Attacks by Al Qaeda Feared, June 27, 2002, p. A01. --------------------------------------------------------------------------- 13. The Commission also is unconvinced that the general public's need for information warrants the risk of disclosure of CEII. The ``need to know'' has never been absolute: the FOIA itself recognizes this principle by having nine exemptions, and the NOPR proposed to do nothing more than rely upon FOIA exemptions in withholding CEII.\28\ The Commission received no convincing arguments in response to the NOPR that there are practical benefits from public availability of CEII that would outweigh possible dangers from attacks on energy infrastructure. Furthermore, this rulemaking is intended to provide an avenue for disclosure in instances where there might be some benefit. The Commission has attempted to strike the best balance possible between the benefits of information and the protection of people and property. --------------------------------------------------------------------------- \28\ 67 FR 57994 at p. 57996, FERC Stats. & Regs. ] 32,564 at p. 34,541. --------------------------------------------------------------------------- B. Legal Authority to Protect CEII 14. In the NOI that initiated this rulemaking, the Commission invited comments on statutes that might affect the Commission's ability to protect CEII. The FOIA was identified as the statute that could mandate disclosure of some sensitive information. After receiving comments from many commenters, the Commission set out its view, in the NOPR, that one or more of several FOIA exemptions would most likely apply to CEII,\29\ namely: (1) Exemption 2, which exempts ``records related solely to the internal personnel rules and practices of an agency''; \30\ (2) Exemption 4, which protects from disclosure ``trade secrets and commercial or financial information obtained from a person and privileged or confidential''; \31\ and (3) Exemption 7, which protects from disclosure certain law enforcement information, including information the disclosure of which might jeopardize a person's life or safety.\32\ --------------------------------------------------------------------------- \29\ Id. at pp. 57997-800, ] 32,564 at pp. 34,542-46. \30\ 5 U.S.C. 552(b)(2). \31\ 5 U.S.C. 552(b)(4). \32\ 5 U.S.C. 552(b)(7)(F). --------------------------------------------------------------------------- 15. Most commenters agree with the Commission's belief that one or more of these three exemptions would apply to CEII,\33\ and the Commission adopts the analysis in the NOPR to support its decision here.\34\ Some, however, either express concerns about the Commission's analysis of one or more exemptions or outright disagree with that analysis.\35\ A few commenters assert that the Commission was somehow overriding the FOIA \36\ by creating an ``extra-legal category of protected information,'' \37\ or by making CEII non-requestable under the FOIA.\38\ --------------------------------------------------------------------------- \33\ E.g., American Electric Power System at p. 1; Duke Energy Corporation (Duke) at p. 7; Edison Electric Institute (EEI) at pp. 6-7; Southern California Edison Company (SCE) at p. 10; Southern Company Services, Inc. (Southern) at p. 2; Washington Legal Foundation and Public Interest Clinic, George Mason University School of Law (Washington Legal Foundation) at pp. 5-6. \34\ For the public's convenience, the Commission's FOIA analysis is reiterated in Appendix B. \35\ E.g., Hydropower Reform Coalition (HRC) at p. 3; Massachusetts Energy Facilities Siting Board at p. 3; National Association of Regulatory Utility Commissioners (NARUC) at pp. 3, 7- 10, 12-15; OMB Watch at pp. 4-6; Reporters Committee at pp. 2, 4, 7; joint comments of the Public Utilities Commission of Ohio, the Michigan Public Service Commission and the Oklahoma Corporation Commission (States) at pp. 3, 7-10, 12-17; Whitfield Russell Associates at p. 8. \36\ OMB Watch at pp. 4-5; Reporters Committee at pp. 2, 7. \37\ American Library Association at p. 2. \38\ OMB Watch at p. 4. --------------------------------------------------------------------------- 16. The comments asserting that the Commission is somehow attempting to abrogate or circumvent the FOIA reflect a fundamental misunderstanding of this rulemaking. The Commission expressly acknowledged in the NOPR its continuing obligation to comply with the FOIA.\39\ This rule does not exempt any information from disclosure under that statute unless it falls within an existing exemption, abrogate in any way the right of any person to submit a request under the FOIA, or make any document or category of documents non-requestable or otherwise not subject to the FOIA. It is not the function of this rule to make any document unavailable that would otherwise be available absent this rulemaking. Instead, the purpose of this rulemaking is to establish a mechanism for making available certain categories of documents that would otherwise be unavailable. --------------------------------------------------------------------------- \39\ 67 FR 57994 at p. 57996, FERC Stats. & Regs. ] 32,564 at p. 34,541. --------------------------------------------------------------------------- 17. The discussion of the FOIA exemptions in the NOPR reflects the Commission's view that a re-evaluation of information access policies, including analysis of the FOIA provisions, is dictated by the changed understanding of safety issues resulting from the 9/11 tragedy.\40\ That re-evaluation would be needed regardless of any regulation governing access to CEII. It becomes relevant here as a part of the reasoning behind this rulemaking, but it should not be mistaken for a determination as to whether any specific piece of information is accessible under the FOIA. A FOIA requester has a right to receive an individualized determination based on the document(s) requested. The Commission has not made, and cannot properly make, generic determinations as to whether FOIA exemptions apply. Accordingly, specific arguments with respect to Exemptions 2, 4, and 7 addressed in the NOPR,\41\ and raised again here,\42\ are best [[Page 9860]] resolved in the context of particular FOIA requests, where submitters have the opportunity to enumerate potential competitive harm associated with release, and where the Commission can evaluate the harm of releasing that particular information. For purposes of this rulemaking, however, the Commission continues to believe that the types of information it has identified as CEII are exempt from disclosure under the FOIA. --------------------------------------------------------------------------- \40\ Id. at pp. 57996-800, ] 32,564 at pp. 34,541-46. \41\ Id. \42\ E.g., NARUC at p. 12; States at p. 13; OMB Watch at p. 5; Whitfield Russell Associates at p. 8 (harm resulting from terrorist attacks would not constitute competitive harm under Exemption 4); Reporters Committee at p. 7; OMB Watch at p. 6 (information that was previously public is not protected under the FOIA). --------------------------------------------------------------------------- 18. As a separate matter, some commenters raise issues concerning the Commission's experience with Exemption 7 and question whether it applies outside the context of criminal investigations.\43\ In particular, OMB Watch wonders how the Commission could have removed from public access tens of thousands of documents on the basis that they were compiled for law enforcement purposes and asks whether the Commission ever relied upon Exemption 7 prior to the 9/11 attack.\44\ With respect to OMB Watch's first argument, the Commission did not remove thousands of documents from public access in October 2001 based on Exemption 7. The Commission removed them because they fit within certain categories of documents that were identified as likely to contain information that could be harmful in the hands of terrorists. The Commission did not do a document-by-document review of these documents to determine whether they contained information exempt from disclosure under the FOIA. In response to OMB Watch's second point, the Commission has relied from time to time on Exemption 7 prior to 9/ 11.\45\ More to the point, it has long been recognized that Exemption 7 applies to civil as well as criminal law enforcement.\46\ OMB Watch is likewise mistaken that the Commission will claim that all information it collects constitutes law enforcement information.\47\ The Commission has no such intention because it recognizes that Exemption 7 does not protect all law enforcement information, but only certain limited types, such as information the disclosure of which might interfere with enforcement proceedings or endanger the safety of an individual.\48\ --------------------------------------------------------------------------- \43\ E.g., OMB Watch at p. 7; Reporters Committee at p. 6. \44\ OMB Watch at p. 7. \45\ A review of the Commission's Annual FOIA reports for FY 1998 through 2001 indicates that the Commission relied on Exemption 7 in Fiscal Years 2001 and 1998, specifically citing exemption 7(A) eight times, 7(B) two times, 7(C) three times, 7(D) two times, and 7(E) five times during those two fiscal years. The Commission also relied on Exemption 7(F) more recently in modifying its practice of making the entirety of FERC Form No. 715 available to the public. See Order on Treatment of Information Collected in Form No. 715, 100 FERC ] 61,141 (2002). \46\ E.g., Detroit Free Press, Inc. v. DOJ, 73 F.3d 93, 96 (6th Cir. 1996); Williams v. IRS, 479 F.2d 317, 318 (3rd Cir. 1973). \47\ See OMB Watch at p. 7. \48\ 5 U.S.C. 552(b)(7). --------------------------------------------------------------------------- 19. Some commenters raise administrative issues. They assert, for example, that this rulemaking will improperly remove functions from qualified ``access professionals,'' and that the Commission has not adequately explained what qualifications the CEII Coordinator must possess.\49\ These concerns are misplaced. As stated above, FOIA requests will continue to be processed according to the Commission's established FOIA procedures and the Commission's FOIA staff. The Commission's goal in appointing the CEII Coordinator will be the same as its goal in assigning staff to handle FOIA requests, or for that matter all of its staff: to ensure that employees are qualified and properly trained to handle their appointed responsibilities. Moreover, as explained below in the discussion on the use of a CEII Coordinator, the Coordinator will be free and indeed encouraged to consult with the staff who provides advice and recommendations on FOIA responses. --------------------------------------------------------------------------- \49\ OMB Watch at p. 7; Reporters Committee at pp. 4-5. --------------------------------------------------------------------------- 20. Some commenters ask whether the Commission will automatically transfer a FOIA request to the CEII Coordinator if it turns out that the requested information is CEII.\50\ The answer is, generally no. If a requester files a FOIA request and does not follow the procedures for seeking access to CEII, the request will be handled as a FOIA request and, if the requested information is exempt from disclosure, it will be withheld. The requester will, however, be notified that the information, although exempt from disclosure under the FOIA, may be accessible under the CEII procedures. If the requester seeks access under both the FOIA and CEII procedures, Commission staff will coordinate the response. --------------------------------------------------------------------------- \50\ NARUC at p. 24; States at p. 24. --------------------------------------------------------------------------- 21. The Commission received comments questioning whether a utility must claim CEII status for information in order for it to qualify for protection under Exemption 4.\51\ The information either is or is not CEII. Thus, a claim that information is CEII is not necessary for the information to qualify as such. For the same reason, a claim that information is CEII will not necessarily qualify it as CEII. Accordingly, a submitter's ability to claim protection under Exemption 4 in particular is not, and cannot be, conditioned on a claim of CEII status. Information may qualify for Exemption 4 protection and not be CEII, just as information may qualify for CEII protection and not fit within Exemption 4, as long as it fits within another FOIA exemption. --------------------------------------------------------------------------- \51\ NARUC at p. 13; States at p. 14. --------------------------------------------------------------------------- 22. As stated above, the Commission recognizes that it is bound by the FOIA. Where the FOIA affords certain rights to submitters of information, the Commission remains obligated to recognize those rights, just as it remains obligated to recognize the rights of FOIA requesters. Nevertheless, if a utility fails to claim CEII status for information that would qualify as CEII, the risk that the information will be disclosed is increased because Commission staff may not become fully aware of the dangers of disclosing it. Commission staff will endeavor to identify CEII in processing requests, including information for which submitters have not claimed CEII status, but proper determinations about what information should be released under the FOIA will be easier to make where submitters identify information they believe to constitute CEII. 23. Finally, some requesters express concern whether the Commission will provide adequate information about decisions not to disclose CEII, including information that would allow requesters to challenge claims of competitive harm.\52\ Determinations of competitive harm would occur as part of the FOIA process and would be subject to existing FOIA procedures. The Commission informs a FOIA requester of the reason(s) for withholding information and the requester may appeal that determination to the Commission's General Counsel and ultimately to a United States District Court.\53\ This rulemaking makes no changes to that procedure. Where information that is exempt from disclosure under the FOIA is found to be CEII, as noted, the Commission will so notify the requester. --------------------------------------------------------------------------- \52\ NARUC at pp. 23-24; States at pp. 24-25. \53\ 18 CFR 388.108(c)(1), 388.110 (2002). --------------------------------------------------------------------------- C. Definition of CEII 24. The NOPR proposed to define CEII in Sec. 388.113(c)(1) of the Commission's regulations \54\ as: --------------------------------------------------------------------------- \54\ 18 CFR 388.113(c)(1) (2002). Information about proposed or existing critical infrastructure that: (i) Relates to the production, generation, transportation, transmission, or distribution of energy; (ii) Could be useful to a person in planning an attack on critical infrastructure; (iii) Is exempt from mandatory disclosure under the [[Page 9861]] Freedom of Information Act, 5 U.S.C. 552; and (iv) Does not simply give the location of the critical infrastructure.