Federal Register: March 3, 2003 (Volume 68, Number 41)
Rules and Regulations             
Page 9857-9873                      

=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

18 CFR Parts 375 and 388

[Docket Nos. RM02-4-000, PL02-1-000; Order No. 630]

 
Critical Energy Infrastructure Information

February 21, 2003.
AGENCY: Federal Energy Regulatory Commission, DOE.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Federal Energy Regulatory Commission (Commission) is 
issuing this final rule establishing a procedure for gaining access to 
critical energy infrastructure information (CEII) that would otherwise 
not be available under the Freedom of Information Act (FOIA). These 
restrictions and the final rule were necessitated by the terrorist acts 
committed on September 11, 2001, and the ongoing terrorism threat. The 
final rule adopts a definition of critical infrastructure that 
explicitly covers proposed facilities, and does not distinguish among 
projects or portions of projects. The rule also details which location 
information is excluded from the definition of CEII and which is 
included. The rule addresses some issues that are specific to state 
agencies, and clarifies that energy market consultants should be able 
to get access to the CEII they need. Finally, the rule modifies the 
proposed CEII process and delegates responsibility to the CEII 
Coordinator to process requests for CEII and to determine what 
information qualifies as CEII.
    The final rule will affect the way in which companies submit some 
information, and will add a new process in addition to the FOIA for 
requesters to use to request information that is not already publicly 
available. These new steps will help keep sensitive infrastructure 
information out of the public domain, decreasing the likelihood that 
such information could be used to plan or execute terrorist attacks.

EFFECTIVE DATE: The rule will become effective April 2, 2003.

FOR FURTHER INFORMATION CONTACT: Carol C. Johnson, Wilbur T. Miller, 
Office of the General Counsel, Federal Energy Regulatory Commission, 
888 First Street, NE., Washington, DC 20426. (202) 502-6457.

SUPPLEMENTARY INFORMATION: 
    1. In this final rule, the Federal Energy Regulatory Commission 
(Commission) amends its regulations to address the appropriate 
treatment of critical energy infrastructure information (CEII) in the 
aftermath of the September 11, 2001, terrorist attacks on the United 
States of America. Under the Policy Statement issued in Docket No. 
PL02-1-000 on October 11, 2001 (Policy Statement), the Commission 
removed from easy public access certain documents that previously had 
been public.\1\ In order to accomplish this step quickly, staff 
identified categories of document types that were likely to contain 
CEII, and those documents were removed from unrestricted public access. 
Persons seeking removed documents were directed to request the records 
using the Freedom of Information Act.\2\
---------------------------------------------------------------------------

    \1\ See 67 FR 3129 (Jan. 23, 2002), IV FERC Stats. & Regs. ] 
35,542.
    \2\ 5 U.S.C. 552.
---------------------------------------------------------------------------

    2. On January 16, 2002, the Commission issued a Notice of Inquiry 
(NOI) in RM02-4-000 to determine what changes, if any, should be made 
to its regulations to restrict unfettered general public access to 
critical energy infrastructure information, but still permit those with 
a need for the information to obtain it in an efficient manner.\3\ On 
September 5, 2002, the Commission issued a Notice of Proposed 
Rulemaking and Revised Statement of Policy (NOPR) in Docket Nos. RM02-
4-000 and PL02-1-000.\4\ The NOPR proposed procedures for submitting 
and requesting CEII, and proposed the creation of a new position of 
CEII Coordinator. The final rule adopts most of the procedures proposed 
in the NOPR and creates the new position.
---------------------------------------------------------------------------

    \3\ See 67 FR 3129, IV FERC Stats. & Regs. ] 35,542.
    \4\ See 67 FR 57994 (Sept. 13, 2002), IV FERC Stats. & Regs. ] 
32,564.
---------------------------------------------------------------------------

    3. The process adopted in the final rule offers a more efficient 
alternative to handling requests for previously public documents than 
does the FOIA, which the Policy Statement established as the short-term 
method for requesting previously public documents. The FOIA was useful 
in the short term where a great deal of information had been removed 
from public access, some of which the Commission ultimately ascertained 
did not actually contain CEII. As discussed in the NOPR, however, the 
FOIA process is not well suited for handling CEII requests.\5\ The FOIA 
mandates disclosure of agency records unless the record falls within 
one of several specifically enumerated exemptions. Therefore, in order 
for CEII to be protected from disclosure, it must qualify for a FOIA 
exemption. For this reason, it is unlikely that requesters will obtain 
CEII through the FOIA process, although they could use the FOIA to 
obtain non-CEII portions of documents. In addition, under the FOIA, an 
agency may not distinguish among requesters based on their particular 
need for the information. Information given to one FOIA requester must 
be given to all requesters. The agency also may not restrict the 
recipient's use or dissemination of the information. All these factors 
make FOIA an unsatisfactory tool for the agency to use if it wishes to 
afford requesters with a specific need for information access to exempt 
and potentially dangerous information. Therefore, the Commission is 
adding Sec.  375.313 to its regulations to authorize a Critical Energy 
Infrastructure Information Coordinator to process non-FOIA requests for 
CEII and make determinations regarding such requests.\6\
---------------------------------------------------------------------------

    \5\ Id. at p. 57995, ] 32,564 at p. 34,539.
    \6\ Of course, the Commission emphasizes that requesters always 
retain the option of seeking information under the FOIA.

---------------------------------------------------------------------------

[[Page 9858]]

    4. The NOPR revised the Policy Statement to restrict public access 
to documents containing detailed specifications of proposed facilities 
as well as existing facilities, while at the same time determining that 
basic location information should not be treated as CEII.\7\ The final 
rule formalizes these policies in the regulations.
---------------------------------------------------------------------------

    \7\ 67 FR 57994 at p. 57995, FERC Stats. & Regs. ] 32,564 at p. 
34,539.
---------------------------------------------------------------------------

    5. The Commission is issuing this rule under the authority of the 
Federal Power Act \8\ and the Natural Gas Act \9\ as the rule 
establishes a procedure for gaining access to documents collected or 
created pursuant to those acts that would not otherwise be available 
under the Freedom of Information Act, 5 U.S.C. 552. Accordingly, this 
order is subject to rehearing under section 313(b) of the Federal Power 
Act, 16 U.S.C. 824l(b), and section 19(b) of the Natural Gas Act, 15 
U.S.C. 717r(b), and jurisdiction to review the order lies in the United 
States Courts of Appeals as provided in those sections.
---------------------------------------------------------------------------

    \8\ 15 U.S.C. 717, et seq.
    \9\ 16 U.S.C. 791a, et seq.
---------------------------------------------------------------------------

I. Background

A. The Policy Statement

    6. The September 11, 2001, terrorist attacks prompted the 
Commission to issue a policy statement on October 11, 2001, in PL02-1-
000, addressing the treatment of previously public documents.\10\ The 
Commission announced there that it would no longer make available to 
the public through its Internet site, the Records and Information 
Management System (RIMS), which has been replaced by the Federal Energy 
Regulatory Records Information System (FERRIS), or the Public Reference 
Room, documents such as oversized maps that detail the specifications 
of energy facilities already licensed or certificated under Part I of 
the Federal Power Act \11\ and section 7(c) of the Natural Gas Act,\12\ 
respectively. Rather, anyone requesting such documents was directed to 
follow the procedures set forth in section 388.108 of the Commission's 
regulations (Requests for Commission records not available through the 
Public Reference Room (FOIA Requests)).\13\ The Policy Statement also 
instructed staff to report back to the Commission within 90 days on the 
impact of this newly announced policy on the agency's business.
---------------------------------------------------------------------------

    \10\ See 66 FR 52917 (Oct. 18, 2001), 97 FERC ] 61,030. Shortly 
after the attacks, the Commission issued another policy statement in 
Docket No. PL01-6-000, in which it provided guidance to regulated 
companies regarding extraordinary expenditures necessary to 
safeguard national energy supplies. See 96 FERC ] 61,299 (2001). The 
Commission recognized there that electric, gas, and oil companies 
may need to adopt new procedures, update existing procedures, and 
install facilities to further safeguard their systems, and that 
these efforts might result in extraordinary expenditures. The 
Commission assured these companies that it would give its highest 
priority to processing any filing made for the recovery of such 
expenditures. See, e.g., Colonial Pipeline Co., 100 FERC ] 61,035 
(2002) (approving Colonial's security surcharge mechanism).
    \11\ 16 U.S.C. 719a, et seq.
    \12\ 15 U.S.C. 717f(c).
    \13\ 18 CFR 388.108 (2002).
---------------------------------------------------------------------------

B. Implementation of the Policy Statement

    7. To implement the policy, the Commission's staff first disabled 
RIMS access to all oversized documents, which frequently contain 
detailed infrastructure information, and also removed them from the 
Public Reference Room.\14\ Staff next identified and disabled or denied 
access to other categories of documents dealing with licensed or exempt 
hydropower projects, certificated natural gas pipelines, and electric 
transmission lines that appeared likely to include critical energy 
infrastructure information. This effort, which was undertaken as 
cautiously and methodically as possible, affected tens of thousands of 
documents.
---------------------------------------------------------------------------

    \14\ OMB Watch has misunderstood what was meant by oversized 
documents, stating ``[c]learly file size was used as a criterion for 
removal of information,'' terming this a ``blunt and clumsy 
approach.'' OMB Watch at p. 3. As explained in the Policy Statement, 
the Commission removed ``documents, such as oversized maps.'' 
``Oversized'' refers to the size of the page itself, not the length 
of the document. Oversized documents generally contain maps and 
detailed diagrams, both of which were deemed likely to contain CEII, 
keeping in mind that location information of existing facilities was 
being protected at that time.
---------------------------------------------------------------------------

    8. From the issuance of the Policy Statement until mid-January 
2003, the Commission received 212 FOIA requests for documents that were 
not available to the public because of the Policy Statement. The 
Commission has responded to or otherwise resolved all of these 
requests. To date, only two CEII requesters have filed timely 
administrative appeals of the decisions to withhold documents, both of 
which involved requests for FERC Form No. 715. Nothing is pending in 
court.

C. The Notice of Inquiry

    9. Three months after the Commission issued the Policy Statement, 
it issued the Notice of Inquiry (NOI).\15\ The NOI set forth the 
Commission's general views on how it intended to treat previously 
public documents, and asked specific questions on the scope and 
implications of maintaining the confidentiality of certain previously 
public documents. The NOI advised infrastructure owners that they could 
seek confidential treatment of filings or parts of filings that, in 
their opinion, contain CEII, following the existing procedures in Sec.  
388.112 of the Commission's regulations,\16\ and by referencing Docket 
No. PL02-1-000 on the first page of the filing. Approximately 50 
entities responded to the NOI, with a handful of commenters filing some 
portion of their filing nonpublic.
---------------------------------------------------------------------------

    \15\ See 67 FR 3129, IV FERC Stats. & Regs. ] 35,542.
    \16\ 18 CFR 388.112.
---------------------------------------------------------------------------

D. The Notice of Proposed Rulemaking and Revised Policy Statement

    10. On September 5, 2002, the Commission issued the Notice of 
Proposed Rulemaking and Revised Statement of Policy (NOPR) in Docket 
Nos. RM02-4-000 and PL02-1-000.\17\ The NOPR proposed to establish a 
CEII Coordinator with delegated authority to process requests for CEII, 
and proposed regulations governing submission of CEII and requests for 
CEII.\18\ It also revised the Policy Statement to extend CEII 
protection to information regarding proposed facilities and eliminate 
CEII protection for information that only reveals the location of the 
facility.\19\ The Commission received more than forty comments in 
response to the NOPR. A list of commenters is attached as Appendix A.
---------------------------------------------------------------------------

    \17\ See 67 FR 57994, IV FERC Stats. & Regs. ] 32,564.
    \18\ Id. at p. 58001, ] 32,564 at p. 34,550.
    \19\ Id. at p. 58000, ] 32,564 at pp. 34,547-48.
---------------------------------------------------------------------------

II. Discussion

A. The Need for Action

    11. As was the case with the NOI, most commenters agree that 
security considerations make it advisable for the Commission to 
continue to protect CEII. A few commenters, however, maintain that such 
protection is either unnecessary to protect the public or outweighed by 
the benefits of making the information available. Some contend that 
CEII will be of little use to terrorists,\20\ an assertion with which 
some commenters specifically disagree.\21\ Some commenters believe that 
the NOPR did not adequately take into account the value of making 
information such as CEII available to the public, and specifically the 
media.\22\

[[Page 9859]]

One commenter contends, for example, that the media has used such 
information to expose safety hazards in pipelines.\23\
---------------------------------------------------------------------------

    \20\ E.g., American Library Association at p. 2; Lydia Olchoff 
at p. 1; Reporters Committee for Freedom of the Press and the 
Society of Environmental Journalists (Reporters Committee) at p. 3.
    \21\ E.g., GE Power Systems Energy Consulting (GE) at pp. 2-3.
    \22\ E.g., American Library Association at p. 1; OMB Watch at p. 
1, 4.
    \23\ Reporters Committee at p. 3-4. The Commission does not, 
however, have jurisdiction over pipeline safety issues, which 
belongs to the Department of Transportation. See 49 U.S.C. Chapter 
601.
---------------------------------------------------------------------------

    12. The Commission remains convinced that the responsible course is 
for it to protect CEII. The arguments that such protection is 
unnecessary are speculative and unconvincing. For instance, one 
commenter points to an estimate that seventy percent of infrastructure 
attacks come from insiders as evidence that CEII is unlikely to aid an 
attack,\24\ while another states that ``the possibility that terrorists 
will study government records and take advantage of perceived 
weaknesses is speculative.''\25\ The Commission is not prepared to 
stake the public's safety on this reasoning. According to the National 
Infrastructure Protection Center, the energy sector is considered one 
of the most attractive terrorist targets.\26\ According to media 
reports, the FBI identified ``multiple casings of sites'' where users 
routed through switches in Saudi Arabia, Indonesia, and Pakistan 
examined ``emergency phone systems, electrical generation and 
transmission, water storage and distribution, nuclear power plants and 
gas facilities.''\27\ Where vulnerable areas exist, the Commission 
believes its responsibility is to reduce risks rather than to wait for 
proof that an attack is imminent or even likely.
---------------------------------------------------------------------------

    \24\ American Library Association at p. 2.
    \25\ Reporters Committee at p. 3.
    \26\ See National Infrastructure Protection Center Advisory 02-
007 (September 10, 2002) (identifying most attractive targets as 
transportation and energy sectors and ``[f]acilities or gatherings 
that would be recognized worldwide as symbols of American power or 
security.'') The National Infrastructure Protection Center's mission 
is to serve as the United States government's focal point for threat 
assessment, warning, investigation and response for threats or 
attacks against critical infrastructures, including energy and water 
systems.
    \27\ See The Washington Post, Cyber-Attacks by Al Qaeda Feared, 
June 27, 2002, p. A01.
---------------------------------------------------------------------------

    13. The Commission also is unconvinced that the general public's 
need for information warrants the risk of disclosure of CEII. The 
``need to know'' has never been absolute: the FOIA itself recognizes 
this principle by having nine exemptions, and the NOPR proposed to do 
nothing more than rely upon FOIA exemptions in withholding CEII.\28\ 
The Commission received no convincing arguments in response to the NOPR 
that there are practical benefits from public availability of CEII that 
would outweigh possible dangers from attacks on energy infrastructure. 
Furthermore, this rulemaking is intended to provide an avenue for 
disclosure in instances where there might be some benefit. The 
Commission has attempted to strike the best balance possible between 
the benefits of information and the protection of people and property.
---------------------------------------------------------------------------

    \28\ 67 FR 57994 at p. 57996, FERC Stats. & Regs. ] 32,564 at p. 
34,541.
---------------------------------------------------------------------------

B. Legal Authority to Protect CEII

    14. In the NOI that initiated this rulemaking, the Commission 
invited comments on statutes that might affect the Commission's ability 
to protect CEII. The FOIA was identified as the statute that could 
mandate disclosure of some sensitive information. After receiving 
comments from many commenters, the Commission set out its view, in the 
NOPR, that one or more of several FOIA exemptions would most likely 
apply to CEII,\29\ namely: (1) Exemption 2, which exempts ``records 
related solely to the internal personnel rules and practices of an 
agency''; \30\ (2) Exemption 4, which protects from disclosure ``trade 
secrets and commercial or financial information obtained from a person 
and privileged or confidential''; \31\ and (3) Exemption 7, which 
protects from disclosure certain law enforcement information, including 
information the disclosure of which might jeopardize a person's life or 
safety.\32\
---------------------------------------------------------------------------

    \29\ Id. at pp. 57997-800, ] 32,564 at pp. 34,542-46.
    \30\ 5 U.S.C. 552(b)(2).
    \31\ 5 U.S.C. 552(b)(4).
    \32\ 5 U.S.C. 552(b)(7)(F).
---------------------------------------------------------------------------

    15. Most commenters agree with the Commission's belief that one or 
more of these three exemptions would apply to CEII,\33\ and the 
Commission adopts the analysis in the NOPR to support its decision 
here.\34\ Some, however, either express concerns about the Commission's 
analysis of one or more exemptions or outright disagree with that 
analysis.\35\ A few commenters assert that the Commission was somehow 
overriding the FOIA \36\ by creating an ``extra-legal category of 
protected information,'' \37\ or by making CEII non-requestable under 
the FOIA.\38\
---------------------------------------------------------------------------

    \33\ E.g., American Electric Power System at p. 1; Duke Energy 
Corporation (Duke) at p. 7; Edison Electric Institute (EEI) at pp. 
6-7; Southern California Edison Company (SCE) at p. 10; Southern 
Company Services, Inc. (Southern) at p. 2; Washington Legal 
Foundation and Public Interest Clinic, George Mason University 
School of Law (Washington Legal Foundation) at pp. 5-6.
    \34\ For the public's convenience, the Commission's FOIA 
analysis is reiterated in Appendix B.
    \35\ E.g., Hydropower Reform Coalition (HRC) at p. 3; 
Massachusetts Energy Facilities Siting Board at p. 3; National 
Association of Regulatory Utility Commissioners (NARUC) at pp. 3, 7-
10, 12-15; OMB Watch at pp. 4-6; Reporters Committee at pp. 2, 4, 7; 
joint comments of the Public Utilities Commission of Ohio, the 
Michigan Public Service Commission and the Oklahoma Corporation 
Commission (States) at pp. 3, 7-10, 12-17; Whitfield Russell 
Associates at p. 8.
    \36\ OMB Watch at pp. 4-5; Reporters Committee at pp. 2, 7.
    \37\ American Library Association at p. 2.
    \38\ OMB Watch at p. 4.
---------------------------------------------------------------------------

    16. The comments asserting that the Commission is somehow 
attempting to abrogate or circumvent the FOIA reflect a fundamental 
misunderstanding of this rulemaking. The Commission expressly 
acknowledged in the NOPR its continuing obligation to comply with the 
FOIA.\39\ This rule does not exempt any information from disclosure 
under that statute unless it falls within an existing exemption, 
abrogate in any way the right of any person to submit a request under 
the FOIA, or make any document or category of documents non-requestable 
or otherwise not subject to the FOIA. It is not the function of this 
rule to make any document unavailable that would otherwise be available 
absent this rulemaking. Instead, the purpose of this rulemaking is to 
establish a mechanism for making available certain categories of 
documents that would otherwise be unavailable.
---------------------------------------------------------------------------

    \39\ 67 FR 57994 at p. 57996, FERC Stats. & Regs. ] 32,564 at p. 
34,541.
---------------------------------------------------------------------------

    17. The discussion of the FOIA exemptions in the NOPR reflects the 
Commission's view that a re-evaluation of information access policies, 
including analysis of the FOIA provisions, is dictated by the changed 
understanding of safety issues resulting from the 9/11 tragedy.\40\ 
That re-evaluation would be needed regardless of any regulation 
governing access to CEII. It becomes relevant here as a part of the 
reasoning behind this rulemaking, but it should not be mistaken for a 
determination as to whether any specific piece of information is 
accessible under the FOIA. A FOIA requester has a right to receive an 
individualized determination based on the document(s) requested. The 
Commission has not made, and cannot properly make, generic 
determinations as to whether FOIA exemptions apply. Accordingly, 
specific arguments with respect to Exemptions 2, 4, and 7 addressed in 
the NOPR,\41\ and raised again here,\42\ are best

[[Page 9860]]

resolved in the context of particular FOIA requests, where submitters 
have the opportunity to enumerate potential competitive harm associated 
with release, and where the Commission can evaluate the harm of 
releasing that particular information. For purposes of this rulemaking, 
however, the Commission continues to believe that the types of 
information it has identified as CEII are exempt from disclosure under 
the FOIA.
---------------------------------------------------------------------------

    \40\ Id. at pp. 57996-800, ] 32,564 at pp. 34,541-46.
    \41\ Id.
    \42\ E.g., NARUC at p. 12; States at p. 13; OMB Watch at p. 5; 
Whitfield Russell Associates at p. 8 (harm resulting from terrorist 
attacks would not constitute competitive harm under Exemption 4); 
Reporters Committee at p. 7; OMB Watch at p. 6 (information that was 
previously public is not protected under the FOIA).
---------------------------------------------------------------------------

    18. As a separate matter, some commenters raise issues concerning 
the Commission's experience with Exemption 7 and question whether it 
applies outside the context of criminal investigations.\43\ In 
particular, OMB Watch wonders how the Commission could have removed 
from public access tens of thousands of documents on the basis that 
they were compiled for law enforcement purposes and asks whether the 
Commission ever relied upon Exemption 7 prior to the 9/11 attack.\44\ 
With respect to OMB Watch's first argument, the Commission did not 
remove thousands of documents from public access in October 2001 based 
on Exemption 7. The Commission removed them because they fit within 
certain categories of documents that were identified as likely to 
contain information that could be harmful in the hands of terrorists. 
The Commission did not do a document-by-document review of these 
documents to determine whether they contained information exempt from 
disclosure under the FOIA. In response to OMB Watch's second point, the 
Commission has relied from time to time on Exemption 7 prior to 9/
11.\45\ More to the point, it has long been recognized that Exemption 7 
applies to civil as well as criminal law enforcement.\46\ OMB Watch is 
likewise mistaken that the Commission will claim that all information 
it collects constitutes law enforcement information.\47\ The Commission 
has no such intention because it recognizes that Exemption 7 does not 
protect all law enforcement information, but only certain limited 
types, such as information the disclosure of which might interfere with 
enforcement proceedings or endanger the safety of an individual.\48\
---------------------------------------------------------------------------

    \43\ E.g., OMB Watch at p. 7; Reporters Committee at p. 6.
    \44\ OMB Watch at p. 7.
    \45\ A review of the Commission's Annual FOIA reports for FY 
1998 through 2001 indicates that the Commission relied on Exemption 
7 in Fiscal Years 2001 and 1998, specifically citing exemption 7(A) 
eight times, 7(B) two times, 7(C) three times, 7(D) two times, and 
7(E) five times during those two fiscal years. The Commission also 
relied on Exemption 7(F) more recently in modifying its practice of 
making the entirety of FERC Form No. 715 available to the public. 
See Order on Treatment of Information Collected in Form No. 715, 100 
FERC ] 61,141 (2002).
    \46\ E.g., Detroit Free Press, Inc. v. DOJ, 73 F.3d 93, 96 (6th 
Cir. 1996); Williams v. IRS, 479 F.2d 317, 318 (3rd Cir. 1973).
    \47\ See OMB Watch at p. 7.
    \48\ 5 U.S.C. 552(b)(7).
---------------------------------------------------------------------------

    19. Some commenters raise administrative issues. They assert, for 
example, that this rulemaking will improperly remove functions from 
qualified ``access professionals,'' and that the Commission has not 
adequately explained what qualifications the CEII Coordinator must 
possess.\49\ These concerns are misplaced. As stated above, FOIA 
requests will continue to be processed according to the Commission's 
established FOIA procedures and the Commission's FOIA staff. The 
Commission's goal in appointing the CEII Coordinator will be the same 
as its goal in assigning staff to handle FOIA requests, or for that 
matter all of its staff: to ensure that employees are qualified and 
properly trained to handle their appointed responsibilities. Moreover, 
as explained below in the discussion on the use of a CEII Coordinator, 
the Coordinator will be free and indeed encouraged to consult with the 
staff who provides advice and recommendations on FOIA responses.
---------------------------------------------------------------------------

    \49\ OMB Watch at p. 7; Reporters Committee at pp. 4-5.
---------------------------------------------------------------------------

    20. Some commenters ask whether the Commission will automatically 
transfer a FOIA request to the CEII Coordinator if it turns out that 
the requested information is CEII.\50\ The answer is, generally no. If 
a requester files a FOIA request and does not follow the procedures for 
seeking access to CEII, the request will be handled as a FOIA request 
and, if the requested information is exempt from disclosure, it will be 
withheld. The requester will, however, be notified that the 
information, although exempt from disclosure under the FOIA, may be 
accessible under the CEII procedures. If the requester seeks access 
under both the FOIA and CEII procedures, Commission staff will 
coordinate the response.
---------------------------------------------------------------------------

    \50\ NARUC at p. 24; States at p. 24.
---------------------------------------------------------------------------

    21. The Commission received comments questioning whether a utility 
must claim CEII status for information in order for it to qualify for 
protection under Exemption 4.\51\ The information either is or is not 
CEII. Thus, a claim that information is CEII is not necessary for the 
information to qualify as such. For the same reason, a claim that 
information is CEII will not necessarily qualify it as CEII. 
Accordingly, a submitter's ability to claim protection under Exemption 
4 in particular is not, and cannot be, conditioned on a claim of CEII 
status. Information may qualify for Exemption 4 protection and not be 
CEII, just as information may qualify for CEII protection and not fit 
within Exemption 4, as long as it fits within another FOIA exemption.
---------------------------------------------------------------------------

    \51\ NARUC at p. 13; States at p. 14.
---------------------------------------------------------------------------

    22. As stated above, the Commission recognizes that it is bound by 
the FOIA. Where the FOIA affords certain rights to submitters of 
information, the Commission remains obligated to recognize those 
rights, just as it remains obligated to recognize the rights of FOIA 
requesters. Nevertheless, if a utility fails to claim CEII status for 
information that would qualify as CEII, the risk that the information 
will be disclosed is increased because Commission staff may not become 
fully aware of the dangers of disclosing it. Commission staff will 
endeavor to identify CEII in processing requests, including information 
for which submitters have not claimed CEII status, but proper 
determinations about what information should be released under the FOIA 
will be easier to make where submitters identify information they 
believe to constitute CEII.
    23. Finally, some requesters express concern whether the Commission 
will provide adequate information about decisions not to disclose CEII, 
including information that would allow requesters to challenge claims 
of competitive harm.\52\ Determinations of competitive harm would occur 
as part of the FOIA process and would be subject to existing FOIA 
procedures. The Commission informs a FOIA requester of the reason(s) 
for withholding information and the requester may appeal that 
determination to the Commission's General Counsel and ultimately to a 
United States District Court.\53\ This rulemaking makes no changes to 
that procedure. Where information that is exempt from disclosure under 
the FOIA is found to be CEII, as noted, the Commission will so notify 
the requester.
---------------------------------------------------------------------------

    \52\ NARUC at pp. 23-24; States at pp. 24-25.
    \53\ 18 CFR 388.108(c)(1), 388.110 (2002).
---------------------------------------------------------------------------

C. Definition of CEII

    24. The NOPR proposed to define CEII in Sec.  388.113(c)(1) of the 
Commission's regulations \54\ as:
---------------------------------------------------------------------------

    \54\ 18 CFR 388.113(c)(1) (2002).

    Information about proposed or existing critical infrastructure 
that: (i) Relates to the production, generation, transportation, 
transmission, or distribution of energy; (ii) Could be useful to a 
person in planning an attack on critical infrastructure; (iii) Is 
exempt from mandatory disclosure under the

[[Page 9861]]

Freedom of Information Act, 5 U.S.C. 552; and (iv) Does not simply 
give the location of the critical infrastructure.\55\
---------------------------------------------------------------------------

    \55\ 67 FR 57994 at p. 58000, FERC Stats. & Regs. ] 32,564 at p. 
34,548.