\55\ --------------------------------------------------------------------------- \55\ 67 FR 57994 at p. 58000, FERC Stats. & Regs. ] 32,564 at p. 34,548. This definition departed from the prior policy in that it covered proposed facilities as well as existing facilities, and in that it excluded from the definition of CEII information regarding the location of the infrastructure. The majority of comments regarding the proposed CEII definition involve the meaning of ``critical infrastructure,'' the exclusion of location information, and the inclusion of information about proposed facilities. 1. Definition of Critical Infrastructure 25. A crucial element in defining CEII is determining what qualifies as ``critical infrastructure.'' The NOPR proposed to define critical infrastructure as: Systems and assets, whether physical or virtual, that are so vital to the United States that the incapacity or destruction of such systems or assets would have a debilitating impact on the security, national economic security, national public health or safety, or any combination of those matters.\56\ --------------------------------------------------------------------------- \56\ Id. at pp. 58000-01, ] 32,564 at p. 34,548. The NOPR proposed definition of critical infrastructure was taken directly from the USA PATRIOT Act (Act).\57\ In proposing that definition, the Commission believed that all components of the energy infrastructure would qualify as critical infrastructure based on a finding in the Act that ``[p]rivate business, government, and the national security apparatus increasingly depend on an interdependent network of critical physical and information infrastructures, including telecommunications, energy, financial services, water and transportation sectors.'' --------------------------------------------------------------------------- \57\ Pub. L. 107-56. --------------------------------------------------------------------------- 26. Some commenters agree with the proposed CEII definition, with EEI noting that ``[e]lectricity is an essential public service that sustains public health and welfare, including * * * the provision of power for heating and air conditioning, water supply, street and building, hospital services, food storage and processing, computers, and other electrical equipment,'' and as such, is vital to the nation's health, security, and economy.\58\ Other commenters, however, are concerned that the language could be read to extend CEII coverage only to very large or ``vital'' projects. For example, the Interstate Natural Gas Association of America (INGAA) requests that the Commission revise the definition of ``critical infrastructure'' to include ``all facilities used in the production, generation, transportation, transmission, or distribution of energy.'' \59\ Conversely, the HRC recommends that the Commission consider ``only certain documents of high-risk, high priority cases to be available for CEII protections.'' \60\ Some commenters recommend that the Commission leave it up to the infrastructure owner to determine whether its project qualifies as critical infrastructure,\61\ while other commenters voice concern that the definition of CEII is too broad.\62\ In this regard, Reporters Committee states that ``[b]y defining CEII in a way that can have all major energy infrastructure fall under the CEII rubric, FERC maximizes the control it maintains over information.'' \63\ --------------------------------------------------------------------------- \58\ EEI at p. 2. \59\ INGAA at p. 3. \60\ HRC at p. 5. \61\ E.g., MidAmerican Energy at p. 3; National Grid USA at p. 5. \62\ E.g., HRC at p. 4; Reporters Committee at p. 8; Society of Professional Journalists at p. 2. \63\ Reporters Committee at p. 8. --------------------------------------------------------------------------- 27. No matter how broadly or narrowly the Commission defines critical infrastructure, in order to qualify for protection as CEII, the information must be useful to terrorists in planning an attack, be exempt from disclosure under the FOIA, and not merely give the location of the infrastructure. This effectively limits the scope of CEII protection. Moreover, the Commission does not want to define CEII in an ambiguous way that will invite disputes over which facilities are covered. The definition of critical infrastructure should encompass all facilities and components of facilities, not just facilities above a certain threshold. Even though a project may be small, destruction of the project could have serious consequences, particularly where it is part of a larger overall system. It is also important to the Commission that computer systems that control or are part of the energy infrastructure are covered. Therefore, the final rule defines critical infrastructure in new Sec. 388.113(c)(2) of the Commission's regulations \64\ as ``existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters.'' --------------------------------------------------------------------------- \64\ See new 18 CFR 388.113(c)(2). --------------------------------------------------------------------------- 2. Information on Location of Facilities 28. The majority of commenters object to the Commission's decision not to classify location information as CEII.\65\ In this regard, some question the Commission's assumption that location information is still publicly available in the wake of September 11.\66\ Others posit that the Commission should be a trailblazer, protecting location information even where it is publicly available elsewhere.\67\ Certain commenters argue that while the Commission should not protect information that is publicly available from other sources, such as USGS or commercial maps, other location information may warrant protection.\68\ Still others contend that information above a certain level of detail should be protected,\69\ for example, ``location of [[Page 9862]] key communication facilities, control centers, and switching facilities,'' \70\ and information that ``identifies major transmission interconnections and other system components.'' \71\ --------------------------------------------------------------------------- \65\ E.g., American Gas Association at pp. 1-2; Bonneville Power Administration (BPA) at pp. 3-4; Duke at p. 14; INGAA at pp. 8-11; MidAmerican Energy Company (MidAmerican) at pp. 6-7; National Grid USA at pp. 3 and 5; National Hydropower Association at p. 5; Northwest Natural Gas Company (Northwest Natural) at pp. 4-8; Pacific Gas & Electric (PG&E) at p. 1; Williston Basin Interstate Pipeline Company (Williston Basin) at pp. 4-6. \66\ E.g., BPA at p. 4; Duke at p. 13 (citing articles claiming that numerous groups, including the Bureau of Transportation Statistics, the Department of Energy (DOE), the International Nuclear Safety Center, the Department of Transportation (DOT), the National Imagery and Mapping Agency and the United States Geological Survey, removed geographic information from open public access after September 11); EEI at pp. 8-9 (stating that DOE has removed information regarding nuclear facilities containing weapons-grade plutonium or highly enriched uranium, DOT has removed interactive oil pipeline maps, and the Energy Information Agency has removed similar information); and INGAA at p. 10. \67\ E.g., American Gas Association at p. 2; Northwest Natural at pp. 7-8; INGAA at pp. 10-11; PG&E at p. 1; Williston Basin at pp. 4-5. These commenters believe that if the Commission protects this information, others may follow suit, eventually ``aging'' the information in the public domain, making it less useful to potential terrorists. The Commission appreciates these commenters' views, but believes that while this information might gradually become outdated in the public domain, the probability is remote given the availability of GPS equipment and commercial satellite images. \68\ E.g., PJM Interconnection (PJM) at p. 2, SCE at p. 5. For its part, INGAA, an advocate of protecting location information, concedes ``[t]o the extent that maps and/or location information are generally and readily available to the public and contain only non- detailed information of the location of energy facilities [such as state- or county-level maps],'' such information could be excluded from the definition of CEII. INGAA at p. 8. \69\ E.g., GE at p. 6 (location of certain types of equipment, such as ``phase-angle regulators or critical FACTS devices'' should be protected); MidAmerican at p. 6; National Hydropower Association at p. 5 (protect information that provides ``details of the sensitive parts of facilities''); North American Electric Reliability Council (NERC) at pp. 4-5 (protect ``detailed network topology maps and the details of the interactions performed by Supervisory Control and Data Acquisition (SCADA) and Energy Management Systems (EMS)''; Northwest Natural at p. 5 (``assumes that medium to highly detailed facility location maps'' will be protected); PG&E at p. 6. \70\ BPA at p. 4. \71\ National Grid USA at p. 3. --------------------------------------------------------------------------- 29. The Commission has considered the commenters' arguments and suggestions especially with respect to protecting information that may otherwise be available to the public. For this purpose, a check of the Internet revealed that some of the information that had been removed after September 11 is once again available. For instance, the International Nuclear Safety Center currently has interactive maps available on its web site,\72\ and the United States Geological Survey lists a variety of maps for sale, including 7.5 minutes maps.\73\ Although some information, such as the DOT pipeline maps have not been restored to public access, the Commission believes that there are publicly available sources that would enable a terrorist to locate most energy infrastructure. Without further guidance from the Congress or the Administration, the Commission is reluctant to withhold from public access location information that is otherwise available. --------------------------------------------------------------------------- \72\ See http://www.insc.anl.gov/pwrmaps/map/world_map.php. \73\ See http://mapping.usgs.gov/digitalbackyard/ topobkyd.html#5. --------------------------------------------------------------------------- 30. The Commission concludes nevertheless that there is some ``location'' information that does warrant protection as CEII. The Commission intends to release location information generally needed to participate in the National Environmental Policy Act (NEPA) process, while protecting information containing technical details not usually needed by most NEPA participants. Accordingly, the Commission considers the following types of gas and hydropower location information as outside the definition of CEII: (1) USGS 7.5-minutes topographic maps showing the location of pipelines, dams, or other aboveground facilities; (2) alignment sheets showing the location of pipeline and aboveground facilities, right of way dimensions, and extra work areas; (3) drawings showing site or project boundaries, footprints, building locations and reservoir extent; and (4) general location maps. In order to alleviate commenters' concerns about making this information so easily available, the Commission instructs filers to segregate this non-CEII location information into a separate volume or appendix, label it clearly ``Non-Internet Public,'' and submit it with instructions that it not be placed on the Internet.\74\ To the extent permissible and practical, the Commission will adhere to those instructions, but the information will still be publicly available through the Public Reference Room. --------------------------------------------------------------------------- \74\ Until instructed otherwise, filers may not submit non- Internet public documents through the electronic filing process. Document submitted through that process are automatically placed in public FERRIS, and are visible on the Internet. --------------------------------------------------------------------------- 31. Conversely, the Commission considers the following gas information to qualify as CEII because it provides more than just location: (1) Diagrams of valve and piping details at compressor stations, meter stations, LNG facilities, and pipeline interconnections; (2) flow diagrams and other drawings or diagrams showing similar details such as volumes and operating pressures like those found in Exhibit G; (3) environmental resource reports for LNG facilities, and (4) drawings matching labels with specific buildings at the site, e.g., central gas control centers or gas control buildings. 32. Similarly, examples of hydropower location-related information that the Commission considers to be CEII include: (1) General design drawings of the principal project works (e.g., plan, elevation, profile, and section of dam and powerplant), such as those found in Exhibit F; (2) maps of projects (including location of project works with respect to water bodies, permanent monuments, or other structures that can be noted on the map and recognized in the field), such as those found in Exhibit G; (3) drawings showing technical details of a project, such as plans and specifications, supporting design reports, Part 12 independent consultant reports,\75\ facility details, electrical transmission systems, and communication and control center information; (4) locations of critical or vulnerable components of the project; (5) innundation information; and (6) global positioning system (GPS) coordinates of any project features (precise surveyed or GPS coordinates at or above two decimal points of accuracy of equipment and structures). --------------------------------------------------------------------------- \75\ See 18 CFR part 12, subpart D. --------------------------------------------------------------------------- 33. A filing such as a license or certificate application could contain a variety of information falling into one or more of the following categories: public, non-Internet public information, nonpublic CEII, and other nonpublic privileged. In that case, the preferred method of filing would be to segregate each type of information into separate volumes or appendices, each clearly marked with the appropriate heading, and with a cover letter explaining the treatment each volume/appendix should receive as follows: [sbull] The public volume/appendix should be marked ``Public,'' although public is the default treatment for unmarked documents [sbull] The non-internet public volume/appendix containing non- CEII location information should be marked ``Non-Internet Public'' [sbull] The CEII volume/appendix should be marked ``Contains Critical Energy Infrastructure Information--Do Not Release,'' in accordance with Sec. 388.112(b), and [sbull] Any other nonpublic privileged volumes/appendices should be marked ``Contains Privileged Information--Do Not Release.'' Filers should note that any filing containing non-Internet public, CEII or other privileged information currently may not be submitted using the electronic filing process. 34. The electric transmission grid differs from dams and pipelines in that the Commission does not have regulatory responsibilities over the siting or licensing of these facilities. Therefore, the Commission is not charged with conducting the NEPA reviews on these facilities. For that reason, there is far less need for the public as a whole to have unfettered access to location information submitted to the Commission regarding the electric grid. Some companies state that portions of FERC Form No. 715, Annual Transmission Planning and Evaluation Report, should fall outside the definition of CEII because it is location information.\76\ The Commission disagrees. Certain information in Part 3 of FERC Form No. 715 is not intended primarily to identify the location of the facilities, but rather to show the interrelationship of facilities. Therefore, the Commission considers Part 3 transmission system maps and diagrams used by the utility for transmission planning to be CEII. --------------------------------------------------------------------------- \76\ E.g., Commonwealth Associates, Inc. at p. 2; Whitfield Russell Associates at p. 8. --------------------------------------------------------------------------- 3. Information Regarding Proposed Facilities 35. In the NOPR, the Commission reversed its earlier position that information relating to proposed facilities should not be treated as CEII.\77\ As noted in the NOPR, ``[t]he major concern initially about withholding information about proposed projects was that people might not be able to participate effectively in the National Environmental Policy Act (NEPA) process.'' \78\ After the Policy Statement was issued in October 2001, the [[Page 9863]] Commission treated information that identified location of existing, certificated or licensed facilities as CEII. It recognized that it would be nearly impossible for people to participate effectively in the NEPA process without access to specific information regarding the location of the proposed facility, the area it affects, and the resources it impacts. For that reason, the Policy Statement contemplated the release of CEII regarding proposed facilities, and then the protection of the information as CEII once a certificate or license was issued.\79\ This resulted in a fairly cumbersome process and raised the concern that a patient terrorist could collect CEII-type information on proposed projects and then use that information to cause harm to the project and the people living and working in its vicinity once it was built. --------------------------------------------------------------------------- \77\ 67 FR 57994 at p. 58000, FERC Stats. & Regs. ] 32,564 at p. 34,548. \78\ Id. \79\ 66 FR 52917 (Oct. 18, 2001), 97 FERC ] 61,030. --------------------------------------------------------------------------- 36. In the NOPR, recognizing the inconsistency in this approach, the Commission revised the Policy Statement to restrict access to detailed technical information relating to proposed facilities, while at the same time revising the policy to cease protecting location information as CEII.\80\ The majority of commenters approve of the decision to include proposed facilities,\81\ with only the HRC explicitly disagreeing.\82\ As explained in the NOPR, the Commission believes that as long as basic location information is not treated as CEII, protection of other sensitive information about proposed facilities will help protect the infrastructure without interfering with the NEPA process.\83\ For example, most NEPA commenters will want to know the location of a proposed pipeline and the footprint of aboveground facilities, but few will need diagrams of valve and piping details, or flow diagrams, or need to know which building will house security and which one will house the computer operations center. Those who do have such a need may file a request for that information using the CEII request procedures in new Sec. 388.113(d) of the Commission's regulations.\84\ --------------------------------------------------------------------------- \80\ 67 FR 57994 at p. 57995, FERC Stats. and Regs. ] 32,564 at p. 34,539. \81\ E.g., EEI at p. 9; Industrials (Process Gas Consumers Group, American Forest & Paper Ass'n, American Iron & Steel Institute, Georgia Industrial Group, Florida Industrial Gas Users, Industrial Gas Users of Florida, and United States Gypsum Company) at p. 4; INGAA at p. 4; National Hydropower Association at p. 5; Southern at p. 3; Washington Legal Foundation at p. 2; Williston Basin at p. 4. \82\ HRC at p. 4. \83\ See 67 FR 57994 at p. 58000, FERC Stats. & Regs. ] 32,564 at p. 34,548. \84\ See new 18 CFR 388.113(d). --------------------------------------------------------------------------- 37. Duke Energy suggests that the Commission clarify that the definition of CEII extends to ``component parts of such systems or assets or * * * formal proposals to create such systems or assets including component parts thereof,'' \85\ voicing concern that the requirement that the infrastructure be vital to the nation's health, security, and economy ``presupposes that the ``infrastructure'' in question is already in place,'' effectively excluding information about proposed facilities.\86\ As discussed above, the Commission is changing the definition of critical infrastructure in new Sec. 388.113(c)(2) of its regulations \87\ to encompass ``existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters.'' This revised definition makes it clear that information regarding proposed facilities may be protected as CEII. --------------------------------------------------------------------------- \85\ Duke Energy at p. 12. \86\ Id. at pp. 10-11. \87\ See new 18 CFR 388.113(c)(2). --------------------------------------------------------------------------- D. Requester's Status and Need for the Information 38. The NOPR proposed a procedure that would not restrict CEII to certain types of applicants, but would take an applicant's identity and need into account.\88\ A person seeking access to CEII under proposed Sec. 388.113 would be required to submit information about his identity and need for the information.\89\ The NOPR emphasized the importance of intervenors, landowners and other persons being able to participate meaningfully in Commission proceedings.\90\ The Commission also expressed its belief that market participants who are not participants in proceedings would be able to access necessary information, either under proposed Sec. 388.113 or through other means, such as the Open Access Same-time Information System (OASIS).\91\ The NOPR also proposed to permit owners and operators to get information about their own facility without the need to file a request under the CEII process, and to require agents of an owner/ operator to obtain information from the owner/operator.\92\ The NOPR pointed out that these requirements would have no application to FOIA requests.\93\ --------------------------------------------------------------------------- \88\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at p. 34,549. \89\ Id. at p. 58001, ] 32,564 at p. 34,550. \90\ Id. at p. 58001, ] 32,564 at pp. 34,549-50. \91\ Id. at p. 58001, ] 32,564 at p. 34,550. \92\ Id. at p. 58001, ] 32,564 at pp. 34,549-50. \93\ Id. at p. 58001, ] 32,564 p. 34,549. --------------------------------------------------------------------------- 39. Several commenters express concern over the ability of energy market consultants and other participants to obtain data that is important to efforts to expand the energy infrastructure and develop new energy resources.\94\ Among the concerns is the possibility that transmission owners might restrict access to CEII in an unfair manner so as to deprive some market participants of the ability to conduct needed research.\95\ Some commenters suggest that the Commission adopt a method of pre-qualification for market participants who are not participants in Commission proceedings or include consultants and other market participants in a list of categories of CEII users who would be permitted access.\96\ --------------------------------------------------------------------------- \94\ E.g., BPA Power Administration at p. 5; Pace Global Energy Services at p. 3; Reliant Resources, Inc. (Reliant) at pp. 2-4. \95\ E.g., Reliant at pp. 4-5. \96\ E.g., Pace Global Energy Services at p. 3; GE at p. 4; Reliant at pp. 4-5. --------------------------------------------------------------------------- 40. The procedures proposed in the NOPR were intended to provide access to CEII to requesters with legitimate need for the information.\97\ Generally speaking, market participants seeking to develop new or expanded energy resources would present such a need. Certainly, continued development of energy infrastructure is one aspect of the nation's defense against attacks upon that infrastructure. The Commission prefers to proceed on a case-by-case basis rather than creating categories of ``pre-approved'' users, because such an approach is better tailored to ensuring that inappropriate users do not gain access to CEII. The Commission understands that extensive delays in obtaining data could hinder development of energy resources, and has no intention of allowing the CEII process to result in any undue delays in the processing of facilities applications. In addition, once the CEII Coordinator has approved access to CEII on the part of a particular requester on a few occasions, subsequent requests by the same requester for similar information should, in most cases, require less time to process. --------------------------------------------------------------------------- \97\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at p. 34,550. --------------------------------------------------------------------------- 41. One matter requires clarification. As National Grid USA points out,\98\ owner/operators often are corporations that can act only through agents. The reference to ``agent or representative'' in Sec. 388.113(d)(2) of the Commission's [[Page 9864]] regulations \99\ is not intended to refer to employees or officials of an owner/operator. They would be covered by Sec. 388.113(d)(1) of the Commission's regulations.\100\ That subsection has been clarified accordingly. --------------------------------------------------------------------------- \98\ National Grid USA at p. 9. \99\ See 18 CFR 388.113(d)(2). \100\ See 18 CFR 388.113(d)(1). --------------------------------------------------------------------------- E. Verification and Access Issues 1. CEII Coordinator 42. Most commenters approve of the creation of a CEII Coordinator position \101\ with some indicating that the agency was better suited to respond to requests than the industry.\102\ However, a few commenters believe that owners, operators, and applicants should have more of a role in granting access to CEII. For example, the National Hydropower Association requests that the Commission amend the regulations to permit owners, operators, and applicants to serve as CEII Coordinator in some circumstances,\103\ and EEI advocates that submitters of information be able to object to intervenor requests for CEII.\104\ The Commission believes that the National Hydropower Association's suggestion would impermissibly interfere with the Commission's administration of the program. EEI's suggestion, however, is consistent with the proposed CEII Coordinator process, which is adopted here. Accordingly, under Sec. 18 CFR 388.112(d) of the Commission's regulations,\105\ submitters are given an opportunity to comment on requests for CEII that they submitted. --------------------------------------------------------------------------- \101\ E.g., EEI at pp. 10-11; Electric Power Supply Association (EPSA) at p. 4; Industrials at pp. 3-4; INGAA at pp. 5 and 7; MidAmerican at pp. 3-4; National Hydropower Association at pp. 3-4; NERC at p. 3; Washington Legal Foundation at p. 2; Whitfield Russell Associates at p. 9. \102\ E.g., American Electric Power at p. 1; Industrials at pp. 3-4; Reliant at p. 5. \103\ National Hydropower Association at pp. 3-4. \104\ EEI at p. 14. \105\ 18 CFR 388.112(d). --------------------------------------------------------------------------- 43. At least one commenter, Reporters Committee, disagrees with the establishment of a CEII Coordinator, voicing concern that the proposed process removes access decisions from the hands of experienced access professionals and permits the agency to avoid the FOIA time limits.\106\ As discussed above in paragraph 18, the CEII Coordinator will have access to the same professional staff who evaluate and draft recommended decisions on FOIA requests, so that expertise will be utilized. Also, the time frames set out in new Sec. 388.113(d)(3)(iii) of the Commission's regulations \107\ for the CEII Coordinator to process a request are the same as provided by the Commission's regulations for processing FOIA requests. To be sure, missing the CEII deadlines does not have the same legal implications as missing the FOIA deadlines.\108\ Nevertheless, the Commission is committed to processing requests for CEII as timely as possible as if it were under the same legal obligations as imposed under the FOIA. Also, of course, if a requester is concerned about the timing for a CEII response running beyond the FOIA statutory time limits, the requester always has the option of filing a FOIA request and seeking access under that statute. --------------------------------------------------------------------------- \106\ Reporters Committee at p. 4. \107\ 18 CFR 388.113(d)(3)(iii). \108\ A FOIA requester may treat an agency's failure to respond within the statutory time limit as constructive exhaustion of administrative remedies, and proceed directly to court without first filing an administrative appeal. See 5 U.S.C. Sec. 552(a)(6)(C)(i). Normally, a requester must file an administrative appeal prior in order to exhaust his or her administrative remedies prior to filing in court. See Stebbins v. Nationwide Mutual Ins. Co., 757 F.2d 364, 366 (D.C. Cir. 1985) (per curiam). --------------------------------------------------------------------------- 44. Certain commenters request clarification of the authority of the Coordinator. Southern believes that the NOPR did not make it clear that the CEII Coordinator has the authority to make determinations of when information qualifies as CEII. The Commission agrees that the proposed version of Sec. 375.313 of its regulations \109\ did not specifically delegate this authority to the Coordinator. The final rule revises proposed 18 CFR 375.313 to add this delegation, and includes language in new Sec. 388.113(d)(3)(ii) of the Commission's regulations \110\ to explicitly add this step into the processing of CEII requests. --------------------------------------------------------------------------- \109\ 18 CFR 375.313. \110\ See new 18 CFR 388.113(d)(3)(ii). --------------------------------------------------------------------------- 45. Other commenters request that the Commission provide more concrete standards or guidance for the Coordinator. For example, National Grid USA recommends that the Commission provide ``standards that will govern the CEII Coordinator's decision whether to release CEII,'' explaining that stated criteria may give requesters insight into which requests will be granted and reduce fruitless requests.