    This definition departed from the prior policy in that it covered 
proposed facilities as well as existing facilities, and in that it 
excluded from the definition of CEII information regarding the location 
of the infrastructure. The majority of comments regarding the proposed 
CEII definition involve the meaning of ``critical infrastructure,'' the 
exclusion of location information, and the inclusion of information 
about proposed facilities.
1. Definition of Critical Infrastructure
    25. A crucial element in defining CEII is determining what 
qualifies as ``critical infrastructure.'' The NOPR proposed to define 
critical infrastructure as:

    Systems and assets, whether physical or virtual, that are so 
vital to the United States that the incapacity or destruction of 
such systems or assets would have a debilitating impact on the 
security, national economic security, national public health or 
safety, or any combination of those matters.\56\
---------------------------------------------------------------------------

    \56\ Id. at pp. 58000-01, ] 32,564 at p. 34,548.

    The NOPR proposed definition of critical infrastructure was taken 
directly from the USA PATRIOT Act (Act).\57\ In proposing that 
definition, the Commission believed that all components of the energy 
infrastructure would qualify as critical infrastructure based on a 
finding in the Act that ``[p]rivate business, government, and the 
national security apparatus increasingly depend on an interdependent 
network of critical physical and information infrastructures, including 
telecommunications, energy, financial services, water and 
transportation sectors.''
---------------------------------------------------------------------------

    \57\ Pub. L. 107-56.
---------------------------------------------------------------------------

    26. Some commenters agree with the proposed CEII definition, with 
EEI noting that ``[e]lectricity is an essential public service that 
sustains public health and welfare, including * * * the provision of 
power for heating and air conditioning, water supply, street and 
building, hospital services, food storage and processing, computers, 
and other electrical equipment,'' and as such, is vital to the nation's 
health, security, and economy.\58\ Other commenters, however, are 
concerned that the language could be read to extend CEII coverage only 
to very large or ``vital'' projects. For example, the Interstate 
Natural Gas Association of America (INGAA) requests that the Commission 
revise the definition of ``critical infrastructure'' to include ``all 
facilities used in the production, generation, transportation, 
transmission, or distribution of energy.'' \59\ Conversely, the HRC 
recommends that the Commission consider ``only certain documents of 
high-risk, high priority cases to be available for CEII protections.'' 
\60\ Some commenters recommend that the Commission leave it up to the 
infrastructure owner to determine whether its project qualifies as 
critical infrastructure,\61\ while other commenters voice concern that 
the definition of CEII is too broad.\62\ In this regard, Reporters 
Committee states that ``[b]y defining CEII in a way that can have all 
major energy infrastructure fall under the CEII rubric, FERC maximizes 
the control it maintains over information.'' \63\
---------------------------------------------------------------------------

    \58\ EEI at p. 2.
    \59\ INGAA at p. 3.
    \60\ HRC at p. 5.
    \61\ E.g., MidAmerican Energy at p. 3; National Grid USA at p. 
5.
    \62\ E.g., HRC at p. 4; Reporters Committee at p. 8; Society of 
Professional Journalists at p. 2.
    \63\ Reporters Committee at p. 8.
---------------------------------------------------------------------------

    27. No matter how broadly or narrowly the Commission defines 
critical infrastructure, in order to qualify for protection as CEII, 
the information must be useful to terrorists in planning an attack, be 
exempt from disclosure under the FOIA, and not merely give the location 
of the infrastructure. This effectively limits the scope of CEII 
protection. Moreover, the Commission does not want to define CEII in an 
ambiguous way that will invite disputes over which facilities are 
covered. The definition of critical infrastructure should encompass all 
facilities and components of facilities, not just facilities above a 
certain threshold. Even though a project may be small, destruction of 
the project could have serious consequences, particularly where it is 
part of a larger overall system. It is also important to the Commission 
that computer systems that control or are part of the energy 
infrastructure are covered. Therefore, the final rule defines critical 
infrastructure in new Sec.  388.113(c)(2) of the Commission's 
regulations \64\ as ``existing and proposed systems and assets, whether 
physical or virtual, the incapacity or destruction of which would 
negatively affect security, economic security, public health or safety, 
or any combination of those matters.''
---------------------------------------------------------------------------

    \64\ See new 18 CFR 388.113(c)(2).
---------------------------------------------------------------------------

2. Information on Location of Facilities
    28. The majority of commenters object to the Commission's decision 
not to classify location information as CEII.\65\ In this regard, some 
question the Commission's assumption that location information is still 
publicly available in the wake of September 11.\66\ Others posit that 
the Commission should be a trailblazer, protecting location information 
even where it is publicly available elsewhere.\67\ Certain commenters 
argue that while the Commission should not protect information that is 
publicly available from other sources, such as USGS or commercial maps, 
other location information may warrant protection.\68\ Still others 
contend that information above a certain level of detail should be 
protected,\69\ for example, ``location of

[[Page 9862]]

key communication facilities, control centers, and switching 
facilities,'' \70\ and information that ``identifies major transmission 
interconnections and other system components.'' \71\
---------------------------------------------------------------------------

    \65\ E.g., American Gas Association at pp. 1-2; Bonneville Power 
Administration (BPA) at pp. 3-4; Duke at p. 14; INGAA at pp. 8-11; 
MidAmerican Energy Company (MidAmerican) at pp. 6-7; National Grid 
USA at pp. 3 and 5; National Hydropower Association at p. 5; 
Northwest Natural Gas Company (Northwest Natural) at pp. 4-8; 
Pacific Gas & Electric (PG&E) at p. 1; Williston Basin Interstate 
Pipeline Company (Williston Basin) at pp. 4-6.
    \66\ E.g., BPA at p. 4; Duke at p. 13 (citing articles claiming 
that numerous groups, including the Bureau of Transportation 
Statistics, the Department of Energy (DOE), the International 
Nuclear Safety Center, the Department of Transportation (DOT), the 
National Imagery and Mapping Agency and the United States Geological 
Survey, removed geographic information from open public access after 
September 11); EEI at pp. 8-9 (stating that DOE has removed 
information regarding nuclear facilities containing weapons-grade 
plutonium or highly enriched uranium, DOT has removed interactive 
oil pipeline maps, and the Energy Information Agency has removed 
similar information); and INGAA at p. 10.
    \67\ E.g., American Gas Association at p. 2; Northwest Natural 
at pp. 7-8; INGAA at pp. 10-11; PG&E at p. 1; Williston Basin at pp. 
4-5. These commenters believe that if the Commission protects this 
information, others may follow suit, eventually ``aging'' the 
information in the public domain, making it less useful to potential 
terrorists. The Commission appreciates these commenters' views, but 
believes that while this information might gradually become outdated 
in the public domain, the probability is remote given the 
availability of GPS equipment and commercial satellite images.
    \68\ E.g., PJM Interconnection (PJM) at p. 2, SCE at p. 5. For 
its part, INGAA, an advocate of protecting location information, 
concedes ``[t]o the extent that maps and/or location information are 
generally and readily available to the public and contain only non-
detailed information of the location of energy facilities [such as 
state- or county-level maps],'' such information could be excluded 
from the definition of CEII. INGAA at p. 8.
    \69\ E.g., GE at p. 6 (location of certain types of equipment, 
such as ``phase-angle regulators or critical FACTS devices'' should 
be protected); MidAmerican at p. 6; National Hydropower Association 
at p. 5 (protect information that provides ``details of the 
sensitive parts of facilities''); North American Electric 
Reliability Council (NERC) at pp. 4-5 (protect ``detailed network 
topology maps and the details of the interactions performed by 
Supervisory Control and Data Acquisition (SCADA) and Energy 
Management Systems (EMS)''; Northwest Natural at p. 5 (``assumes 
that medium to highly detailed facility location maps'' will be 
protected); PG&E at p. 6.
    \70\ BPA at p. 4.
    \71\ National Grid USA at p. 3.
---------------------------------------------------------------------------

    29. The Commission has considered the commenters' arguments and 
suggestions especially with respect to protecting information that may 
otherwise be available to the public. For this purpose, a check of the 
Internet revealed that some of the information that had been removed 
after September 11 is once again available. For instance, the 
International Nuclear Safety Center currently has interactive maps 
available on its web site,\72\ and the United States Geological Survey 
lists a variety of maps for sale, including 7.5 minutes maps.\73\ 
Although some information, such as the DOT pipeline maps have not been 
restored to public access, the Commission believes that there are 
publicly available sources that would enable a terrorist to locate most 
energy infrastructure. Without further guidance from the Congress or 
the Administration, the Commission is reluctant to withhold from public 
access location information that is otherwise available.
---------------------------------------------------------------------------

    \72\ See http://www.insc.anl.gov/pwrmaps/map/world_map.php.

    \73\ See http://mapping.usgs.gov/digitalbackyard/

topobkyd.html#5.
---------------------------------------------------------------------------

    30. The Commission concludes nevertheless that there is some 
``location'' information that does warrant protection as CEII. The 
Commission intends to release location information generally needed to 
participate in the National Environmental Policy Act (NEPA) process, 
while protecting information containing technical details not usually 
needed by most NEPA participants. Accordingly, the Commission considers 
the following types of gas and hydropower location information as 
outside the definition of CEII: (1) USGS 7.5-minutes topographic maps 
showing the location of pipelines, dams, or other aboveground 
facilities; (2) alignment sheets showing the location of pipeline and 
aboveground facilities, right of way dimensions, and extra work areas; 
(3) drawings showing site or project boundaries, footprints, building 
locations and reservoir extent; and (4) general location maps. In order 
to alleviate commenters' concerns about making this information so 
easily available, the Commission instructs filers to segregate this 
non-CEII location information into a separate volume or appendix, label 
it clearly ``Non-Internet Public,'' and submit it with instructions 
that it not be placed on the Internet.\74\ To the extent permissible 
and practical, the Commission will adhere to those instructions, but 
the information will still be publicly available through the Public 
Reference Room.
---------------------------------------------------------------------------

    \74\ Until instructed otherwise, filers may not submit non-
Internet public documents through the electronic filing process. 
Document submitted through that process are automatically placed in 
public FERRIS, and are visible on the Internet.
---------------------------------------------------------------------------

    31. Conversely, the Commission considers the following gas 
information to qualify as CEII because it provides more than just 
location: (1) Diagrams of valve and piping details at compressor 
stations, meter stations, LNG facilities, and pipeline 
interconnections; (2) flow diagrams and other drawings or diagrams 
showing similar details such as volumes and operating pressures like 
those found in Exhibit G; (3) environmental resource reports for LNG 
facilities, and (4) drawings matching labels with specific buildings at 
the site, e.g., central gas control centers or gas control buildings.
    32. Similarly, examples of hydropower location-related information 
that the Commission considers to be CEII include: (1) General design 
drawings of the principal project works (e.g., plan, elevation, 
profile, and section of dam and powerplant), such as those found in 
Exhibit F; (2) maps of projects (including location of project works 
with respect to water bodies, permanent monuments, or other structures 
that can be noted on the map and recognized in the field), such as 
those found in Exhibit G; (3) drawings showing technical details of a 
project, such as plans and specifications, supporting design reports, 
Part 12 independent consultant reports,\75\ facility details, 
electrical transmission systems, and communication and control center 
information; (4) locations of critical or vulnerable components of the 
project; (5) innundation information; and (6) global positioning system 
(GPS) coordinates of any project features (precise surveyed or GPS 
coordinates at or above two decimal points of accuracy of equipment and 
structures).
---------------------------------------------------------------------------

    \75\ See 18 CFR part 12, subpart D.
---------------------------------------------------------------------------

    33. A filing such as a license or certificate application could 
contain a variety of information falling into one or more of the 
following categories: public, non-Internet public information, 
nonpublic CEII, and other nonpublic privileged. In that case, the 
preferred method of filing would be to segregate each type of 
information into separate volumes or appendices, each clearly marked 
with the appropriate heading, and with a cover letter explaining the 
treatment each volume/appendix should receive as follows:

    [sbull] The public volume/appendix should be marked ``Public,'' 
although public is the default treatment for unmarked documents
    [sbull] The non-internet public volume/appendix containing non-
CEII location information should be marked ``Non-Internet Public''
    [sbull] The CEII volume/appendix should be marked ``Contains 
Critical Energy Infrastructure Information--Do Not Release,'' in 
accordance with Sec.  388.112(b), and
    [sbull] Any other nonpublic privileged volumes/appendices should 
be marked ``Contains Privileged Information--Do Not Release.''