\111\ The National Hydropower Association, the NERC, PJM, and Southern also request that the Commission provide criteria for the Coordinator to use in determining whether information qualifies as CEII, whether a requester has a need for the information, and whether to require a non- disclosure agreement (NDA) as a condition of release.\112\ The Commission believes that the standards the Coordinator should use to determine whether information qualifies as CEII are adequately detailed in the definition in new Sec. 388.113(c)(1) of its regulations.\113\ That is, does the information relate to the production, generation, transportation, transmission, or distribution of energy; could it be useful to a person in planning an attack on critical infrastructure; is it exempt from disclosure under the FOIA; and does it do more than provide location information? --------------------------------------------------------------------------- \111\ National Grid USA at pp. 6-7. \112\ National Hydropower Association at p. 4; NERC at p. 5; PJM at p. 1; Southern at pp. 4-6. \113\ See new 18 CFR 388.113(c)(1). --------------------------------------------------------------------------- 46. Commenters also ask that the Commission develop guidelines for the Coordinator to use in determining whether to release information to a particular requester.\114\ The Commission does not intend to provide within the regulation itself a list of the types of requesters who would be deemed to have a need for CEII. First of all, that determination is fact specific. However, in the preamble to the NOPR and this final rule, the Commission has indicated that intervenors, market participants, energy market consultants, state agencies, landowners, environmental groups, and market participants may be found to have a need for information in a particular situation.\115\ It will be in the requester's best interest to explain as fully as possible why he or she needs the information in question. One factor that the Coordinator should factor into a decision is whether the requester's need for the information outweighs the potential harm from release of the information. For instance, if the Commission developed a hierarchical listing of the most critical portions of the infrastructure, it would be highly unlikely to release that information to most requesters, although it might be released to the FBI or the Office of Homeland Security. The final rule has been changed to reflect this balancing in new Sec. 388.113(d)(3)(ii) of the Commission's regulations.\116\ --------------------------------------------------------------------------- \114\ E.g., PJM at p. 1; Southern at pp. 4-5. \115\ 67 FR 57994 , FERC Stats. & Regs. ] 32,564. \116\ See 18 CFR 388.113(d)(3)(ii). --------------------------------------------------------------------------- 2. Use of PINS and Passwords 47. Some commenters are concerned that adequate security measures be taken to protect access to CEII. For instance, certain commenters favor the use of a password system to provide Internet access to CEII.\117\ GE believes it may be beneficial to maintain records on each individual's access to CEII to facilitate investigation of potential inappropriate access.\118\ Other [[Page 9865]] commenters have concerns about the security issues associated with providing Internet access to CEII.\119\ For the time being, the Commission does not plan to give requesters access to Commission databases containing CEII. If and when that time comes, it is expected that identifications and passwords will be used. --------------------------------------------------------------------------- \117\ E.g., Duke at p. 17; National Hydropower Association at p. 8; GE at p. 5; SCE at p. 8. \118\ See GE at p. 5. \119\ E.g., National Hydropower Association at p. 8; GE at p. 5. --------------------------------------------------------------------------- 3. Verification/Checks on Requesters 48. In the NOPR, the Commission proposed to require each individual requester to obtain access to information instead of granting access on an organization-by-organization basis.\120\ Several commenters urge the Commission to rethink its decision not to grant requesters generic access to nonpublic information. Some note that such generic access would reduce burdens on the Commission and requesters.\121\ INGAA, among others, believes that access decisions should be made on a case- by-case basis,\122\ while GE recommends a hybrid approach that would allow entities with ``continuous legitimate need for information'' to gain generic access, while utilizing a case-by-case system for those with more occasional need for the information.\123\ For the time being, the Commission is most comfortable granting access on a case-by-case basis. As mentioned in the discussion on standards to be used by the Coordinator, whether someone has a need for information can vary from circumstance to circumstance. The Commission's goal is to limit CEII access to those with a need for the information. Even though a requester may not be a terrorist, the more people who have access to information, the greater likelihood that it may find its way into the wrong hands. As also noted above, someone who requests access frequently will probably be cleared more quickly than a first-time requester, so the burden of multiple requests should not be too great. --------------------------------------------------------------------------- \120\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 at p. 34,550. \121\ E.g., Duke Energy at p. 17; EPSA at p. 4. \122\ See INGAA at p. 7; PJM at p. 2. \123\ See GE at p. 3. --------------------------------------------------------------------------- 49. In the NOPR, the Commission concluded that since the majority of requesters were expected to be entities and individuals who were well known to the Commission, it was not necessary to use the services of outsiders to verify the identity and legitimacy of requesters.\124\ The Commission is reconsidering that position and is in the process of evaluating existing databases that it may use to screen requesters.\125\ For that reason, the Commission is revising proposed Sec. 388.113(d)(3)(i) to add a requirement that the requester provide his or her date and place of birth and to request that each requester provide his or her social security number \126\ in addition to the other information initially proposed in the NOPR.\127\ This will help verify that the name that the individual provides is their true name, thus facilitating an accurate screening. --------------------------------------------------------------------------- \124\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 at p. 34,550. \125\ One possibility is to use the Interagency Border Inspection Service (IBIS) database, which keeps track of information on suspect individuals, businesses, etc., and which may also be used to access the FBI's National Crime Information Center containing records on wanted persons, criminal histories, etc. \126\ Under the section 7(a)(1) of the Privacy Act, 5 U.S.C. 552a, an agency may not deny a right or benefit provided by law because an individual did not provide his or her social security numbers. Therefore, a requester has the option of not disclosing his or her social security number. \127\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at p. 34,550. --------------------------------------------------------------------------- F. State Agency Issues 50. As indicated in the NOI and the NOPR, there are some unique issues with respect to state agency access to CEII.\128\ A primary concern is the ability of state agencies, which likely will be subject to their own FOIA rules, to protect CEII received from the Commission. State Commissions \129\ also raise the following additional issues: --------------------------------------------------------------------------- \128\ 67 FR 3129 at pp. 3132-33, FERC Stats. & Regs. ] 35,542 at pp. 35,830-33; 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 at p. 34,551. \129\ Whether and on what basis FERC proposes that its CEII rule will preempt state open records laws and rules? Whether State Commissions will automatically be permitted to obtain all CEII data from FERC or whether State Commission access may be limited on a ``need to know'' basis? Whether FERC's rule will adequately preclude utilities from invoking the FERC rule to avoid providing CEII data to State Commissions? Whether State Commissions will have requisite access to CEII data from utilities not within a State Commission's jurisdiction (e.g., for purposes of examining regional transmission or generation capability)? Whether State Commissions or their staff will be required to enter into an NDA, and if so, on what terms? \130\ \130\ NARUC also raises two miscellaneous issues which go beyond the scope of this rule. First, NARUC encourages the Commission to clarify how the CEII rule relates to the Commission's Standard Market Design (SMD) NOPR, ``Remedying Undue Discrimination Through Open Access Transmission Service and Standard Electricity Market Design,'' IV FERC Stats. & Regs. ] 32,563 (2002). Without more, and given the comprehensive nature of the SMD NOPR, the Commission is uncertain as to what NARUC's specific concerns are. The Commission believes, however, that there is nothing in this final rule that conflicts with the goals of the SMD NOPR. Second, NARUC suggests that the Commission set a benchmark for what reasonable costs of complying with the CEII rule may be passed through in companies' rates. To start with, not every one who complies with this rule will necessarily be a jurisdictional company whose rates the Commission sets. To the extent jurisdictional companies do incur costs to comply with the rule, the Commission believes that the current rules and policies for recovery of administrative costs are adequate to address the recovery of such compliance costs. --------------------------------------------------------------------------- 51. As an initial matter, the Commission emphasizes that its goal is to cooperate as fully as possible with the State Commissions, which share the Commission's objective to ensure that CEII does not get into the wrong hands. That said, the Commission grants the National Association of Regulatory Commissioners' (NARUC's) requested clarification on the Federal preemption issue. NARUC states that the Commission has no basis to preempt authority over the totality of access to information regarding gas and electric utility regulation, and that much of the information at issue is not ``Federal information,'' that is, generated by or for the Federal government, but instead is generated by non-Federal entities that have provided similar or identical information to state regulators.\131\ The Commission agrees. --------------------------------------------------------------------------- \131\ NARUC at pp. 17-18. --------------------------------------------------------------------------- 52. The NOPR discussion on preemption related to state agency requests to FERC for CEII that the Commission had generated or collected.\132\ As NARUC correctly points out, ``the NOPR itself declares that FERC's rule does not propose to alter the traditional ability of State Commissions to obtain such data directly'' from the companies.\133\ Therefore, as requested by NARUC, the Commission confirms that it does not intend that public utilities may rely on this rule to refuse to provide information directly to State Commissions. --------------------------------------------------------------------------- \132\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. [para]32,564 at p. 34,551. \133\ NARUC at p. 18. --------------------------------------------------------------------------- 53. In addition, State Commissions will be presumed to have a need to know information within their state involving issues within their responsibilities. They also may submit requests for information regarding entities outside of their jurisdictions with an explanation of the need. Such requests should be capable of being resolved in a timely manner. On the other hand, as discussed below, release of CEII to State Commissions and other State Agencies will normally be subject to signing an NDA. It does not make sense for the Commission to release the [[Page 9866]] information to the State Agencies with no agreement to protect the information, at least to the extent permitted by law. The Commission has no intention of asking a state agency to ignore state law, but merely to give the Commission notice and an opportunity to take action to prevent release of the information. G. Timing Issues 54. The NOPR proposed to provide in Sec. 388.112(d) of the Commission's regulations \134\ notice and an opportunity for a CEII submitter to comment when a request was received for its information, and to provide in Sec. 388.112(e) \135\ notification to the submitter prior to release.\136\ Under the proposal, a submitter would have at least five days in which to submit its comments, and at least five-days notice prior to release of information submitted as CEII.\137\ Several commenters claim that these time limits are too short, and advocate having at least 10 days to comment, and up to 30 days notice prior to release.\138\ At the same time, other commenters are concerned that the time frames are too long in some circumstances, for instance, where a time for filing a protest or intervention may expire in the interim.\139\ At least one, Duke Energy, raises the possibility that the Commission could extend other deadlines where someone is delayed in getting access to information.\140\ --------------------------------------------------------------------------- \134\ 18 CFR 388.112(d). \135\ 18 CFR 388.112(e). \136\ 67 FR 57994 at p. 58003, FERC Stats & Regs. [para]32,564 at p. 34,552. \137\ ID. at pp. 58002-03, [para]32,564 at p. 34,552. \138\ E.g., Duke Energy at p. 5 (advocating a ten-day comment period); EEI at p. 12 (advocating at least 15 days notice prior to release); National Hydropower Association at pp. 7-8, 12 (advocating at least ten business days to comment and ten business days notice prior to release); NERC at p. 4 (advocating 30 days to respond to determination to release CEII to non-governmental requester); Southern at p. 10 (advocating 30 days notice prior to release). \139\ See, e.g., Industrials at pp. 6-8; Massachusetts Energy Facilities Siting Board at p. 5; Transmission Access Policy Study Group at pp. 5-6. \140\ Duke Energy at p. 17. --------------------------------------------------------------------------- 55. The Commission has considered these arguments and examined the filings that have very short time limits, for instance responses to rate filings under Sections 205 of the Federal Power Act,\141\ or Section 4 of the Natural Gas Act,\142\ and does not believe anyone will be prejudiced by the time frames proposed in the NOPR. It is unlikely there will be CEII in most of these filings, and if there is, there should still be sufficient information available for parties to make the required filings in a timely manner. This same issue could arise whenever a company claims confidential treatment for a portion of its filing. To date, that has not proved to be an obstacle to meaningful, timely participation by other parties, and there is no reason to expect that the CEII regulation will cause a problem where none has existed previously. --------------------------------------------------------------------------- \141\ 16 U.S.C. 824d. \142\ 15 U.S.C. 717c. --------------------------------------------------------------------------- 56. The Commission also has examined the arguments that the proposed time limits do not give submitters adequate time to respond. First of all, the rule provides minimum times. Where circumstances permit, the Coordinator may give submitters a longer amount of time. However, the shorter minimum is needed to permit a quick turnaround where necessary and to facilitate response within the FOIA time limits. Prior to 9/11, the five-day minimums existed in Sec. 388.112 of the Commission's regulations for other requests for nonpublic treatment.