Filers should note that any filing containing non-Internet public, CEII 
or other privileged information currently may not be submitted using 
the electronic filing process.
    34. The electric transmission grid differs from dams and pipelines 
in that the Commission does not have regulatory responsibilities over 
the siting or licensing of these facilities. Therefore, the Commission 
is not charged with conducting the NEPA reviews on these facilities. 
For that reason, there is far less need for the public as a whole to 
have unfettered access to location information submitted to the 
Commission regarding the electric grid. Some companies state that 
portions of FERC Form No. 715, Annual Transmission Planning and 
Evaluation Report, should fall outside the definition of CEII because 
it is location information.\76\ The Commission disagrees. Certain 
information in Part 3 of FERC Form No. 715 is not intended primarily to 
identify the location of the facilities, but rather to show the 
interrelationship of facilities. Therefore, the Commission considers 
Part 3 transmission system maps and diagrams used by the utility for 
transmission planning to be CEII.
---------------------------------------------------------------------------

    \76\ E.g., Commonwealth Associates, Inc. at p. 2; Whitfield 
Russell Associates at p. 8.
---------------------------------------------------------------------------

3. Information Regarding Proposed Facilities
    35. In the NOPR, the Commission reversed its earlier position that 
information relating to proposed facilities should not be treated as 
CEII.\77\ As noted in the NOPR, ``[t]he major concern initially about 
withholding information about proposed projects was that people might 
not be able to participate effectively in the National Environmental 
Policy Act (NEPA) process.'' \78\ After the Policy Statement was issued 
in October 2001, the

[[Page 9863]]

Commission treated information that identified location of existing, 
certificated or licensed facilities as CEII. It recognized that it 
would be nearly impossible for people to participate effectively in the 
NEPA process without access to specific information regarding the 
location of the proposed facility, the area it affects, and the 
resources it impacts. For that reason, the Policy Statement 
contemplated the release of CEII regarding proposed facilities, and 
then the protection of the information as CEII once a certificate or 
license was issued.\79\ This resulted in a fairly cumbersome process 
and raised the concern that a patient terrorist could collect CEII-type 
information on proposed projects and then use that information to cause 
harm to the project and the people living and working in its vicinity 
once it was built.
---------------------------------------------------------------------------

    \77\ 67 FR 57994 at p. 58000, FERC Stats. & Regs. ] 32,564 at p. 
34,548.
    \78\ Id.
    \79\ 66 FR 52917 (Oct. 18, 2001), 97 FERC ] 61,030.
---------------------------------------------------------------------------

    36. In the NOPR, recognizing the inconsistency in this approach, 
the Commission revised the Policy Statement to restrict access to 
detailed technical information relating to proposed facilities, while 
at the same time revising the policy to cease protecting location 
information as CEII.\80\ The majority of commenters approve of the 
decision to include proposed facilities,\81\ with only the HRC 
explicitly disagreeing.\82\ As explained in the NOPR, the Commission 
believes that as long as basic location information is not treated as 
CEII, protection of other sensitive information about proposed 
facilities will help protect the infrastructure without interfering 
with the NEPA process.\83\ For example, most NEPA commenters will want 
to know the location of a proposed pipeline and the footprint of 
aboveground facilities, but few will need diagrams of valve and piping 
details, or flow diagrams, or need to know which building will house 
security and which one will house the computer operations center. Those 
who do have such a need may file a request for that information using 
the CEII request procedures in new Sec.  388.113(d) of the Commission's 
regulations.\84\
---------------------------------------------------------------------------

    \80\ 67 FR 57994 at p. 57995, FERC Stats. and Regs. ] 32,564 at 
p. 34,539.
    \81\ E.g., EEI at p. 9; Industrials (Process Gas Consumers 
Group, American Forest & Paper Ass'n, American Iron & Steel 
Institute, Georgia Industrial Group, Florida Industrial Gas Users, 
Industrial Gas Users of Florida, and United States Gypsum Company) 
at p. 4; INGAA at p. 4; National Hydropower Association at p. 5; 
Southern at p. 3; Washington Legal Foundation at p. 2; Williston 
Basin at p. 4.
    \82\ HRC at p. 4.
    \83\ See 67 FR 57994 at p. 58000, FERC Stats. & Regs. ] 32,564 
at p. 34,548.
    \84\ See new 18 CFR 388.113(d).
---------------------------------------------------------------------------

    37. Duke Energy suggests that the Commission clarify that the 
definition of CEII extends to ``component parts of such systems or 
assets or * * * formal proposals to create such systems or assets 
including component parts thereof,'' \85\ voicing concern that the 
requirement that the infrastructure be vital to the nation's health, 
security, and economy ``presupposes that the ``infrastructure'' in 
question is already in place,'' effectively excluding information about 
proposed facilities.\86\ As discussed above, the Commission is changing 
the definition of critical infrastructure in new Sec.  388.113(c)(2) of 
its regulations \87\ to encompass ``existing and proposed systems and 
assets, whether physical or virtual, the incapacity or destruction of 
which would negatively affect security, economic security, public 
health or safety, or any combination of those matters.'' This revised 
definition makes it clear that information regarding proposed 
facilities may be protected as CEII.
---------------------------------------------------------------------------

    \85\ Duke Energy at p. 12.
    \86\ Id. at pp. 10-11.
    \87\ See new 18 CFR 388.113(c)(2).
---------------------------------------------------------------------------

D. Requester's Status and Need for the Information

    38. The NOPR proposed a procedure that would not restrict CEII to 
certain types of applicants, but would take an applicant's identity and 
need into account.\88\ A person seeking access to CEII under proposed 
Sec.  388.113 would be required to submit information about his 
identity and need for the information.\89\ The NOPR emphasized the 
importance of intervenors, landowners and other persons being able to 
participate meaningfully in Commission proceedings.\90\ The Commission 
also expressed its belief that market participants who are not 
participants in proceedings would be able to access necessary 
information, either under proposed Sec.  388.113 or through other 
means, such as the Open Access Same-time Information System 
(OASIS).\91\ The NOPR also proposed to permit owners and operators to 
get information about their own facility without the need to file a 
request under the CEII process, and to require agents of an owner/
operator to obtain information from the owner/operator.\92\ The NOPR 
pointed out that these requirements would have no application to FOIA 
requests.\93\
---------------------------------------------------------------------------

    \88\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at p. 
34,549.
    \89\ Id. at p. 58001, ] 32,564 at p. 34,550.
    \90\ Id. at p. 58001, ] 32,564 at pp. 34,549-50.
    \91\ Id. at p. 58001, ] 32,564 at p. 34,550.
    \92\ Id. at p. 58001, ] 32,564 at pp. 34,549-50.
    \93\ Id. at p. 58001, ] 32,564 p. 34,549.
---------------------------------------------------------------------------

    39. Several commenters express concern over the ability of energy 
market consultants and other participants to obtain data that is 
important to efforts to expand the energy infrastructure and develop 
new energy resources.\94\ Among the concerns is the possibility that 
transmission owners might restrict access to CEII in an unfair manner 
so as to deprive some market participants of the ability to conduct 
needed research.\95\ Some commenters suggest that the Commission adopt 
a method of pre-qualification for market participants who are not 
participants in Commission proceedings or include consultants and other 
market participants in a list of categories of CEII users who would be 
permitted access.\96\
---------------------------------------------------------------------------

    \94\ E.g., BPA Power Administration at p. 5; Pace Global Energy 
Services at p. 3; Reliant Resources, Inc. (Reliant) at pp. 2-4.
    \95\ E.g., Reliant at pp. 4-5.
    \96\ E.g., Pace Global Energy Services at p. 3; GE at p. 4; 
Reliant at pp. 4-5.
---------------------------------------------------------------------------

    40. The procedures proposed in the NOPR were intended to provide 
access to CEII to requesters with legitimate need for the 
information.\97\ Generally speaking, market participants seeking to 
develop new or expanded energy resources would present such a need. 
Certainly, continued development of energy infrastructure is one aspect 
of the nation's defense against attacks upon that infrastructure. The 
Commission prefers to proceed on a case-by-case basis rather than 
creating categories of ``pre-approved'' users, because such an approach 
is better tailored to ensuring that inappropriate users do not gain 
access to CEII. The Commission understands that extensive delays in 
obtaining data could hinder development of energy resources, and has no 
intention of allowing the CEII process to result in any undue delays in 
the processing of facilities applications. In addition, once the CEII 
Coordinator has approved access to CEII on the part of a particular 
requester on a few occasions, subsequent requests by the same requester 
for similar information should, in most cases, require less time to 
process.
---------------------------------------------------------------------------

    \97\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at p. 
34,550.
---------------------------------------------------------------------------

    41. One matter requires clarification. As National Grid USA points 
out,\98\ owner/operators often are corporations that can act only 
through agents. The reference to ``agent or representative'' in Sec.  
388.113(d)(2) of the Commission's

[[Page 9864]]

regulations \99\ is not intended to refer to employees or officials of 
an owner/operator. They would be covered by Sec.  388.113(d)(1) of the 
Commission's regulations.\100\ That subsection has been clarified 
accordingly.
---------------------------------------------------------------------------

    \98\ National Grid USA at p. 9.
    \99\ See 18 CFR 388.113(d)(2).
    \100\ See 18 CFR 388.113(d)(1).
---------------------------------------------------------------------------

E. Verification and Access Issues

1. CEII Coordinator
    42. Most commenters approve of the creation of a CEII Coordinator 
position \101\ with some indicating that the agency was better suited 
to respond to requests than the industry.\102\ However, a few 
commenters believe that owners, operators, and applicants should have 
more of a role in granting access to CEII. For example, the National 
Hydropower Association requests that the Commission amend the 
regulations to permit owners, operators, and applicants to serve as 
CEII Coordinator in some circumstances,\103\ and EEI advocates that 
submitters of information be able to object to intervenor requests for 
CEII.\104\ The Commission believes that the National Hydropower 
Association's suggestion would impermissibly interfere with the 
Commission's administration of the program. EEI's suggestion, however, 
is consistent with the proposed CEII Coordinator process, which is 
adopted here. Accordingly, under Sec.  18 CFR 388.112(d) of the 
Commission's regulations,\105\ submitters are given an opportunity to 
comment on requests for CEII that they submitted.
---------------------------------------------------------------------------

    \101\ E.g., EEI at pp. 10-11; Electric Power Supply Association 
(EPSA) at p. 4; Industrials at pp. 3-4; INGAA at pp. 5 and 7; 
MidAmerican at pp. 3-4; National Hydropower Association at pp. 3-4; 
NERC at p. 3; Washington Legal Foundation at p. 2; Whitfield Russell 
Associates at p. 9.
    \102\ E.g., American Electric Power at p. 1; Industrials at pp. 
3-4; Reliant at p. 5.
    \103\ National Hydropower Association at pp. 3-4.
    \104\ EEI at p. 14.
    \105\ 18 CFR 388.112(d).
---------------------------------------------------------------------------

    43. At least one commenter, Reporters Committee, disagrees with the 
establishment of a CEII Coordinator, voicing concern that the proposed 
process removes access decisions from the hands of experienced access 
professionals and permits the agency to avoid the FOIA time 
limits.\106\ As discussed above in paragraph 18, the CEII Coordinator 
will have access to the same professional staff who evaluate and draft 
recommended decisions on FOIA requests, so that expertise will be 
utilized. Also, the time frames set out in new Sec.  388.113(d)(3)(iii) 
of the Commission's regulations \107\ for the CEII Coordinator to 
process a request are the same as provided by the Commission's 
regulations for processing FOIA requests. To be sure, missing the CEII 
deadlines does not have the same legal implications as missing the FOIA 
deadlines.\108\ Nevertheless, the Commission is committed to processing 
requests for CEII as timely as possible as if it were under the same 
legal obligations as imposed under the FOIA. Also, of course, if a 
requester is concerned about the timing for a CEII response running 
beyond the FOIA statutory time limits, the requester always has the 
option of filing a FOIA request and seeking access under that statute.
---------------------------------------------------------------------------

    \106\ Reporters Committee at p. 4.
    \107\ 18 CFR 388.113(d)(3)(iii).
    \108\ A FOIA requester may treat an agency's failure to respond 
within the statutory time limit as constructive exhaustion of 
administrative remedies, and proceed directly to court without first 
filing an administrative appeal. See 5 U.S.C. Sec.  552(a)(6)(C)(i). 
Normally, a requester must file an administrative appeal prior in 
order to exhaust his or her administrative remedies prior to filing 
in court. See Stebbins v. Nationwide Mutual Ins. Co., 757 F.2d 364, 
366 (D.C. Cir. 1985) (per curiam).
---------------------------------------------------------------------------

    44. Certain commenters request clarification of the authority of 
the Coordinator. Southern believes that the NOPR did not make it clear 
that the CEII Coordinator has the authority to make determinations of 
when information qualifies as CEII. The Commission agrees that the 
proposed version of Sec.  375.313 of its regulations \109\ did not 
specifically delegate this authority to the Coordinator. The final rule 
revises proposed 18 CFR 375.313 to add this delegation, and includes 
language in new Sec.  388.113(d)(3)(ii) of the Commission's regulations 
\110\ to explicitly add this step into the processing of CEII requests.
---------------------------------------------------------------------------

    \109\ 18 CFR 375.313.
    \110\ See new 18 CFR 388.113(d)(3)(ii).
---------------------------------------------------------------------------

    45. Other commenters request that the Commission provide more 
concrete standards or guidance for the Coordinator. For example, 
National Grid USA recommends that the Commission provide ``standards 
that will govern the CEII Coordinator's decision whether to release 
CEII,'' explaining that stated criteria may give requesters insight 
into which requests will be granted and reduce fruitless requests.\111\ 
The National Hydropower Association, the NERC, PJM, and Southern also 
request that the Commission provide criteria for the Coordinator to use 
in determining whether information qualifies as CEII, whether a 
requester has a need for the information, and whether to require a non-
disclosure agreement (NDA) as a condition of release.\112\ The 
Commission believes that the standards the Coordinator should use to 
determine whether information qualifies as CEII are adequately detailed 
in the definition in new Sec.  388.113(c)(1) of its regulations.\113\ 
That is, does the information relate to the production, generation, 
transportation, transmission, or distribution of energy; could it be 
useful to a person in planning an attack on critical infrastructure; is 
it exempt from disclosure under the FOIA; and does it do more than 
provide location information?
---------------------------------------------------------------------------

    \111\ National Grid USA at pp. 6-7.
    \112\ National Hydropower Association at p. 4; NERC at p. 5; PJM 
at p. 1; Southern at pp. 4-6.
    \113\ See new 18 CFR 388.113(c)(1).
---------------------------------------------------------------------------

    46. Commenters also ask that the Commission develop guidelines for 
the Coordinator to use in determining whether to release information to 
a particular requester.\114\ The Commission does not intend to provide 
within the regulation itself a list of the types of requesters who 
would be deemed to have a need for CEII. First of all, that 
determination is fact specific. However, in the preamble to the NOPR 
and this final rule, the Commission has indicated that intervenors, 
market participants, energy market consultants, state agencies, 
landowners, environmental groups, and market participants may be found 
to have a need for information in a particular situation.\115\ It will 
be in the requester's best interest to explain as fully as possible why 
he or she needs the information in question. One factor that the 
Coordinator should factor into a decision is whether the requester's 
need for the information outweighs the potential harm from release of 
the information. For instance, if the Commission developed a 
hierarchical listing of the most critical portions of the 
infrastructure, it would be highly unlikely to release that information 
to most requesters, although it might be released to the FBI or the 
Office of Homeland Security. The final rule has been changed to reflect 
this balancing in new Sec.  388.113(d)(3)(ii) of the Commission's 
regulations.\116\
---------------------------------------------------------------------------

    \114\ E.g., PJM at p. 1; Southern at pp. 4-5.
    \115\ 67 FR 57994 , FERC Stats. & Regs. ] 32,564.
    \116\ See 18 CFR 388.113(d)(3)(ii).
---------------------------------------------------------------------------

2. Use of PINS and Passwords
    47. Some commenters are concerned that adequate security measures 
be taken to protect access to CEII. For instance, certain commenters 
favor the use of a password system to provide Internet access to 
CEII.\117\ GE believes it may be beneficial to maintain records on each 
individual's access to CEII to facilitate investigation of potential 
inappropriate access.\118\ Other

[[Page 9865]]

commenters have concerns about the security issues associated with 
providing Internet access to CEII.\119\ For the time being, the 
Commission does not plan to give requesters access to Commission 
databases containing CEII. If and when that time comes, it is expected 
that identifications and passwords will be used.
---------------------------------------------------------------------------

    \117\ E.g., Duke at p. 17; National Hydropower Association at p. 
8; GE at p. 5; SCE at p. 8.
    \118\ See GE at p. 5.
    \119\ E.g., National Hydropower Association at p. 8; GE at p. 5.
---------------------------------------------------------------------------

3. Verification/Checks on Requesters
    48. In the NOPR, the Commission proposed to require each individual 
requester to obtain access to information instead of granting access on 
an organization-by-organization basis.\120\ Several commenters urge the 
Commission to rethink its decision not to grant requesters generic 
access to nonpublic information. Some note that such generic access 
would reduce burdens on the Commission and requesters.\121\ INGAA, 
among others, believes that access decisions should be made on a case-
by-case basis,\122\ while GE recommends a hybrid approach that would 
allow entities with ``continuous legitimate need for information'' to 
gain generic access, while utilizing a case-by-case system for those 
with more occasional need for the information.\123\ For the time being, 
the Commission is most comfortable granting access on a case-by-case 
basis. As mentioned in the discussion on standards to be used by the 
Coordinator, whether someone has a need for information can vary from 
circumstance to circumstance. The Commission's goal is to limit CEII 
access to those with a need for the information. Even though a 
requester may not be a terrorist, the more people who have access to 
information, the greater likelihood that it may find its way into the 
wrong hands. As also noted above, someone who requests access 
frequently will probably be cleared more quickly than a first-time 
requester, so the burden of multiple requests should not be too great.
---------------------------------------------------------------------------

    \120\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 at 
p. 34,550.
    \121\ E.g., Duke Energy at p. 17; EPSA at p. 4.
    \122\ See INGAA at p. 7; PJM at p. 2.
    \123\ See GE at p. 3.
---------------------------------------------------------------------------

    49. In the NOPR, the Commission concluded that since the majority 
of requesters were expected to be entities and individuals who were 
well known to the Commission, it was not necessary to use the services 
of outsiders to verify the identity and legitimacy of requesters.\124\ 
The Commission is reconsidering that position and is in the process of 
evaluating existing databases that it may use to screen 
requesters.\125\ For that reason, the Commission is revising proposed 
Sec.  388.113(d)(3)(i) to add a requirement that the requester provide 
his or her date and place of birth and to request that each requester 
provide his or her social security number \126\ in addition to the 
other information initially proposed in the NOPR.\127\ This will help 
verify that the name that the individual provides is their true name, 
thus facilitating an accurate screening.
---------------------------------------------------------------------------

    \124\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 at 
p. 34,550.
    \125\ One possibility is to use the Interagency Border 
Inspection Service (IBIS) database, which keeps track of information 
on suspect individuals, businesses, etc., and which may also be used 
to access the FBI's National Crime Information Center containing 
records on wanted persons, criminal histories, etc.
    \126\ Under the section 7(a)(1) of the Privacy Act, 5 U.S.C. 
552a, an agency may not deny a right or benefit provided by law 
because an individual did not provide his or her social security 
numbers. Therefore, a requester has the option of not disclosing his 
or her social security number.
    \127\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at 
p. 34,550.
---------------------------------------------------------------------------

F. State Agency Issues

    50. As indicated in the NOI and the NOPR, there are some unique 
issues with respect to state agency access to CEII.\128\ A primary 
concern is the ability of state agencies, which likely will be subject 
to their own FOIA rules, to protect CEII received from the Commission. 
State Commissions \129\ also raise the following additional issues:
---------------------------------------------------------------------------

    \128\ 67 FR 3129 at pp. 3132-33, FERC Stats. & Regs. ] 35,542 at 
pp. 35,830-33; 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 
at p. 34,551.
    \129\

    Whether and on what basis FERC proposes that its CEII rule will 
preempt state open records laws and rules?
    Whether State Commissions will automatically be permitted to 
obtain all CEII data from FERC or whether State Commission access 
may be limited on a ``need to know'' basis?
    Whether FERC's rule will adequately preclude utilities from 
invoking the FERC rule to avoid providing CEII data to State 
Commissions?
    Whether State Commissions will have requisite access to CEII 
data from utilities not within a State Commission's jurisdiction 
(e.g., for purposes of examining regional transmission or generation 
capability)?
    Whether State Commissions or their staff will be required to 
enter into an NDA, and if so, on what terms? \130\

    \130\ NARUC also raises two miscellaneous issues which go beyond 
the scope of this rule. First, NARUC encourages the Commission to 
clarify how the CEII rule relates to the Commission's Standard 
Market Design (SMD) NOPR, ``Remedying Undue Discrimination Through 
Open Access Transmission Service and Standard Electricity Market 
Design,'' IV FERC Stats. & Regs. ] 32,563 (2002). Without more, and 
given the comprehensive nature of the SMD NOPR, the Commission is 
uncertain as to what NARUC's specific concerns are. The Commission 
believes, however, that there is nothing in this final rule that 
conflicts with the goals of the SMD NOPR. Second, NARUC suggests 
that the Commission set a benchmark for what reasonable costs of 
complying with the CEII rule may be passed through in companies' 
rates. To start with, not every one who complies with this rule will 
necessarily be a jurisdictional company whose rates the Commission 
sets. To the extent jurisdictional companies do incur costs to 
comply with the rule, the Commission believes that the current rules 
and policies for recovery of administrative costs are adequate to 
address the recovery of such compliance costs.
---------------------------------------------------------------------------

    51. As an initial matter, the Commission emphasizes that its goal 
is to cooperate as fully as possible with the State Commissions, which 
share the Commission's objective to ensure that CEII does not get into 
the wrong hands. That said, the Commission grants the National 
Association of Regulatory Commissioners' (NARUC's) requested 
clarification on the Federal preemption issue. NARUC states that the 
Commission has no basis to preempt authority over the totality of 
access to information regarding gas and electric utility regulation, 
and that much of the information at issue is not ``Federal 
information,'' that is, generated by or for the Federal government, but 
instead is generated by non-Federal entities that have provided similar 
or identical information to state regulators.\131\ The Commission 
agrees.
---------------------------------------------------------------------------

    \131\ NARUC at pp. 17-18.
---------------------------------------------------------------------------

    52. The NOPR discussion on preemption related to state agency 
requests to FERC for CEII that the Commission had generated or 
collected.\132\ As NARUC correctly points out, ``the NOPR itself 
declares that FERC's rule does not propose to alter the traditional 
ability of State Commissions to obtain such data directly'' from the 
companies.\133\ Therefore, as requested by NARUC, the Commission 
confirms that it does not intend that public utilities may rely on this 
rule to refuse to provide information directly to State Commissions.
---------------------------------------------------------------------------

    \132\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. [para]32,564 
at p. 34,551.
    \133\ NARUC at p. 18.
---------------------------------------------------------------------------

    53. In addition, State Commissions will be presumed to have a need 
to know information within their state involving issues within their 
responsibilities. They also may submit requests for information 
regarding entities outside of their jurisdictions with an explanation 
of the need. Such requests should be capable of being resolved in a 
timely manner. On the other hand, as discussed below, release of CEII 
to State Commissions and other State Agencies will normally be subject 
to signing an NDA. It does not make sense for the Commission to release 
the

[[Page 9866]]

information to the State Agencies with no agreement to protect the 
information, at least to the extent permitted by law. The Commission 
has no intention of asking a state agency to ignore state law, but 
merely to give the Commission notice and an opportunity to take action 
to prevent release of the information.

G. Timing Issues

    54. The NOPR proposed to provide in Sec.  388.112(d) of the 
Commission's regulations \134\ notice and an opportunity for a CEII 
submitter to comment when a request was received for its information, 
and to provide in Sec.  388.112(e) \135\ notification to the submitter 
prior to release.\136\ Under the proposal, a submitter would have at 
least five days in which to submit its comments, and at least five-days 
notice prior to release of information submitted as CEII.\137\ Several 
commenters claim that these time limits are too short, and advocate 
having at least 10 days to comment, and up to 30 days notice prior to 
release.\138\ At the same time, other commenters are concerned that the 
time frames are too long in some circumstances, for instance, where a 
time for filing a protest or intervention may expire in the 
interim.\139\ At least one, Duke Energy, raises the possibility that 
the Commission could extend other deadlines where someone is delayed in 
getting access to information.\140\
---------------------------------------------------------------------------

    \134\ 18 CFR 388.112(d).
    \135\ 18 CFR 388.112(e).
    \136\ 67 FR 57994 at p. 58003, FERC Stats & Regs. [para]32,564 
at p. 34,552.
    \137\ ID. at pp. 58002-03, [para]32,564 at p. 34,552.
    \138\ E.g., Duke Energy at p. 5 (advocating a ten-day comment 
period); EEI at p. 12 (advocating at least 15 days notice prior to 
release); National Hydropower Association at pp. 7-8, 12 (advocating 
at least ten business days to comment and ten business days notice 
prior to release); NERC at p. 4 (advocating 30 days to respond to 
determination to release CEII to non-governmental requester); 
Southern at p. 10 (advocating 30 days notice prior to release).
    \139\ See, e.g., Industrials at pp. 6-8; Massachusetts Energy 
Facilities Siting Board at p. 5; Transmission Access Policy Study 
Group at pp. 5-6.
    \140\ Duke Energy at p. 17.
---------------------------------------------------------------------------

    55. The Commission has considered these arguments and examined the 
filings that have very short time limits, for instance responses to 
rate filings under Sections 205 of the Federal Power Act,\141\ or 
Section 4 of the Natural Gas Act,\142\ and does not believe anyone will 
be prejudiced by the time frames proposed in the NOPR. It is unlikely 
there will be CEII in most of these filings, and if there is, there 
should still be sufficient information available for parties to make 
the required filings in a timely manner. This same issue could arise 
whenever a company claims confidential treatment for a portion of its 
filing. To date, that has not proved to be an obstacle to meaningful, 
timely participation by other parties, and there is no reason to expect 
that the CEII regulation will cause a problem where none has existed 
previously.
---------------------------------------------------------------------------

    \141\ 16 U.S.C. 824d.
    \142\ 15 U.S.C. 717c.
---------------------------------------------------------------------------

    56. The Commission also has examined the arguments that the 
proposed time limits do not give submitters adequate time to respond. 
First of all, the rule provides minimum times. Where circumstances 
permit, the Coordinator may give submitters a longer amount of time. 
However, the shorter minimum is needed to permit a quick turnaround 
where necessary and to facilitate response within the FOIA time limits. 
Prior to 9/11, the five-day minimums existed in Sec.  388.112 of the 
Commission's regulations for other requests for nonpublic 
treatment.\143\ For years parties have been able to respond within the 
time permitted. The Commission sees no reason to extend these time 
limits for cases involving CEII.
---------------------------------------------------------------------------

    \143\ See 18 CFR 388.112(d) and (e).
---------------------------------------------------------------------------

H. Use of Non-Disclosure Agreements (NDAs)

    57. The NOPR proposed to require most CEII requesters to sign an 
NDA as a condition of gaining access to CEII.\144\ The major exception 
was laid out in proposed 18 CFR 388.113(d)(2), which provided that 
owner/operators would be exempt from the requirement to sign an NDA 
prior to gaining access to CEII regarding their own projects.\145\ The 
reason for this is that they have at least as great an incentive to 
protect this information as the Commission has, and probably have 
access to even more damaging information in the event a rogue employee 
wanted to cause harm to the facility. The Commission adopts here the 
proposed exception for owner/operators, and also retains the 
requirement that agents/representatives (other than employees or 
officers) of owner/operators obtain CEII directly from the owner/
operator, who will be in a better position to judge the agent/
representative's need for the information and to impose restrictions on 
its use.
---------------------------------------------------------------------------

    \144\ 67 FR 57994 at p. 58002, FERC Stats. Regs. ] 32,564 at pp. 
34,551-52.
    \145\ Id.
---------------------------------------------------------------------------

    58. In addition, as explained in the NOPR, NDAs for Federal agency 
CEII requesters will differ from others in part because the Commission 
will remind the requester of his or her responsibilities under the 
Federal Records Act,\146\ and will require that the requesting agency 
refer any subsequent FOIA requests for information provided by the 
Commission back to the Commission for a determination as to whether the 
information is subject to release under the FOIA.\147\ Similarly, NDAs 
for State Agency requesters will specify that the information is 
Federal information that is ``on loan'' to the State Agency and that 
the Commission has the right to request return of the information. The 
Commission will also require that the State Agency notify the 
Commission whenever a request for the information is received.
---------------------------------------------------------------------------

    \146\ 44 U.S.C. Sec.  3510(b).
    \147\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 at 
p. 34,551.
---------------------------------------------------------------------------

    59. Several commenters ask the Commission to elaborate on possible 
penalties for violation of an NDA.\148\ There are two that readily come 
to mind. First, a violation of an NDA could result in the Commission's 
refusing to give similar information to the violator in the future 
under the CEII process. Indeed, the Commission would be violating the 
public's trust if a requester were permitted to violate his or her 
obligations under an NDA with impunity. Second, the Commission could 
rightly bar someone from representing people before the Commission for 
a stated period of time under Sec.  385.2102(a)(2) of the Commission's 
regulations.\149\
---------------------------------------------------------------------------

    \148\ E.g., EEI at p. 15; Duke at pp. 16-17; MidAmerican at p. 
3.
    \149\ See 18 CFR 385.2102(a)(2).
---------------------------------------------------------------------------