\143\ For years parties have been able to respond within the time permitted. The Commission sees no reason to extend these time limits for cases involving CEII. --------------------------------------------------------------------------- \143\ See 18 CFR 388.112(d) and (e). --------------------------------------------------------------------------- H. Use of Non-Disclosure Agreements (NDAs) 57. The NOPR proposed to require most CEII requesters to sign an NDA as a condition of gaining access to CEII.\144\ The major exception was laid out in proposed 18 CFR 388.113(d)(2), which provided that owner/operators would be exempt from the requirement to sign an NDA prior to gaining access to CEII regarding their own projects.\145\ The reason for this is that they have at least as great an incentive to protect this information as the Commission has, and probably have access to even more damaging information in the event a rogue employee wanted to cause harm to the facility. The Commission adopts here the proposed exception for owner/operators, and also retains the requirement that agents/representatives (other than employees or officers) of owner/operators obtain CEII directly from the owner/ operator, who will be in a better position to judge the agent/ representative's need for the information and to impose restrictions on its use. --------------------------------------------------------------------------- \144\ 67 FR 57994 at p. 58002, FERC Stats. Regs. ] 32,564 at pp. 34,551-52. \145\ Id. --------------------------------------------------------------------------- 58. In addition, as explained in the NOPR, NDAs for Federal agency CEII requesters will differ from others in part because the Commission will remind the requester of his or her responsibilities under the Federal Records Act,\146\ and will require that the requesting agency refer any subsequent FOIA requests for information provided by the Commission back to the Commission for a determination as to whether the information is subject to release under the FOIA.\147\ Similarly, NDAs for State Agency requesters will specify that the information is Federal information that is ``on loan'' to the State Agency and that the Commission has the right to request return of the information. The Commission will also require that the State Agency notify the Commission whenever a request for the information is received. --------------------------------------------------------------------------- \146\ 44 U.S.C. Sec. 3510(b). \147\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 at p. 34,551. --------------------------------------------------------------------------- 59. Several commenters ask the Commission to elaborate on possible penalties for violation of an NDA.\148\ There are two that readily come to mind. First, a violation of an NDA could result in the Commission's refusing to give similar information to the violator in the future under the CEII process. Indeed, the Commission would be violating the public's trust if a requester were permitted to violate his or her obligations under an NDA with impunity. Second, the Commission could rightly bar someone from representing people before the Commission for a stated period of time under Sec. 385.2102(a)(2) of the Commission's regulations.\149\ --------------------------------------------------------------------------- \148\ E.g., EEI at p. 15; Duke at pp. 16-17; MidAmerican at p. 3. \149\ See 18 CFR 385.2102(a)(2). --------------------------------------------------------------------------- I. Submission of CEII to the Commission 60. In the NOPR, the Commission proposed to make submission of CEII a subcategory of submission of documents subject to claims of privilege under Sec. 388.112 of its regulations,\150\ with the same number of copies and the same requirement for a written statement supporting the request for privileged treatment.\151\ As adopted here, CEII submissions under that section have to indicate that the information is CEII, paralleling the existing requirement for information submitted with a request for privileged treatment.\152\ The Commission proposed to have the submitter determine how best to segregate CEII and non- CEII, such as by creating a separate nonpublic appendix or simply redacting CEII from the public filing.\153\ The Commission further cautioned that it would take disciplinary action against submitters [[Page 9867]] who abuse the CEII process by claiming CEII status for extensive portions of non-CEII.\154\ Under both the NOPR and the final rule, a claim of privilege has the same effect regardless of whether the privileged information is CEII or other nonpublic information.\155\ Under Sec. 388.112 of the Commission's regulations,\156\ the portions for which privileged treatment is sought will be placed in the nonpublic file, and will not be released before the submitter has an opportunity to comment on its release, and receives notice of the impending release. --------------------------------------------------------------------------- \150\ 18 CFR 388.112. \151\ 67 FR 57994 at p. 58003, FERC Stats. & Regs. ] 32,564 at p. 34,552. \152\ Id. \153\ Id. \154\ Id. \155\ See id. \156\ See new 18 CFR 388.112. --------------------------------------------------------------------------- 61. Some commenters dislike the practice of creating public and nonpublic documents, expressing concern over potential confusion between versions. These commenters urge the Commission to redesign its forms so that CEII and other nonpublic information are included as a separate attachment.\157\ Commonwealth Associates, Inc. (CAI) objects to allowing submitters to designate CEII, out of fear that system owners/operators will abuse the process by making CEII available to their agents, while forcing others to wait for a decision by the CEII Coordinator by making sweeping claims of CEII status. CAI suggests that the Commission determine CEII status in the first instance. Other commenters suggest that the Commission specify penalties for violations of the CEII procedures.\158\ --------------------------------------------------------------------------- \157\ E.g., NERC at p. 3; National Hydropower Association at pp. 11-12. \158\ E.g., EEI at p. 15; MidAmerican at p. 3. --------------------------------------------------------------------------- 62. The Commission believes, as it did in formulating the NOPR, that the process for submitting CEII will work best if it tracks as closely as possible the existing procedures for submitting other privileged information, procedures that have proven satisfactory over time. It consequently is reluctant to depart from those procedures for fear of creating confusion and encountering unforeseen problems. The suggestion that the CEII Coordinator, rather than the owner of the information, designate CEII in the first instance, rather than reduce any prejudice from delays, will more likely increase the delays. Commission staff would be required to examine every page of a submission to make the determination, as opposed to examining only those portions that are claimed to constitute CEII. 63. The concern that some submitters will make unjustified claims of CEII status is not one that the Commission takes lightly, as it indicated in the NOPR.\159\ The Commission will take action against submitters who abuse the system. It does not intend, however, to specify the form that action may take, as it will depend on the circumstances. Admittedly, the Commission's ability to impose penalties is not extensive, but it can disqualify a person from practice before the Commission in the event of ``unethical or improper professional conduct.''\160\ --------------------------------------------------------------------------- \159\ 67 FR 57994 at p. 58003, FERC Stats. & Regs. ] 32,564 at p. 34,552. \160\ 18 CFR 385.2102(a)(2). --------------------------------------------------------------------------- 64. With respect to the process of separating CEII from non-CEII, the Commission agrees with the commenters preferring a separate appendix for documents containing protected information rather than two entire copies, one public and one nonpublic. Accordingly, the Commission will modify Sec. 388.112(b) of its regulations \161\ to state a strong preference for an appendix containing protected information. The Commission will, however, leave the option of separate public and nonpublic versions for situations where the use of an appendix would render the document difficult to read. This revision will apply to non-CEII protected information as well. As stated above, the Commission believes that the procedures for CEII and non-CEII protected information should be as similar as possible to avoid confusion. --------------------------------------------------------------------------- \161\ See new 18 CFR 388.112(b). --------------------------------------------------------------------------- 65. The suggestion that the Commission redesign its forms to place CEII in attachments or appendices is outside the scope of this rulemaking. As discussed below, however, the Commission does intend to re-examine its forms and reports to determine whether changes are needed to provide better protection for CEII. This issue can be addressed at that time. For now, the Commission will add a requirement to Sec. 388.112 of its regulations \162\ that all submissions for which CEII status is claimed be stamped ``Contains CEII--Do Not Release'' on every page containing CEII rather than just on the front page. A similar provision will be added for other types of protected information as well. In addition, the Commission is revising Sec. 388.112(b)(2) of its regulations \163\ to direct those who file on electronic media \164\ to provide a list of the names of each file containing CEII or other privileged material, and to mark the outside of the media (CD, diskette, tape) itself to indicate CEII or other privileged material. Hopefully these additional steps will prevent inadvertent disclosure of material. --------------------------------------------------------------------------- \162\ See new 18 CFR 388.112. \163\ See 18 CFR 388.112(b)(2). \164\ At the present time, nonpublic documents are filed on electronic media such as CDs, diskettes, and tapes. At some point in the future, the Commission will accept nonpublic and non-Internet public documents through its electronic filing process. Certain filers also use Commission-created submission software (e.g., FERC Form No. 2 software) that enables the filer to ``flag'' certain fields for nonpublic treatment. The Commission will be examining that software and revising it and the associated filing instructions to permit filers to flag CEII and non-Internet Public information as well. --------------------------------------------------------------------------- J. Challenges to CEII Status 66. As with the submission of CEII, the NOPR proposed to handle challenges to CEII status through the existing procedures of Sec. 388.112 of the Commission's regulations.\165\ Under proposed Sec. 388.112(d), the CEII Coordinator would afford the submitter notice in the event of a request for CEII, and give the submitter at least five days in which to oppose the request.\166\ Under proposed Sec. 388.112(e), if the CEII Coordinator denies the claim of privilege, the submitter would receive notice of the denial at least five days prior to release of the information.\167\ --------------------------------------------------------------------------- \165\ 67 FR 57994 at pp. 58002-3, FERC Stats. & Regs. ] 32,564 at p. 34,552. \166\ Id. at p. 58003, ] 32,564 at p. 34,552. \167\ Id. at pp. 58002-3, ] 32,564 at p. 34,552. --------------------------------------------------------------------------- 67. Several commenters have concerns about the time frames proposed in Sec. 388.112 of the Commission's regulations.\168\ They assert that a five-day notice period is insufficient, both for the time in which a submitter must respond to a request for CEII and for the notice of a proposed release. For the former, commenters favor a 10-day notice period.\169\ For the latter, commenters prefer anywhere from a 10 to 30-day notice period.\170\ The Commission also received suggestions that the time run from receipt of notice and that the notice be ``actual'' rather than constructive, such as in a Federal Register notice.\171\ Some commenters also suggest that the Commission provide for an automatic stay of a decision to release CEII in the event of a request for rehearing, arguing that the time limit for making such a request is 30 days and that the information will otherwise be released before that time runs.\172\ --------------------------------------------------------------------------- \168\ See 18 CFR 388.112. \169\ E.g., Duke at p. 5; National Hydropower Association at pp. 7-8, 12. \170\ E.g., EEI at p. 12; National Hydropower Association at pp. 7-8; National Grid USA at p. 10; NERC at p. 4; Southern at p. 10. \171\ National Hydropower Association at pp. 7-8, 12. \172\ E.g., National Hydropower Association at pp. 7-8, 12; National Grid USA at p. 10. --------------------------------------------------------------------------- 68. The Commission continues to believe that the currently existing procedures are adequate. The [[Page 9868]] Commission has not encountered a problem with submitters of privileged information subject to a FOIA request not being able to respond timely. These time frames come into play in situations involving confidential business information that is highly sensitive to submitters. If the current time frames are adequate in such situations, they should be adequate where CEII is requested. It should be noted that the Commission does send notice directly to the submitter, usually by facsimile as well as by mail and frequently alerts the submitter by telephone too, and does not rely on constructive notice. 69. Moreover, as discussed in the NOPR,\173\ decisions by the CEII Coordinator, which will be made pursuant to authority delegated here in new Sec. 375.313 of the Commission's regulations,\174\ will be subject to requests to the Commission for rehearing.\175\ As is true for all orders issued under delegated authority, the time limit for a request for rehearing is thirty days.\176\ In addition, the Commission's rules specifically provide that a request for rehearing does not stay the order being challenged unless the Commission orders otherwise.