I. Submission of CEII to the Commission

    60. In the NOPR, the Commission proposed to make submission of CEII 
a subcategory of submission of documents subject to claims of privilege 
under Sec.  388.112 of its regulations,\150\ with the same number of 
copies and the same requirement for a written statement supporting the 
request for privileged treatment.\151\ As adopted here, CEII 
submissions under that section have to indicate that the information is 
CEII, paralleling the existing requirement for information submitted 
with a request for privileged treatment.\152\ The Commission proposed 
to have the submitter determine how best to segregate CEII and non-
CEII, such as by creating a separate nonpublic appendix or simply 
redacting CEII from the public filing.\153\ The Commission further 
cautioned that it would take disciplinary action against submitters

[[Page 9867]]

who abuse the CEII process by claiming CEII status for extensive 
portions of non-CEII.\154\ Under both the NOPR and the final rule, a 
claim of privilege has the same effect regardless of whether the 
privileged information is CEII or other nonpublic information.\155\ 
Under Sec.  388.112 of the Commission's regulations,\156\ the portions 
for which privileged treatment is sought will be placed in the 
nonpublic file, and will not be released before the submitter has an 
opportunity to comment on its release, and receives notice of the 
impending release.
---------------------------------------------------------------------------

    \150\ 18 CFR 388.112.
    \151\ 67 FR 57994 at p. 58003, FERC Stats. & Regs. ] 32,564 at 
p. 34,552.
    \152\ Id.
    \153\ Id.
    \154\ Id.
    \155\ See id.
    \156\ See new 18 CFR 388.112.
---------------------------------------------------------------------------

    61. Some commenters dislike the practice of creating public and 
nonpublic documents, expressing concern over potential confusion 
between versions. These commenters urge the Commission to redesign its 
forms so that CEII and other nonpublic information are included as a 
separate attachment.\157\ Commonwealth Associates, Inc. (CAI) objects 
to allowing submitters to designate CEII, out of fear that system 
owners/operators will abuse the process by making CEII available to 
their agents, while forcing others to wait for a decision by the CEII 
Coordinator by making sweeping claims of CEII status. CAI suggests that 
the Commission determine CEII status in the first instance. Other 
commenters suggest that the Commission specify penalties for violations 
of the CEII procedures.\158\
---------------------------------------------------------------------------

    \157\ E.g., NERC at p. 3; National Hydropower Association at pp. 
11-12.
    \158\ E.g., EEI at p. 15; MidAmerican at p. 3.
---------------------------------------------------------------------------

    62. The Commission believes, as it did in formulating the NOPR, 
that the process for submitting CEII will work best if it tracks as 
closely as possible the existing procedures for submitting other 
privileged information, procedures that have proven satisfactory over 
time. It consequently is reluctant to depart from those procedures for 
fear of creating confusion and encountering unforeseen problems. The 
suggestion that the CEII Coordinator, rather than the owner of the 
information, designate CEII in the first instance, rather than reduce 
any prejudice from delays, will more likely increase the delays. 
Commission staff would be required to examine every page of a 
submission to make the determination, as opposed to examining only 
those portions that are claimed to constitute CEII.
    63. The concern that some submitters will make unjustified claims 
of CEII status is not one that the Commission takes lightly, as it 
indicated in the NOPR.\159\ The Commission will take action against 
submitters who abuse the system. It does not intend, however, to 
specify the form that action may take, as it will depend on the 
circumstances. Admittedly, the Commission's ability to impose penalties 
is not extensive, but it can disqualify a person from practice before 
the Commission in the event of ``unethical or improper professional 
conduct.''\160\
---------------------------------------------------------------------------

    \159\ 67 FR 57994 at p. 58003, FERC Stats. & Regs. ] 32,564 at 
p. 34,552.
    \160\ 18 CFR 385.2102(a)(2).
---------------------------------------------------------------------------

    64. With respect to the process of separating CEII from non-CEII, 
the Commission agrees with the commenters preferring a separate 
appendix for documents containing protected information rather than two 
entire copies, one public and one nonpublic. Accordingly, the 
Commission will modify Sec.  388.112(b) of its regulations \161\ to 
state a strong preference for an appendix containing protected 
information. The Commission will, however, leave the option of separate 
public and nonpublic versions for situations where the use of an 
appendix would render the document difficult to read. This revision 
will apply to non-CEII protected information as well. As stated above, 
the Commission believes that the procedures for CEII and non-CEII 
protected information should be as similar as possible to avoid 
confusion.
---------------------------------------------------------------------------

    \161\ See new 18 CFR 388.112(b).
---------------------------------------------------------------------------

    65. The suggestion that the Commission redesign its forms to place 
CEII in attachments or appendices is outside the scope of this 
rulemaking. As discussed below, however, the Commission does intend to 
re-examine its forms and reports to determine whether changes are 
needed to provide better protection for CEII. This issue can be 
addressed at that time. For now, the Commission will add a requirement 
to Sec.  388.112 of its regulations \162\ that all submissions for 
which CEII status is claimed be stamped ``Contains CEII--Do Not 
Release'' on every page containing CEII rather than just on the front 
page. A similar provision will be added for other types of protected 
information as well. In addition, the Commission is revising Sec.  
388.112(b)(2) of its regulations \163\ to direct those who file on 
electronic media \164\ to provide a list of the names of each file 
containing CEII or other privileged material, and to mark the outside 
of the media (CD, diskette, tape) itself to indicate CEII or other 
privileged material. Hopefully these additional steps will prevent 
inadvertent disclosure of material.
---------------------------------------------------------------------------

    \162\ See new 18 CFR 388.112.
    \163\ See 18 CFR 388.112(b)(2).
    \164\ At the present time, nonpublic documents are filed on 
electronic media such as CDs, diskettes, and tapes. At some point in 
the future, the Commission will accept nonpublic and non-Internet 
public documents through its electronic filing process. Certain 
filers also use Commission-created submission software (e.g., FERC 
Form No. 2 software) that enables the filer to ``flag'' certain 
fields for nonpublic treatment. The Commission will be examining 
that software and revising it and the associated filing instructions 
to permit filers to flag CEII and non-Internet Public information as 
well.
---------------------------------------------------------------------------

J. Challenges to CEII Status

    66. As with the submission of CEII, the NOPR proposed to handle 
challenges to CEII status through the existing procedures of Sec.  
388.112 of the Commission's regulations.\165\ Under proposed Sec.  
388.112(d), the CEII Coordinator would afford the submitter notice in 
the event of a request for CEII, and give the submitter at least five 
days in which to oppose the request.\166\ Under proposed Sec.  
388.112(e), if the CEII Coordinator denies the claim of privilege, the 
submitter would receive notice of the denial at least five days prior 
to release of the information.\167\
---------------------------------------------------------------------------

    \165\ 67 FR 57994 at pp. 58002-3, FERC Stats. & Regs. ] 32,564 
at p. 34,552.
    \166\ Id. at p. 58003, ] 32,564 at p. 34,552.
    \167\ Id. at pp. 58002-3, ] 32,564 at p. 34,552.
---------------------------------------------------------------------------

    67. Several commenters have concerns about the time frames proposed 
in Sec.  388.112 of the Commission's regulations.\168\ They assert that 
a five-day notice period is insufficient, both for the time in which a 
submitter must respond to a request for CEII and for the notice of a 
proposed release. For the former, commenters favor a 10-day notice 
period.\169\ For the latter, commenters prefer anywhere from a 10 to 
30-day notice period.\170\ The Commission also received suggestions 
that the time run from receipt of notice and that the notice be 
``actual'' rather than constructive, such as in a Federal Register 
notice.\171\ Some commenters also suggest that the Commission provide 
for an automatic stay of a decision to release CEII in the event of a 
request for rehearing, arguing that the time limit for making such a 
request is 30 days and that the information will otherwise be released 
before that time runs.\172\
---------------------------------------------------------------------------

    \168\ See 18 CFR 388.112.
    \169\ E.g., Duke at p. 5; National Hydropower Association at pp. 
7-8, 12.
    \170\ E.g., EEI at p. 12; National Hydropower Association at pp. 
7-8; National Grid USA at p. 10; NERC at p. 4; Southern at p. 10.
    \171\ National Hydropower Association at pp. 7-8, 12.
    \172\ E.g., National Hydropower Association at pp. 7-8, 12; 
National Grid USA at p. 10.
---------------------------------------------------------------------------

    68. The Commission continues to believe that the currently existing 
procedures are adequate. The

[[Page 9868]]

Commission has not encountered a problem with submitters of privileged 
information subject to a FOIA request not being able to respond timely. 
These time frames come into play in situations involving confidential 
business information that is highly sensitive to submitters. If the 
current time frames are adequate in such situations, they should be 
adequate where CEII is requested. It should be noted that the 
Commission does send notice directly to the submitter, usually by 
facsimile as well as by mail and frequently alerts the submitter by 
telephone too, and does not rely on constructive notice.
    69. Moreover, as discussed in the NOPR,\173\ decisions by the CEII 
Coordinator, which will be made pursuant to authority delegated here in 
new Sec.  375.313 of the Commission's regulations,\174\ will be subject 
to requests to the Commission for rehearing.\175\ As is true for all 
orders issued under delegated authority, the time limit for a request 
for rehearing is thirty days.\176\ In addition, the Commission's rules 
specifically provide that a request for rehearing does not stay the 
order being challenged unless the Commission orders otherwise.\177\ The 
Commission has found these procedures to be workable in various 
contexts over the years and believes they will continue to function 
well in connection with requests for CEII.
---------------------------------------------------------------------------

    \173\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at 
p. 34,550.
    \174\ 18 CFR 375.313.
    \175\ 18 CFR 385.1902(a).
    \176\ 18 CFR 385.713(b).
    \177\ 18 CFR 385.713(e).
---------------------------------------------------------------------------

K. Other Issues

    70. In response to the NOPR, several commenters suggested that the 
Commission review the information that it collects to determine if such 
collections are necessary. They reason that if the Commission does not 
have the information, it cannot be subject to disclosure under the 
FOIA. Southern is concerned about this, particularly where the 
information may be available through the Open Access Same-time 
Information System (OASIS).\178\ The Commission agrees with these 
commenters' logic. As noted in the NOPR, the Commission will be 
examining its information collections to see where collections can be 
scaled back or eliminated without compromising fulfillment of its 
statutory responsibilities.\179\ This will most likely be done in 
conjunction with the periodic Office of Management and Budget clearance 
process.
---------------------------------------------------------------------------

    \178\ Southern at p. 11.
    \179\ 67 FR 57994 at p. 58000, n. 41, FERC Stats. & Regs. ] 
32,564 at p. 34,547, n. 41.
---------------------------------------------------------------------------

    71. Commenters also seek Commission action to amend requirements 
that companies make information available where the Commission is 
protecting the same information from disclosure.\180\ Conversely, at 
least one commenter, the Transmission Access Policy Study Group, 
requested that the Commission confirm that it is not eliminating 
requirements that companies make this information available.\181\ The 
Commission intends to eliminate the inconsistent treatment, and will be 
making future modifications to its regulations to effect these changes. 
Until those regulations are changed, the requirements remain in place 
unless a company successfully obtains a waiver from the requirement.
---------------------------------------------------------------------------

    \180\ E.g., INGAA at p. 12; Puget Sound Energy, Inc. at pp. 5-6.
    \181\ Transmission Access Policy Study Group at p. 7.
---------------------------------------------------------------------------

III. Information Collection Statement

    72. The Office of Management and Budget's (OMB's) regulations 
require that OMB approve certain information collection requirements 
imposed by agency rule. \182\ In the NOPR, the Commission estimated the 
annual public reporting burden as follows:
---------------------------------------------------------------------------

    \182\ 5 CFR part 1320 (2002).

----------------------------------------------------------------------------------------------------------------
                                                     Number of       Number of       Hours per     Total annual
                 Data collection                    respondents      responses       response          hours
----------------------------------------------------------------------------------------------------------------
FERC-603........................................             200             200             .25              50
----------------------------------------------------------------------------------------------------------------

    Total Annual Hours for Collection (reporting + record keeping, if 
appropriate) = 50 hours. Information Collection Costs: The NOPR 
estimated the cost to comply with these requirements. It projected the 
average annualized cost of all respondents to be: Annualized Capital 
Startup Costs: The Commission estimated that to respond to this 
information collection will be a one-time cost of $12.50 per 
respondent. (50 hours @ $50 hourly rate / 200).
    73. None of the commenters challenged the estimates provided in the 
NOPR. On October 1, 2002, OMB approved without change, the Commission's 
request for approval of the information collection required by the 
proposed rule, and assigned it OMB No. 1902-0197. The only information 
collection changes from the NOPR to the final rule are the added 
requirement in new Sec.  388.113(d)(3)(i) of the Commission's 
regulations \183\ that requesters provide their date and place of birth 
and the request that they provide their social security number. OMB 
regulations provide an exemption where a person is required to provide 
only facts that are necessary for identification.\184\ The requirement 
that a requester provide his or her date and place of birth and the 
request that a requester provide his or her social security number are 
intended to verify the identity of the requester. For that reason, this 
collection need not be resubmitted to OMB for approval.
---------------------------------------------------------------------------

    \183\ See new 18 CFR 388.113(d)(3)(i).
    \184\ 5 CFR 1320.3(h)(1).
---------------------------------------------------------------------------

IV. Environmental Analysis

    74. The Commission is required to prepare an Environmental 
Assessment or an Environmental Impact Statement for any action that may 
have a significant adverse effect on the human environment.\185\ 
Included in the exclusions are rules that are clarifying, corrective, 
or procedural or that do not substantively change the effect of the 
regulations being amended.\186\ This rule is procedural in nature and 
therefore falls under this exception; consequently, no environmental 
consideration is necessary.
---------------------------------------------------------------------------

    \185\ Order No. 486, Regulations Implementing the National 
Environmental Policy Act, 52 FR 47897 (Dec. 17, 1987), FERC Stats. & 
Regs. Preambles 1986-1990 ] 30,783 (1987).
    \186\ 18 CFR 380.4(a)(2)(ii).
---------------------------------------------------------------------------

V. Regulatory Flexibility Act Certification

    75. The Regulatory Flexibility Act of 1980 (RFA) \187\ generally 
requires a description and analysis of final rules that will have 
significant economic impact on a substantial number of small entities. 
The Commission is not required to make such analyses if a rule would 
not have such an effect. The Commission certifies that this rule does 
not have such an impact on small entities.
---------------------------------------------------------------------------

    \187\ 5 U.S.C. 601-612.