\177\ The Commission has found these procedures to be workable in various contexts over the years and believes they will continue to function well in connection with requests for CEII. --------------------------------------------------------------------------- \173\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at p. 34,550. \174\ 18 CFR 375.313. \175\ 18 CFR 385.1902(a). \176\ 18 CFR 385.713(b). \177\ 18 CFR 385.713(e). --------------------------------------------------------------------------- K. Other Issues 70. In response to the NOPR, several commenters suggested that the Commission review the information that it collects to determine if such collections are necessary. They reason that if the Commission does not have the information, it cannot be subject to disclosure under the FOIA. Southern is concerned about this, particularly where the information may be available through the Open Access Same-time Information System (OASIS).\178\ The Commission agrees with these commenters' logic. As noted in the NOPR, the Commission will be examining its information collections to see where collections can be scaled back or eliminated without compromising fulfillment of its statutory responsibilities.\179\ This will most likely be done in conjunction with the periodic Office of Management and Budget clearance process. --------------------------------------------------------------------------- \178\ Southern at p. 11. \179\ 67 FR 57994 at p. 58000, n. 41, FERC Stats. & Regs. ] 32,564 at p. 34,547, n. 41. --------------------------------------------------------------------------- 71. Commenters also seek Commission action to amend requirements that companies make information available where the Commission is protecting the same information from disclosure.\180\ Conversely, at least one commenter, the Transmission Access Policy Study Group, requested that the Commission confirm that it is not eliminating requirements that companies make this information available.\181\ The Commission intends to eliminate the inconsistent treatment, and will be making future modifications to its regulations to effect these changes. Until those regulations are changed, the requirements remain in place unless a company successfully obtains a waiver from the requirement. --------------------------------------------------------------------------- \180\ E.g., INGAA at p. 12; Puget Sound Energy, Inc. at pp. 5-6. \181\ Transmission Access Policy Study Group at p. 7. --------------------------------------------------------------------------- III. Information Collection Statement 72. The Office of Management and Budget's (OMB's) regulations require that OMB approve certain information collection requirements imposed by agency rule. \182\ In the NOPR, the Commission estimated the annual public reporting burden as follows: --------------------------------------------------------------------------- \182\ 5 CFR part 1320 (2002). ---------------------------------------------------------------------------------------------------------------- Number of Number of Hours per Total annual Data collection respondents responses response hours ---------------------------------------------------------------------------------------------------------------- FERC-603........................................ 200 200 .25 50 ---------------------------------------------------------------------------------------------------------------- Total Annual Hours for Collection (reporting + record keeping, if appropriate) = 50 hours. Information Collection Costs: The NOPR estimated the cost to comply with these requirements. It projected the average annualized cost of all respondents to be: Annualized Capital Startup Costs: The Commission estimated that to respond to this information collection will be a one-time cost of $12.50 per respondent. (50 hours @ $50 hourly rate / 200). 73. None of the commenters challenged the estimates provided in the NOPR. On October 1, 2002, OMB approved without change, the Commission's request for approval of the information collection required by the proposed rule, and assigned it OMB No. 1902-0197. The only information collection changes from the NOPR to the final rule are the added requirement in new Sec. 388.113(d)(3)(i) of the Commission's regulations \183\ that requesters provide their date and place of birth and the request that they provide their social security number. OMB regulations provide an exemption where a person is required to provide only facts that are necessary for identification.\184\ The requirement that a requester provide his or her date and place of birth and the request that a requester provide his or her social security number are intended to verify the identity of the requester. For that reason, this collection need not be resubmitted to OMB for approval. --------------------------------------------------------------------------- \183\ See new 18 CFR 388.113(d)(3)(i). \184\ 5 CFR 1320.3(h)(1). --------------------------------------------------------------------------- IV. Environmental Analysis 74. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment.\185\ Included in the exclusions are rules that are clarifying, corrective, or procedural or that do not substantively change the effect of the regulations being amended.\186\ This rule is procedural in nature and therefore falls under this exception; consequently, no environmental consideration is necessary. --------------------------------------------------------------------------- \185\ Order No. 486, Regulations Implementing the National Environmental Policy Act, 52 FR 47897 (Dec. 17, 1987), FERC Stats. & Regs. Preambles 1986-1990 ] 30,783 (1987). \186\ 18 CFR 380.4(a)(2)(ii). --------------------------------------------------------------------------- V. Regulatory Flexibility Act Certification 75. The Regulatory Flexibility Act of 1980 (RFA) \187\ generally requires a description and analysis of final rules that will have significant economic impact on a substantial number of small entities. The Commission is not required to make such analyses if a rule would not have such an effect. The Commission certifies that this rule does not have such an impact on small entities. --------------------------------------------------------------------------- \187\ 5 U.S.C. 601-612. --------------------------------------------------------------------------- [[Page 9869]] VI. Document Availability 76. In addition to publishing the full text of this document in the Federal Register, the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the Internet through FERC's Home Page (http://www.ferc.gov) and in FERC's Internet through FERC's Home Page (http://www.ferc.gov) and in FERC's Public Reference Room during normal business hours (8:30 a.m. to 5 p.m. eastern time) at 888 First Street, NE., Room 2A, Washington, DC 20426. 77. From FERC's Home Page on the Internet, this information is available in the Federal Energy Regulatory Records Information System (FERRIS). The full text of this document is available on FERRIS in PDF and WordPerfect format for viewing, printing, and/or downloading. To access this document in FERRIS, type the docket number of this document excluding the last three digits in the docket number field. 78. User assistance is available for FERRIS and the FERC's website during normal business hours from FERC Online Support (by phone at 1- 866-208-3673 (toll-free) or 202-502-6652, or by e-mail at FERCOnlineSupport@ferc.gov) or the Public Reference Room at (202) 502- 8371 Press 0, TTY (202) 502-8659. E-Mail the Public Reference Room at public.referenceroom@ferc.gov. VII. Effective Date 79. These regulations are effective April 2, 2003. 80. The provisions of 5 U.S.C. 801 regarding Congressional review of final rules does not apply to this final rule, because the rule concerns agency procedure and practice and will not substantially affect the rights of non-agency parties. List of Subjects in 18 CFR Parts 375 and 388 18 CFR Part 375 Authority delegations (Government agencies), Seals and insignia, Sunshine Act. 18 CFR Part 388 Confidential business information, Freedom of information. By the Commission. Magalie R. Salas, Secretary. In consideration of the foregoing, the Commission amends parts 375 and 388, chapter I, title 18, Code of Federal Regulations, as follows. PART 375--THE COMMISSION 1. The authority citation for part 375 continues to read as follows: Authority: 5 U.S.C. 551-557; 15 U.S.C. 717-717w, 3301-3432; 16 U.S.C. 791-825r, 2601-2645, 42 U.S.C. 7101-7352. 2. Add Sec. 375.313 to subpart C to read as follows: Sec. 375.313 Delegations to the Critical Energy Infrastructure Information Coordinator. The Commission authorizes the Coordinator or the Coordinator's designee to: (a) Receive and review all requests for critical energy infrastructure information as defined in Sec. 388.113(c)(1). (b) Make determinations as to whether particular information fits within the definition of CEII found at Sec. 388.113(c)(1). (c) Make determinations as to whether a particular requester's need for and ability and willingness to protect critical energy infrastructure information warrants limited disclosure of the information to the requester. (d) Establish reasonable conditions on the release of critical energy infrastructure information. (e) Release critical energy infrastructure information to requesters who satisfy the requirements in paragraph (b) of this section and agree in writing to abide by any conditions set forth by the Coordinator pursuant to paragraph (c) of this section. PART 388--INFORMATION AND REQUESTS 3. The authority citation for part 388 continues to read as follows: Authority: 5 U.S.C. 301-305, 551, 552 (as amended), 553-557; 42 U.S.C. 7101-7352. 4. Section 388.112 is revised to read as follows: Sec. 388.112 Requests for privileged treatment of documents submitted to the Commission. (a) Scope. (1) Any person submitting a document to the Commission may request privileged treatment by claiming that some or all of the information contained in a particular document is exempt from the mandatory public disclosure requirements of the Freedom of Information Act, 5 U.S.C. 552, and should be withheld from public disclosure. (2) Any person submitting documents containing critical energy infrastructure information (CEII) as defined in Sec. 388.113 should follow the procedures specified in this section. (b) Procedures. A person claiming that information is privileged under paragraph (a) of this section must file: (1) For documents submitted in hard copy, (i) A written statement requesting privileged treatment for some or all of the information in a document, and the justification for nondisclosure of the information; (ii) One of the following: (A) In all cases where the privileged information or CEII can, as a practical matter, be segregated into a separate document or appendix: (1) Fourteen copies of the original document, indicating in bold print on the front page either ``Privileged Information Contained in Attachment'' or ``Critical Energy Infrastructure Information Contained in Attachment,'' and (2) One separate document or appendix, indicating in bold print on the front page either ``Contains Privileged Information--Do Not Release'' or ``Contains Critical Energy Infrastructure Information--Do Not Release,'' with every page in the document or appendix marked either ``Privileged Information--Do Not Release'' or ``Critical Energy Infrastructure Information--Do Not Release,'' or (B) In cases where the privileged information or CEII cannot reasonably or coherently be separated into a separate document or appendix: (1) The original document, indicating in bold print on the front page either ``Contains Privileged Information--Do Not Release,'' or ``Contains Critical Energy Infrastructure Information--Do Not Release'' and, on every page containing privileged information or CEII, the marking ``Privileged Information--Do Not Release,'' or ``Critical Energy Infrastructure Information--Do Not Release,'' with the privileged information or CEII clearly identified, and (2) Fourteen copies of the document without the information for which privileged treatment is sought, and with a statement indicating that information has been removed for privileged treatment, and (iii) The name, title, address telephone number, e-mail address, and facsimile number of the person or persons to be contacted regarding the request for privileged treatment of documents submitted to the Commission. (2) For documents submitted on electronic media, (i) A written statement requesting privileged treatment for some or all of the information on the electronic media, [[Page 9870]] and the justification for non-disclosure of the information; (ii) One of the following: (A) In all cases where the privileged information or CEII can, as a practical matter, be segregated into a separate document or appendix: (1) One copy of the electronic media and fourteen paper copies of a filing all without the privileged information or CEII, and all marked either ``Privileged Information Contained in Separate Attachment'' or ``Critical Energy Infrastructure Information Contained in Separate Attachment,'' and (2) One copy of the electronic media and one paper copy of a separate document or appendix, in both cases marked on media itself and on the front page either ``Contains Privileged Information--Do Not Release'' or ``Contains Critical Energy Infrastructure Information--Do Not Release,'' with every page in the document or appendix marked either ``Privileged Information--Do Not Release'' or ``Critical Energy Infrastructure Information--Do Not Release,'' and (3) An index identifying each file on the media and whether it is public, contains Critical Energy Infrastructure Information, or contains other privileged information; or (B) In cases where the privileged information or CEII cannot reasonably or coherently be separated into a separate document or appendix: (1) One copy of a complete filing on the electronic media and a paper copy, both marked on the media itself and on the front page either ``Contains Privileged Information--Do Not Release''or ``Contains Critical Energy Infrastructure Information--Do Not Release,'' with every page containing privileged information or CEII marked either ``Privileged Information--Do Not Release'' or ``Critical Energy Infrastructure Information--Do Not Release'' and with the privileged information or CEII clearly and specifically identified, and (2) One copy of the electronic media without the information for which privileged treatment is sought and with a statement that information has been removed for privileged treatment, together with fourteen paper copies without the information for which privileged treatment is sought, (3) An index identifying each file on the media and whether it is public, contains Critical Energy Infrastructure Information, or contains other privileged information, and (iii) The name, title, address, telephone number, e-mail address, and facsimile number of the person or persons to be contacted regarding the request for privileged treatment of documents submitted to the Commission. (c) Effect of privilege claim--(1)For documents filed with the Commission. (i) The Secretary of the Commission will place documents for which privileged treatment is sought in accordance with paragraph (b)(1)(ii) of this section in a nonpublic file, while the request for privileged treatment is pending. By placing documents in a nonpublic file, the Commission is not making a determination on any claim for privilege. The Commission retains the right to make determinations with regard to any claim of privilege, and the discretion to release information as necessary to carry out its jurisdictional responsibilities. (ii) The Secretary of the Commission will place the request for privileged treatment described in paragraph (b) of this section and a copy of the original document with the privileged information removed in a public file while the request for privileged treatment is pending. (2) For documents submitted to Commission staff. The notification procedures of paragraphs (d), (e), and (f) of this section will be followed by staff before making a document public. (d) Notification of request and opportunity to comment. When a FOIA or CEII requester seeks a document for which privilege is claimed, or when the Commission itself is considering release of the information, the Commission official who will decide whether to make the document public will notify the person who submitted the document and give the person an opportunity (at least five days) in which to comment in writing on the request. A copy of this notice will be sent to the requester. (e) Notification before release. Notice of a decision by the Commission, the Chairman of the Commission, the Director, Office of External Affairs, the General Counsel or General Counsel's designee, a presiding officer in a proceeding under part 385 of this chapter, or any other appropriate official to deny a claim of privilege, in whole or in part, will be given to any person claiming that information is privileged no less than five days before public disclosure. The notice will briefly explain why the person's objections to disclosure are not sustained by the Commission. A copy of this notice will be sent to the FOIA or CEII requester. (f) Notification of suit in Federal courts. When a FOIA requester brings suit to compel disclosure of information for which a person has claimed privileged treatment, the Commission will notify the person who submitted the documents of the suit. 5. Add Sec. 388.113 to read as follows: Sec. 388.113. Accessing critical energy infrastructure information. (a) Scope. This section governs access to critical energy infrastructure information (CEII). The rules governing submission of CEII are contained in 18 CFR 388.112(b). The Commission reserves the right to restrict access to previously filed documents as well as Commission-generated documents containing CEII. (b) Purpose. The procedures in this section are available at the requester's option as an alternative to the FOIA procedures in Sec. 388.108 where the information requested is exempted from disclosure under the FOIA and contains CEII. (c) Definitions. For purposes of this section: (1) Critical energy infrastructure information means information about proposed or existing critical infrastructure that: (i) Relates to the production, generation, transportation, transmission, or distribution of energy; (ii) Could be useful to a person in planning an attack on critical infrastructure; (iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552; and (iv) Does not simply give the location of the critical infrastructure. (2) Critical infrastructure means existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters. (d) Optional procedures for requesting critical energy infrastructure information. (1) An owner/operator of a facility, including employees and officers of the owner/operator, may obtain CEII relating to its own facility directly from Commission staff without going through the procedures outlined in paragraph (d)(3) of this section. (2) An agent or representative of an owner/operator must obtain information from the owner/operator. (3) If any other requester has a particular need for information designated as CEII, the requester may request the information using the following procedures: (i) File a written request with the Commission's CEII Coordinator. The request shall contain the following: Requester's name, date and place of [[Page 9871]] birth, title, address, and telephone number; the name, address, and telephone number of the person or entity on whose behalf the information is requested; a detailed statement explaining the particular need for and intended use of the information; and a statement as to the requester's willingness to adhere to limitations on the use and disclosure of the information requested. Requesters are also requested to include their social security number for identification purposes. (ii) Once the request is received, the CEII Coordinator will determine if the information is CEII, and, if it is, whether to release the CEII to the requester. The CEII Coordinator will balance the requester's need for the information against the sensitivity of the information. If the requester is determined to be eligible to receive the information requested, the CEII Coordinator will determine what conditions, if any, to place on release of the information. Where appropriate, the CEII Coordinator will forward a non-disclosure agreement (NDA) to the requester for execution. Once the requester signs any required NDA, the CEII Coordinator will make the critical energy infrastructure information available to the requester. The CEII Coordinator's decisions regarding release of CEII are subject to rehearing as provided in Sec. 385.713 of this chapter. (iii) The CEII Coordinator will attempt to respond to the requester under this section according to the timing required for responses under the Freedom of Information Act in Sec. 388.108(c), and will provide notice to the submitter in accordance with Sec. 388.112(d) and (e). Appendix A List of Commenters Adirondack Mountain Club American Electric Power System American Gas Association American Library Association Bonneville Power Administration (BPA) Commonwealth Associates, Inc. City Public Service of San Antonio Duke Energy Corporation (Duke) Edison Electric Institute (EEI), including the EEI Alliance of Energy Suppliers, and EEI Transmission Group Electric Power Supply Association (EPSA) Exelon Generation Corporation on behalf of its public utility subsidiaries PECO Energy Company and Commonwealth Edison Company Federation of American Scientists Hydropower Reform Coalition (HRC) The Industrials: Process Gas Consumers Group, American Forest & Paper Ass'n, American Iron & Steel Institute, Georgia Industrial Group, Florida Industrial Gas Users, Industrial Gas Users of Florida, and United States Gypsum Company Interstate Natural Gas Association of America (INGAA) Massachusetts Energy Facilities Siting Board MidAmerican Energy Company (MidAmerican) National Association of Regulatory Utility Commissioners (NARUC) National Grid USA National Hydropower Association New York State Public Service Commission North American Electric Reliability Council (NERC) Northwest Natural Gas Company (Northwest Natural) Oklahoma Corporation Commission Oklahoma Gas and Electric Company Lydia Olchoff OMB Watch Pace Global Energy Services Pacific Gas & Electric Company (PG&E) PJM Interconnection, L.L.C. (PJM) GE Power Systems Energy Consulting (GE) Puget Sound Energy, Inc. Reliant Resources, Inc. (Reliant) Reporters Committee for Freedom of the Press and The Society of Environmental Journalists (Reporters Committee) Southern California Edison Company (SCE) Society of Professional Journalists Southern Company Services, Inc., acting for itself and as agent for Alabama Power Company, Georgia Power Company, Gulf Power Company, Mississippi Power Company, Savannah Electric and Power Company, and Southern Power Company (Southern) Public Utilities Commission of Ohio, the Michigan Public Service Commission and the staff of the Oklahoma Corporation Commission (States) Transmission Access Policy Study Group Washington Legal Foundation and Public Interest Clinic, George Mason University School of Law (Washington Legal Foundation) Williston Basin Interstate Pipeline Company (Williston Basin) Whitfield Russell Associates Appendix B Applicability of Freedom of Information Act Exemptions to Critical Energy Infrastructure Information The Commission's actions in the NOPR and the final rule are based on its position that CEII includes only information that is exempt from disclosure under FOIA. The exemptions most likely to apply to CEII are Exemptions 2, 4, and 7. A discussion of the potential applicability of each follows. a. Exemption 2 Exemption 2 exempts from disclosure ``records related solely to the internal personnel rules and practices of an agency.'' \1\ According to guidance from the Department of Justice (DOJ), ``[a]ny agency assessment of, or statement regarding, the vulnerability of such a critical asset should be protected pursuant to Exemption 2.'' \2\ DOJ has counseled agencies that ``a wide range of information can be withheld under Exemption 2's 'circumvention' aspect.'' \3\ DOJ also has instructed agencies to take full advantage of the breadth of Exemption 2's protection for critical infrastructure information.\4\ --------------------------------------------------------------------------- \1\ 5 U.S.C. 552(b)(2). \2\ DOJ 2001 FOIA Post 19, posted October 15, 2001. DOJ is the Federal agency responsible for the administration of the FOIA. \3\ Id. \4\ Id. --------------------------------------------------------------------------- The Commission has concluded that a portion of the CEII is exempt from disclosure under Exemption 2 of FOIA. Illustratively, the Commission is expanding its efforts to help facility owners and operators assess security risks and protect facilities from attack.\5\ Information developed or created by the Commission as part of these efforts is likely to fall within the ambit of Exemption 2. Documents describing inspections of regulated facilities likewise will fall within Exemption 2 if they assess or describe vulnerabilities of the project. --------------------------------------------------------------------------- \5\ The Commission has jurisdiction over the safety of hydroelectric projects under sections 4(e), 10(a), and 10(c) of the Federal Power Act, 16 U.S.C. 797(e), 803(a), (c). --------------------------------------------------------------------------- b. Exemption 4 Exemption 4 protects from public disclosure ``trade secrets and commercial or financial information obtained from a person and privileged or confidential.'' \6\ The Commission has determined that much of the CEII falls within the scope of Exemption 4, on the basis that release of the information could cause competitive harm to submitters, impair the Commission's ability to obtain similar information in the future, or impair the effectiveness of the Commission's programs. --------------------------------------------------------------------------- \6\ 5 U.S.C. 552(b)(4). --------------------------------------------------------------------------- There are two primary issues regarding the application of Exemption 4 to CEII. First, whether the fact that this sort of information had been publicly available in the past undermines an argument that it is now confidential, and second, whether the Trade Secrets Act \7\ prohibits the Commission from sharing this information on a ``need-to-know'' basis. --------------------------------------------------------------------------- \7\ 18 U.S.C. 1905. --------------------------------------------------------------------------- The Commission concludes that the fact that this information has been previously public does not defeat Exemption 4. Americans live in a different world today than they did prior to September 11, 2001. Americans have had to face the harsh realities of terrorism on their soil. This has forced the nation to reassess its vulnerability to terrorist threats. Government agencies as well as private companies have had to reconsider the extent to which they make information freely available to others. Specifically, under National Parks & Conservation Assoc. v. Morton, 49 F.2d 765 (DC Cir. 1974) (National Parks) and Critical Mass Energy Project v. NRC, 975 F.2d 871 (DC Cir. 1992) (Critical Mass), the initial inquiry in Exemption 4 cases is whether the information was submitted to the government voluntarily or whether it was compelled to be submitted. For voluntary submissions, the information is entitled to protection if it ``would customarily not be released to the public by the person from whom it was [[Page 9872]] obtained.'' \8\ This test focuses on the submitter's current treatment of the information, not past treatment. Therefore, if, in the post-September 11 world, the company would not release the information to the public, the Commission should not release the information. --------------------------------------------------------------------------- \8\ Critical Mass, 975 F.2d at 878. --------------------------------------------------------------------------- For compelled submissions, there is a three-pronged test--the competitive harm prong, the impairment prong, and the program effectiveness prong. If any of the three tests is met, the information is exempt from mandatory disclosure under FOIA even though it may have been previously public.\9\ Under the competitive harm prong, there must be evidence of actual competition, and a likelihood of substantial competitive injury.\10\ This inquiry tends to be fact specific, so it is not possible to identify with certainty which categories of CEII would meet the test. However, as utilities transition from monopolies to competitive markets, it may be easier for them to demonstrate actual competition. The inquiry is whether the submitter is facing competition at the time the Commission received the request for the information, not whether there was competition when the information was first submitted to the Commission. If the competitive situation has changed, the likelihood of competitive harm would be analyzed using the current situation, not past conditions. Where competition is found to exist, the next issue is whether release of the information is likely to result in substantial competitive injury to the submitter. Again, the likelihood of competitive injury would be examined at the time the Commission received the request for the information. Whether the information could have harmed the submitter two years earlier is irrelevant; what is relevant is whether release of the information at the time of the request would cause competitive harm to the submitter.