---------------------------------------------------------------------------

[[Page 9869]]

VI. Document Availability

    76. In addition to publishing the full text of this document in the 
Federal Register, the Commission provides all interested persons an 
opportunity to view and/or print the contents of this document via the 
Internet through FERC's Home Page (http://www.ferc.gov) and in FERC's 

Internet through FERC's Home Page (http://www.ferc.gov) and in FERC's 

Public Reference Room during normal business hours (8:30 a.m. to 5 p.m. 
eastern time) at 888 First Street, NE., Room 2A, Washington, DC 20426.
    77. From FERC's Home Page on the Internet, this information is 
available in the Federal Energy Regulatory Records Information System 
(FERRIS). The full text of this document is available on FERRIS in PDF 
and WordPerfect format for viewing, printing, and/or downloading. To 
access this document in FERRIS, type the docket number of this document 
excluding the last three digits in the docket number field.
    78. User assistance is available for FERRIS and the FERC's website 
during normal business hours from FERC Online Support (by phone at 1-
866-208-3673 (toll-free) or 202-502-6652, or by e-mail at 
FERCOnlineSupport@ferc.gov) or the Public Reference Room at (202) 502-

8371 Press 0, TTY (202) 502-8659. E-Mail the Public Reference Room at 
public.referenceroom@ferc.gov.

VII. Effective Date

    79. These regulations are effective April 2, 2003.
    80. The provisions of 5 U.S.C. 801 regarding Congressional review 
of final rules does not apply to this final rule, because the rule 
concerns agency procedure and practice and will not substantially 
affect the rights of non-agency parties.

List of Subjects in 18 CFR Parts 375 and 388

18 CFR Part 375

    Authority delegations (Government agencies), Seals and insignia, 
Sunshine Act.

18 CFR Part 388

    Confidential business information, Freedom of information.
    By the Commission.

Magalie R. Salas,
Secretary.

    In consideration of the foregoing, the Commission amends parts 375 
and 388, chapter I, title 18, Code of Federal Regulations, as follows.

PART 375--THE COMMISSION

    1. The authority citation for part 375 continues to read as 
follows:

    Authority: 5 U.S.C. 551-557; 15 U.S.C. 717-717w, 3301-3432; 16 
U.S.C. 791-825r, 2601-2645, 42 U.S.C. 7101-7352.


    2. Add Sec.  375.313 to subpart C to read as follows:


Sec.  375.313  Delegations to the Critical Energy Infrastructure 
Information Coordinator.

    The Commission authorizes the Coordinator or the Coordinator's 
designee to:
    (a) Receive and review all requests for critical energy 
infrastructure information as defined in Sec.  388.113(c)(1).
    (b) Make determinations as to whether particular information fits 
within the definition of CEII found at Sec.  388.113(c)(1).
    (c) Make determinations as to whether a particular requester's need 
for and ability and willingness to protect critical energy 
infrastructure information warrants limited disclosure of the 
information to the requester.
    (d) Establish reasonable conditions on the release of critical 
energy infrastructure information.
    (e) Release critical energy infrastructure information to 
requesters who satisfy the requirements in paragraph (b) of this 
section and agree in writing to abide by any conditions set forth by 
the Coordinator pursuant to paragraph (c) of this section.

PART 388--INFORMATION AND REQUESTS

    3. The authority citation for part 388 continues to read as 
follows:

    Authority: 5 U.S.C. 301-305, 551, 552 (as amended), 553-557; 42 
U.S.C. 7101-7352.


    4. Section 388.112 is revised to read as follows:


Sec.  388.112  Requests for privileged treatment of documents submitted 
to the Commission.

    (a) Scope. (1) Any person submitting a document to the Commission 
may request privileged treatment by claiming that some or all of the 
information contained in a particular document is exempt from the 
mandatory public disclosure requirements of the Freedom of Information 
Act, 5 U.S.C. 552, and should be withheld from public disclosure.
    (2) Any person submitting documents containing critical energy 
infrastructure information (CEII) as defined in Sec.  388.113 should 
follow the procedures specified in this section.
    (b) Procedures. A person claiming that information is privileged 
under paragraph (a) of this section must file:
    (1) For documents submitted in hard copy,
    (i) A written statement requesting privileged treatment for some or 
all of the information in a document, and the justification for 
nondisclosure of the information;
    (ii) One of the following:
    (A) In all cases where the privileged information or CEII can, as a 
practical matter, be segregated into a separate document or appendix:
    (1) Fourteen copies of the original document, indicating in bold 
print on the front page either ``Privileged Information Contained in 
Attachment'' or ``Critical Energy Infrastructure Information Contained 
in Attachment,'' and
    (2) One separate document or appendix, indicating in bold print on 
the front page either ``Contains Privileged Information--Do Not 
Release'' or ``Contains Critical Energy Infrastructure Information--Do 
Not Release,'' with every page in the document or appendix marked 
either ``Privileged Information--Do Not Release'' or ``Critical Energy 
Infrastructure Information--Do Not Release,'' or
    (B) In cases where the privileged information or CEII cannot 
reasonably or coherently be separated into a separate document or 
appendix:
    (1) The original document, indicating in bold print on the front 
page either ``Contains Privileged Information--Do Not Release,'' or 
``Contains Critical Energy Infrastructure Information--Do Not Release'' 
and, on every page containing privileged information or CEII, the 
marking ``Privileged Information--Do Not Release,'' or ``Critical 
Energy Infrastructure Information--Do Not Release,'' with the 
privileged information or CEII clearly identified, and
    (2) Fourteen copies of the document without the information for 
which privileged treatment is sought, and with a statement indicating 
that information has been removed for privileged treatment, and
    (iii) The name, title, address telephone number, e-mail address, 
and facsimile number of the person or persons to be contacted regarding 
the request for privileged treatment of documents submitted to the 
Commission.
    (2) For documents submitted on electronic media,
    (i) A written statement requesting privileged treatment for some or 
all of the information on the electronic media,

[[Page 9870]]

and the justification for non-disclosure of the information;
    (ii) One of the following:
    (A) In all cases where the privileged information or CEII can, as a 
practical matter, be segregated into a separate document or appendix:
    (1) One copy of the electronic media and fourteen paper copies of a 
filing all without the privileged information or CEII, and all marked 
either ``Privileged Information Contained in Separate Attachment'' or 
``Critical Energy Infrastructure Information Contained in Separate 
Attachment,'' and
    (2) One copy of the electronic media and one paper copy of a 
separate document or appendix, in both cases marked on media itself and 
on the front page either ``Contains Privileged Information--Do Not 
Release'' or ``Contains Critical Energy Infrastructure Information--Do 
Not Release,'' with every page in the document or appendix marked 
either ``Privileged Information--Do Not Release'' or ``Critical Energy 
Infrastructure Information--Do Not Release,'' and
    (3) An index identifying each file on the media and whether it is 
public, contains Critical Energy Infrastructure Information, or 
contains other privileged information; or
    (B) In cases where the privileged information or CEII cannot 
reasonably or coherently be separated into a separate document or 
appendix:
    (1) One copy of a complete filing on the electronic media and a 
paper copy, both marked on the media itself and on the front page 
either ``Contains Privileged Information--Do Not Release''or ``Contains 
Critical Energy Infrastructure Information--Do Not Release,'' with 
every page containing privileged information or CEII marked either 
``Privileged Information--Do Not Release'' or ``Critical Energy 
Infrastructure Information--Do Not Release'' and with the privileged 
information or CEII clearly and specifically identified, and
    (2) One copy of the electronic media without the information for 
which privileged treatment is sought and with a statement that 
information has been removed for privileged treatment, together with 
fourteen paper copies without the information for which privileged 
treatment is sought,
    (3) An index identifying each file on the media and whether it is 
public, contains Critical Energy Infrastructure Information, or 
contains other privileged information, and
    (iii) The name, title, address, telephone number, e-mail address, 
and facsimile number of the person or persons to be contacted regarding 
the request for privileged treatment of documents submitted to the 
Commission.
    (c) Effect of privilege claim--(1)For documents filed with the 
Commission. (i) The Secretary of the Commission will place documents 
for which privileged treatment is sought in accordance with paragraph 
(b)(1)(ii) of this section in a nonpublic file, while the request for 
privileged treatment is pending. By placing documents in a nonpublic 
file, the Commission is not making a determination on any claim for 
privilege. The Commission retains the right to make determinations with 
regard to any claim of privilege, and the discretion to release 
information as necessary to carry out its jurisdictional 
responsibilities.
    (ii) The Secretary of the Commission will place the request for 
privileged treatment described in paragraph (b) of this section and a 
copy of the original document with the privileged information removed 
in a public file while the request for privileged treatment is pending.
    (2) For documents submitted to Commission staff. The notification 
procedures of paragraphs (d), (e), and (f) of this section will be 
followed by staff before making a document public.
    (d) Notification of request and opportunity to comment. When a FOIA 
or CEII requester seeks a document for which privilege is claimed, or 
when the Commission itself is considering release of the information, 
the Commission official who will decide whether to make the document 
public will notify the person who submitted the document and give the 
person an opportunity (at least five days) in which to comment in 
writing on the request. A copy of this notice will be sent to the 
requester.
    (e) Notification before release. Notice of a decision by the 
Commission, the Chairman of the Commission, the Director, Office of 
External Affairs, the General Counsel or General Counsel's designee, a 
presiding officer in a proceeding under part 385 of this chapter, or 
any other appropriate official to deny a claim of privilege, in whole 
or in part, will be given to any person claiming that information is 
privileged no less than five days before public disclosure. The notice 
will briefly explain why the person's objections to disclosure are not 
sustained by the Commission. A copy of this notice will be sent to the 
FOIA or CEII requester.
    (f) Notification of suit in Federal courts. When a FOIA requester 
brings suit to compel disclosure of information for which a person has 
claimed privileged treatment, the Commission will notify the person who 
submitted the documents of the suit.

    5. Add Sec.  388.113 to read as follows:


Sec.  388.113. Accessing  critical energy infrastructure information.

    (a) Scope. This section governs access to critical energy 
infrastructure information (CEII). The rules governing submission of 
CEII are contained in 18 CFR 388.112(b). The Commission reserves the 
right to restrict access to previously filed documents as well as 
Commission-generated documents containing CEII.
    (b) Purpose. The procedures in this section are available at the 
requester's option as an alternative to the FOIA procedures in Sec.  
388.108 where the information requested is exempted from disclosure 
under the FOIA and contains CEII.
    (c) Definitions. For purposes of this section:
    (1) Critical energy infrastructure information means information 
about proposed or existing critical infrastructure that:
    (i) Relates to the production, generation, transportation, 
transmission, or distribution of energy;
    (ii) Could be useful to a person in planning an attack on critical 
infrastructure;
    (iii) Is exempt from mandatory disclosure under the Freedom of 
Information Act, 5 U.S.C. 552; and
    (iv) Does not simply give the location of the critical 
infrastructure.
    (2) Critical infrastructure means existing and proposed systems and 
assets, whether physical or virtual, the incapacity or destruction of 
which would negatively affect security, economic security, public 
health or safety, or any combination of those matters.
    (d) Optional procedures for requesting critical energy 
infrastructure information.
    (1) An owner/operator of a facility, including employees and 
officers of the owner/operator, may obtain CEII relating to its own 
facility directly from Commission staff without going through the 
procedures outlined in paragraph (d)(3) of this section.
    (2) An agent or representative of an owner/operator must obtain 
information from the owner/operator.
    (3) If any other requester has a particular need for information 
designated as CEII, the requester may request the information using the 
following procedures:
    (i) File a written request with the Commission's CEII Coordinator. 
The request shall contain the following: Requester's name, date and 
place of

[[Page 9871]]

birth, title, address, and telephone number; the name, address, and 
telephone number of the person or entity on whose behalf the 
information is requested; a detailed statement explaining the 
particular need for and intended use of the information; and a 
statement as to the requester's willingness to adhere to limitations on 
the use and disclosure of the information requested. Requesters are 
also requested to include their social security number for 
identification purposes.
    (ii) Once the request is received, the CEII Coordinator will 
determine if the information is CEII, and, if it is, whether to release 
the CEII to the requester. The CEII Coordinator will balance the 
requester's need for the information against the sensitivity of the 
information. If the requester is determined to be eligible to receive 
the information requested, the CEII Coordinator will determine what 
conditions, if any, to place on release of the information. Where 
appropriate, the CEII Coordinator will forward a non-disclosure 
agreement (NDA) to the requester for execution. Once the requester 
signs any required NDA, the CEII Coordinator will make the critical 
energy infrastructure information available to the requester. The CEII 
Coordinator's decisions regarding release of CEII are subject to 
rehearing as provided in Sec.  385.713 of this chapter.
    (iii) The CEII Coordinator will attempt to respond to the requester 
under this section according to the timing required for responses under 
the Freedom of Information Act in Sec.  388.108(c), and will provide 
notice to the submitter in accordance with Sec.  388.112(d) and (e).