\11\ --------------------------------------------------------------------------- \9\ While most of the submissions to a regulatory agency like FERC may appear to be compelled, this may not necessarily be the case. DOJ has recognized that the ``existence of agency authority to require submission of information does not automatically mean such a submission is `required'; the agency authority must actually be exercised in order for a particular submission to be deemed `required.' '' DOJ Freedom of Information Act Guide & Privacy Act Overview, May 2002 ed., at 202. Courts have found submissions to be voluntary where the agency had issued a subpoena but not sought to enforce it, see McDonnell Douglas Corp. v. EEOC, 922 F. Supp. 235 (E.D. Mo. 1996), and where the agency did not have authority to enforce the information collection because the information request violated the Paperwork Reduction Act, 44 U.S.C. 3501, see Center for Auto Safety v. NHTSA, 244 F.3d 144 (D.C. Cir. 2001). At bottom, the question of whether the information has been submitted voluntarily or was compelled must be analyzed on a case-by-case basis. \10\ See CNA Fin. Corp. v. Donovan, 830 F.2d 1132 (D.C. Cir. 1987) (CNA). \11\ The Commission's analysis of a submitter's competitive situation under FOIA is not the same as, and indeed is less rigid than, the analysis it must perform to establish lack of market power for charging market based rates. For FOIA purposes, the competition requirement is satisfied if the submitter faces some level of actual competition. See Niagara Mohawk Power Corp. v. DOE, 169 F.3d 16, 19 (D.D.C. 1999) (Niagara). --------------------------------------------------------------------------- The test most frequently applied under the competitive harm prong is whether use of the information by competitors is likely to harm the submitter.\12\ This may be fairly challenging to demonstrate in the case of CEII because the primary concern is that the information could be used to plan an attack on the infrastructure, not that it could be used to steal customers or undercut prices. On the other hand, a submitter may be able to show competitive harm where use of the information by someone other than a competitor could cause financial harm to the submitter.\13\ As relevant here, a terrorist attack on the energy infrastructure could cause financial harm to the owners and operators of the facilities because of lost opportunity costs as well as repair costs. --------------------------------------------------------------------------- \12\ See, e.g., CNA, 830 F.2d at 1152 & n.158; Public Citizen Health Research Group v. FDA, 704 F.2d 1280, 1291 (D.C. Cir. 1983). \13\ See Nadler v. FDIC, 899 F. Supp. 158, 163 (S.D.N.Y. 1995) (Nadler), aff'd, 92 F.3d 93 (2d Cir. 1996). --------------------------------------------------------------------------- For compelled submissions, the impairment prong is satisfied where disclosure may affect the reliability or quality of the information received.\14\ The more subjective the filing requirement, the more likely that disclosure of the information could impair the Commission's ability to get thorough and accurate information in the future.\15\ As noted by EEI in its comments on the NOI, regulated entities may have discretion regarding how to construct their filings.\16\ If companies are worried that information they submit will be subject to public disclosure, they may choose not to submit the same level of detail that they might otherwise submit. In such circumstances, and assuming the submissions would otherwise comply with the Commission's regulations, the information may be exempt from disclosure under the impairment prong of Exemption 4. --------------------------------------------------------------------------- \14\ Id. \15\ See Niagara Mohawk, 169 F.3d at 18 (holding that impairment is unlikely to be found where ``data sought appears to take the form of hard, cold numbers on energy use and production, the fudging of which may strain all but the deliberately mendacious.''). \16\ EEI NOI comments at p. 42. --------------------------------------------------------------------------- Critical Mass recognized that in addition to the competitive harm and impairment prongs, there may be other instances where non- disclosure is warranted in order to protect other governmental interests, such as program effectiveness.\17\ Recently, in Public Citizen Health Research Group v. NIH,\18\ the district court relied on Critical Mass in determining that ``impairment of the effectiveness of a government program is a proper factor for consideration in conducting an analysis under'' Exemption 4. The court held that the National Institutes of Health's royalty information was protected under Exemption 4 because release of the information would make companies reluctant to enter into agreements with NIH, thus impairing the effectiveness of NIH's licensing program.\19\ The court reached a similar conclusion in Judicial Watch, Inc. v. Export-Import Bank, where release of certain financial information from foreign export credit agencies was held to be exempt from disclosure because release would make the credit agencies look for financing outside of the United States, undermining the agency's statutory purpose of fostering domestic economic growth by supporting export transactions.\20\ --------------------------------------------------------------------------- \17\ See Critical Mass, 975 F.2d 879 (``It should be evident from this review that the two interests identified in that National Parks test are not exclusive.''). \18\ 209 F. Supp. 2d 37 at 52 (D.D.C. Mar. 12, 2002) (alternative holding). \19\ Id. at 54. \20\ 108 F. Supp. 2d 19, 30 (D.D.C. 2000). --------------------------------------------------------------------------- Applying these recent decisions here, indiscriminate release of CEII could impair the effectiveness of the Commission's programs, which are meant to satisfy its mandate to regulate and oversee energy industries in the economic and environmental interest of the American public.\21\ Inappropriate release of CEII could make the infrastructure more vulnerable to attack, threatening those industries and resulting in potentially devastating economic and environmental consequences. Release of CEII also could make regulated entities less forthcoming in the information they provide to the Commission, especially where they have discretion as to what they submit.\22\ Restricted flow of information between the Commission and the companies could impair the Commission's programs that rely on such information. This is of particular concern in today's world, where the Commission is seeking additional information from licensees to assure that the infrastructure is sited and built safely and remains protected. Finally, release of CEII could harm the relationship between Commission staff and the regulated companies, impairing trust, and causing the parties to deal with each other in a more adversarial manner than necessary. For all of these reasons, much, if not all of the CEII would be exempt from disclosure under the third prong of Exemption 4 as it relates to compelled submissions. --------------------------------------------------------------------------- \21\ See http://www.ferc.gov/About/mission/mission_intro.htm \21\ See http://www.ferc.gov/About/mission/mission_intro.htm (2002). \22\ See Nadler, 899 F. Supp. 158, 162. --------------------------------------------------------------------------- A second issue is whether the Trade Secrets Act prohibits the Commission from sharing Exemption 4 material on an as-needed basis. The Trade Secrets Act states in relevant part that: Whoever, being an officer or employee of the United States or of any department or agency thereof, publishes, divulges, discloses or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties or by reason of any examination or investigation made by, or return, report or record made to or filed with, such department or agency or officer or employee thereof, which concerns or relates to trade secrets, processes, operations, style of work, or apparatus, or to the identify, confidential statistical data, amount or source of any income, profits, losses or expenditures of any person, firm, partnership, corporation, or association; * * * to be seen or examined by any person except as provided by law; shall be fined not more than $1,000, or imprisoned not more than one year, or both; [[Page 9873]] and shall be removed from office or employment.\23\ --------------------------------------------------------------------------- \23\ 18 U.S.C. 1905. --------------------------------------------------------------------------- See Chrysler Corp. v. Brown, 441 U.S. 281, 301(1979) (Chrysler). The Trade Secrets Act applies to formal agency actions as well as actions by the agency's individual employees. Courts have found that the coverage of the Trade Secrets Act and Exemption 4 are co- extensive,\24\ meaning that the Trade Secrets Act generally prohibits release of information covered by Exemption 4.\25\ However, the Trade Secrets Act permits disclosure of trade secret information where ``authorized by law.'' \26\ Accordingly, under the Trade Secrets Act, protected information may be released where there is statutory or regulatory authority for the agency to release it. In cases where the authorization for release is found in an agency regulation, the inquiry is whether the regulation permitting the release is authorized by law.\27\ --------------------------------------------------------------------------- \24\ See, e.g., Bartholdi Cable Co. v. FCC, 114 F.3d 274 (D.C. Cir. 1997); CNA, 830 F.2d at 1152. \25\ CNA, 830 F.2d at 1151. \26\ Chrysler, 441 U.S. at 301. \27\ Id. --------------------------------------------------------------------------- The Commission has statutory authority to release trade secret information. While both the Federal Power and Natural Gas Acts place restrictions on an individual employee's release of information gathered in the course of examining records of a company, they permit the Commission itself to authorize such a release. The Federal Power Act provides: The Commission shall at all times have access to and the right to inspect and examine all accounts, records, and memoranda of licensees and public utilities, and it shall be the duty of such licensees and public utilities to furnish to the Commission, within such reasonable time as the Commission may order, any information with respect thereto which the Commission may by order require, including copies of maps, contracts, reports of engineers, and other data, records, and papers, and to grant to all agents of the Commission free access to its property and its accounts, records and memorandum when requested so to do. No member, officer, or employee of the Commission shall divulge any fact or information which may come to his knowledge during the course of examination of books or other accounts, as hereinbefore provided, except insofar as he may be directed by the Commission or by a court.\28\ --------------------------------------------------------------------------- \28\ 16 U.S.C. 825(b); see also 15 U.S.C. 717g(b) (Natural Gas Act) and 18 CFR 3c.2(a). --------------------------------------------------------------------------- In addition, sections 4 and 312 of the Federal Power Act authorize the Commission ``[t]o make public from time to time the information secured hereunder and to provide for the publication of its reports and investigations in such form and manner as may be best adapted for public information and use.'' \29\ Section 14 of the Natural Gas Act provides similar authorization. It states: --------------------------------------------------------------------------- \29\ 16 U.S.C. 797(d), 825k. --------------------------------------------------------------------------- The Commission may permit any person to file with it a statement in writing, under oath or otherwise, as it shall determine, as to any or all facts and circumstances concerning a matter which may be the subject of investigation. The Commission, in its discretion, may publish in the manner authorized in section 312 of the Federal Power Act * * * information concerning any such matter.\30\ --------------------------------------------------------------------------- \30\ 15 U.S.C. 717m. --------------------------------------------------------------------------- Because these provisions give the Commission broad discretion to release information, such release would be authorized by law under the Federal Power and Natural Gas Acts and, therefore, permitted under the Trade Secrets Act, creating an exception to the normal situation where the Trade Secrets Act prohibits release of information covered by Exemption 4. This, in turn, would permit the Commission to withhold the information from public FOIA disclosure under Exemption 4, and still disclose the information to selected individuals with appropriate restrictions on use and dissemination of that information without violating the Trade Secrets Act. c. Exemption 7 Exemption 7 exempts from disclosure certain information compiled for law enforcement purposes.\31\ For purposes of CEII, the most relevant Exemption 7 provision is 7(F), which allows information to be withheld in order to protect a person's life or physical safety. In order to invoke Exemption 7, the agency must be able to demonstrate that the document at issue involves enforcement of a statute or regulation that the agency is authorized to enforce. The Commission has very broad authority to enforce the provisions of the Federal Power Act and the Natural Gas Act. For instance, under the Federal Power Act, the Commission (1) Monitors and investigates compliance with licenses, exemptions and preliminary permits it issues; \32\ (2) determines just and reasonable rates; \33\ and (3) ensures compliance with the Act and regulations issued thereunder.\34\ Similarly, with respect to the Natural Gas Act, the Commission has broad authority to (1) Determine whether rates and charges are just and reasonable; \35\ and (2) enforce violations of the statute or regulations issued thereunder.\36\ Thus, given its broad enforcement authority, much of the information the Commission collects qualifies as information collected for a law enforcement purpose. For such law enforcement information to enjoy protection under Exemption 7(F), however, the release of the information must reasonably be expected to endanger a person's life or safety. --------------------------------------------------------------------------- \31\ 5 U.S.C. 552(b)(7). \32\ 16 U.S.C. 823b. \33\ 16 U.S.C. 824e. \34\ 16 U.S.C. 825m, 825o-1. \35\ 15 U.S.C. 717c. \36\ 15 U.S.C. 717s. --------------------------------------------------------------------------- As noted in paragraph 11 of the final rule, there have been official warnings that the energy infrastructure could be the target of terrorist attacks. Given that an attack on the energy infrastructure is a legitimate threat, the Commission concludes that release of information that could facilitate or increase the likelihood of the success of such an attack could be expected to endanger life and safety of people. The failure of a dam could cause flooding that would endanger lives, as could the explosion of a natural gas pipeline. Interruptions to gas and electric power supplies likewise could endanger lives of those reliant on power, especially in times of extreme hot or cold weather. For these reasons, information identified as CEII may qualify for protection under Exemption 7(F). [FR Doc. 03-4834 Filed 2-28-03; 8:45 am] BILLING CODE 6717-01-P --------------------------------------------------------------------