Appendix A

List of Commenters

Adirondack Mountain Club
American Electric Power System
American Gas Association
American Library Association
Bonneville Power Administration (BPA)
Commonwealth Associates, Inc.
City Public Service of San Antonio
Duke Energy Corporation (Duke)
Edison Electric Institute (EEI), including the EEI Alliance of 
Energy Suppliers, and EEI Transmission Group
Electric Power Supply Association (EPSA)
Exelon Generation Corporation on behalf of its public utility 
subsidiaries PECO Energy Company and Commonwealth Edison Company
Federation of American Scientists
Hydropower Reform Coalition (HRC)
The Industrials: Process Gas Consumers Group, American Forest & 
Paper Ass'n, American Iron & Steel Institute, Georgia Industrial 
Group, Florida Industrial Gas Users, Industrial Gas Users of 
Florida, and United States Gypsum Company
Interstate Natural Gas Association of America (INGAA)
Massachusetts Energy Facilities Siting Board
MidAmerican Energy Company (MidAmerican)
National Association of Regulatory Utility Commissioners (NARUC)
National Grid USA
National Hydropower Association
New York State Public Service Commission
North American Electric Reliability Council (NERC)
Northwest Natural Gas Company (Northwest Natural)
Oklahoma Corporation Commission
Oklahoma Gas and Electric Company
Lydia Olchoff
OMB Watch
Pace Global Energy Services
Pacific Gas & Electric Company (PG&E)
PJM Interconnection, L.L.C. (PJM)
GE Power Systems Energy Consulting (GE)
Puget Sound Energy, Inc.
Reliant Resources, Inc. (Reliant)
Reporters Committee for Freedom of the Press and The Society of 
Environmental Journalists (Reporters Committee)
Southern California Edison Company (SCE)
Society of Professional Journalists
Southern Company Services, Inc., acting for itself and as agent for 
Alabama Power Company, Georgia Power Company, Gulf Power Company, 
Mississippi Power Company, Savannah Electric and Power Company, and 
Southern Power Company (Southern)
Public Utilities Commission of Ohio, the Michigan Public Service 
Commission and the staff of the Oklahoma Corporation Commission 
(States)
Transmission Access Policy Study Group
Washington Legal Foundation and Public Interest Clinic, George Mason 
University School of Law (Washington Legal Foundation)
Williston Basin Interstate Pipeline Company (Williston Basin)
Whitfield Russell Associates

Appendix B

Applicability of Freedom of Information Act Exemptions to Critical 
Energy Infrastructure Information

    The Commission's actions in the NOPR and the final rule are 
based on its position that CEII includes only information that is 
exempt from disclosure under FOIA. The exemptions most likely to 
apply to CEII are Exemptions 2, 4, and 7. A discussion of the 
potential applicability of each follows.

a. Exemption 2

    Exemption 2 exempts from disclosure ``records related solely to 
the internal personnel rules and practices of an agency.'' \1\ 
According to guidance from the Department of Justice (DOJ), ``[a]ny 
agency assessment of, or statement regarding, the vulnerability of 
such a critical asset should be protected pursuant to Exemption 2.'' 
\2\ DOJ has counseled agencies that ``a wide range of information 
can be withheld under Exemption 2's 'circumvention' aspect.'' \3\ 
DOJ also has instructed agencies to take full advantage of the 
breadth of Exemption 2's protection for critical infrastructure 
information.\4\
---------------------------------------------------------------------------

    \1\ 5 U.S.C. 552(b)(2).
    \2\ DOJ 2001 FOIA Post 19, posted October 15, 2001. DOJ is the 
Federal agency responsible for the administration of the FOIA.
    \3\ Id.
    \4\ Id.
---------------------------------------------------------------------------

    The Commission has concluded that a portion of the CEII is 
exempt from disclosure under Exemption 2 of FOIA. Illustratively, 
the Commission is expanding its efforts to help facility owners and 
operators assess security risks and protect facilities from 
attack.\5\ Information developed or created by the Commission as 
part of these efforts is likely to fall within the ambit of 
Exemption 2. Documents describing inspections of regulated 
facilities likewise will fall within Exemption 2 if they assess or 
describe vulnerabilities of the project.
---------------------------------------------------------------------------

    \5\ The Commission has jurisdiction over the safety of 
hydroelectric projects under sections 4(e), 10(a), and 10(c) of the 
Federal Power Act, 16 U.S.C. 797(e), 803(a), (c).
---------------------------------------------------------------------------

b. Exemption 4

    Exemption 4 protects from public disclosure ``trade secrets and 
commercial or financial information obtained from a person and 
privileged or confidential.'' \6\ The Commission has determined that 
much of the CEII falls within the scope of Exemption 4, on the basis 
that release of the information could cause competitive harm to 
submitters, impair the Commission's ability to obtain similar 
information in the future, or impair the effectiveness of the 
Commission's programs.
---------------------------------------------------------------------------

    \6\ 5 U.S.C. 552(b)(4).
---------------------------------------------------------------------------

    There are two primary issues regarding the application of 
Exemption 4 to CEII. First, whether the fact that this sort of 
information had been publicly available in the past undermines an 
argument that it is now confidential, and second, whether the Trade 
Secrets Act \7\ prohibits the Commission from sharing this 
information on a ``need-to-know'' basis.
---------------------------------------------------------------------------

    \7\ 18 U.S.C. 1905.
---------------------------------------------------------------------------

    The Commission concludes that the fact that this information has 
been previously public does not defeat Exemption 4. Americans live 
in a different world today than they did prior to September 11, 
2001. Americans have had to face the harsh realities of terrorism on 
their soil. This has forced the nation to reassess its vulnerability 
to terrorist threats. Government agencies as well as private 
companies have had to reconsider the extent to which they make 
information freely available to others.
    Specifically, under National Parks & Conservation Assoc. v. 
Morton, 49 F.2d 765 (DC Cir. 1974) (National Parks) and Critical 
Mass Energy Project v. NRC, 975 F.2d 871 (DC Cir. 1992) (Critical 
Mass), the initial inquiry in Exemption 4 cases is whether the 
information was submitted to the government voluntarily or whether 
it was compelled to be submitted. For voluntary submissions, the 
information is entitled to protection if it ``would customarily not 
be released to the public by the person from whom it was

[[Page 9872]]

obtained.'' \8\ This test focuses on the submitter's current 
treatment of the information, not past treatment. Therefore, if, in 
the post-September 11 world, the company would not release the 
information to the public, the Commission should not release the 
information.
---------------------------------------------------------------------------

    \8\ Critical Mass, 975 F.2d at 878.
---------------------------------------------------------------------------

    For compelled submissions, there is a three-pronged test--the 
competitive harm prong, the impairment prong, and the program 
effectiveness prong. If any of the three tests is met, the 
information is exempt from mandatory disclosure under FOIA even 
though it may have been previously public.\9\ Under the competitive 
harm prong, there must be evidence of actual competition, and a 
likelihood of substantial competitive injury.\10\ This inquiry tends 
to be fact specific, so it is not possible to identify with 
certainty which categories of CEII would meet the test. However, as 
utilities transition from monopolies to competitive markets, it may 
be easier for them to demonstrate actual competition. The inquiry is 
whether the submitter is facing competition at the time the 
Commission received the request for the information, not whether 
there was competition when the information was first submitted to 
the Commission. If the competitive situation has changed, the 
likelihood of competitive harm would be analyzed using the current 
situation, not past conditions. Where competition is found to exist, 
the next issue is whether release of the information is likely to 
result in substantial competitive injury to the submitter. Again, 
the likelihood of competitive injury would be examined at the time 
the Commission received the request for the information. Whether the 
information could have harmed the submitter two years earlier is 
irrelevant; what is relevant is whether release of the information 
at the time of the request would cause competitive harm to the 
submitter.\11\
---------------------------------------------------------------------------

    \9\ While most of the submissions to a regulatory agency like 
FERC may appear to be compelled, this may not necessarily be the 
case. DOJ has recognized that the ``existence of agency authority to 
require submission of information does not automatically mean such a 
submission is `required'; the agency authority must actually be 
exercised in order for a particular submission to be deemed 
`required.' '' DOJ Freedom of Information Act Guide & Privacy Act 
Overview, May 2002 ed., at 202. Courts have found submissions to be 
voluntary where the agency had issued a subpoena but not sought to 
enforce it, see McDonnell Douglas Corp. v. EEOC, 922 F. Supp. 235 
(E.D. Mo. 1996), and where the agency did not have authority to 
enforce the information collection because the information request 
violated the Paperwork Reduction Act, 44 U.S.C. 3501, see Center for 
Auto Safety v. NHTSA, 244 F.3d 144 (D.C. Cir. 2001). At bottom, the 
question of whether the information has been submitted voluntarily 
or was compelled must be analyzed on a case-by-case basis.
    \10\ See CNA Fin. Corp. v. Donovan, 830 F.2d 1132 (D.C. Cir. 
1987) (CNA).
    \11\ The Commission's analysis of a submitter's competitive 
situation under FOIA is not the same as, and indeed is less rigid 
than, the analysis it must perform to establish lack of market power 
for charging market based rates. For FOIA purposes, the competition 
requirement is satisfied if the submitter faces some level of actual 
competition. See Niagara Mohawk Power Corp. v. DOE, 169 F.3d 16, 19 
(D.D.C. 1999) (Niagara).
---------------------------------------------------------------------------

    The test most frequently applied under the competitive harm 
prong is whether use of the information by competitors is likely to 
harm the submitter.\12\ This may be fairly challenging to 
demonstrate in the case of CEII because the primary concern is that 
the information could be used to plan an attack on the 
infrastructure, not that it could be used to steal customers or 
undercut prices. On the other hand, a submitter may be able to show 
competitive harm where use of the information by someone other than 
a competitor could cause financial harm to the submitter.\13\ As 
relevant here, a terrorist attack on the energy infrastructure could 
cause financial harm to the owners and operators of the facilities 
because of lost opportunity costs as well as repair costs.
---------------------------------------------------------------------------

    \12\ See, e.g., CNA, 830 F.2d at 1152 & n.158; Public Citizen 
Health Research Group v. FDA, 704 F.2d 1280, 1291 (D.C. Cir. 1983).
    \13\ See Nadler v. FDIC, 899 F. Supp. 158, 163 (S.D.N.Y. 1995) 
(Nadler), aff'd, 92 F.3d 93 (2d Cir. 1996).
---------------------------------------------------------------------------

    For compelled submissions, the impairment prong is satisfied 
where disclosure may affect the reliability or quality of the 
information received.\14\ The more subjective the filing 
requirement, the more likely that disclosure of the information 
could impair the Commission's ability to get thorough and accurate 
information in the future.\15\ As noted by EEI in its comments on 
the NOI, regulated entities may have discretion regarding how to 
construct their filings.\16\ If companies are worried that 
information they submit will be subject to public disclosure, they 
may choose not to submit the same level of detail that they might 
otherwise submit. In such circumstances, and assuming the 
submissions would otherwise comply with the Commission's 
regulations, the information may be exempt from disclosure under the 
impairment prong of Exemption 4.
---------------------------------------------------------------------------

    \14\ Id.
    \15\ See Niagara Mohawk, 169 F.3d at 18 (holding that impairment 
is unlikely to be found where ``data sought appears to take the form 
of hard, cold numbers on energy use and production, the fudging of 
which may strain all but the deliberately mendacious.'').
    \16\ EEI NOI comments at p. 42.
---------------------------------------------------------------------------

    Critical Mass recognized that in addition to the competitive 
harm and impairment prongs, there may be other instances where non-
disclosure is warranted in order to protect other governmental 
interests, such as program effectiveness.\17\ Recently, in Public 
Citizen Health Research Group v. NIH,\18\ the district court relied 
on Critical Mass in determining that ``impairment of the 
effectiveness of a government program is a proper factor for 
consideration in conducting an analysis under'' Exemption 4. The 
court held that the National Institutes of Health's royalty 
information was protected under Exemption 4 because release of the 
information would make companies reluctant to enter into agreements 
with NIH, thus impairing the effectiveness of NIH's licensing 
program.\19\ The court reached a similar conclusion in Judicial 
Watch, Inc. v. Export-Import Bank, where release of certain 
financial information from foreign export credit agencies was held 
to be exempt from disclosure because release would make the credit 
agencies look for financing outside of the United States, 
undermining the agency's statutory purpose of fostering domestic 
economic growth by supporting export transactions.\20\
---------------------------------------------------------------------------

    \17\ See Critical Mass, 975 F.2d 879 (``It should be evident 
from this review that the two interests identified in that National 
Parks test are not exclusive.'').
    \18\ 209 F. Supp. 2d 37 at 52 (D.D.C. Mar. 12, 2002) 
(alternative holding).
    \19\ Id. at 54.
    \20\ 108 F. Supp. 2d 19, 30 (D.D.C. 2000).
---------------------------------------------------------------------------

    Applying these recent decisions here, indiscriminate release of 
CEII could impair the effectiveness of the Commission's programs, 
which are meant to satisfy its mandate to regulate and oversee 
energy industries in the economic and environmental interest of the 
American public.\21\ Inappropriate release of CEII could make the 
infrastructure more vulnerable to attack, threatening those 
industries and resulting in potentially devastating economic and 
environmental consequences. Release of CEII also could make 
regulated entities less forthcoming in the information they provide 
to the Commission, especially where they have discretion as to what 
they submit.\22\ Restricted flow of information between the 
Commission and the companies could impair the Commission's programs 
that rely on such information. This is of particular concern in 
today's world, where the Commission is seeking additional 
information from licensees to assure that the infrastructure is 
sited and built safely and remains protected. Finally, release of 
CEII could harm the relationship between Commission staff and the 
regulated companies, impairing trust, and causing the parties to 
deal with each other in a more adversarial manner than necessary. 
For all of these reasons, much, if not all of the CEII would be 
exempt from disclosure under the third prong of Exemption 4 as it 
relates to compelled submissions.
---------------------------------------------------------------------------

    \21\ See http://www.ferc.gov/About/mission/mission_intro.htm 

    \21\ See http://www.ferc.gov/About/mission/mission_intro.htm 

(2002).
    \22\ See Nadler, 899 F. Supp. 158, 162.
---------------------------------------------------------------------------

    A second issue is whether the Trade Secrets Act prohibits the 
Commission from sharing Exemption 4 material on an as-needed basis. 
The Trade Secrets Act states in relevant part that:
    Whoever, being an officer or employee of the United States or of 
any department or agency thereof, publishes, divulges, discloses or 
makes known in any manner or to any extent not authorized by law any 
information coming to him in the course of his employment or 
official duties or by reason of any examination or investigation 
made by, or return, report or record made to or filed with, such 
department or agency or officer or employee thereof, which concerns 
or relates to trade secrets, processes, operations, style of work, 
or apparatus, or to the identify, confidential statistical data, 
amount or source of any income, profits, losses or expenditures of 
any person, firm, partnership, corporation, or association; * * * to 
be seen or examined by any person except as provided by law; shall 
be fined not more than $1,000, or imprisoned not more than one year, 
or both;

[[Page 9873]]

and shall be removed from office or employment.\23\
---------------------------------------------------------------------------

    \23\ 18 U.S.C. 1905.
---------------------------------------------------------------------------

See Chrysler Corp. v. Brown, 441 U.S. 281, 301(1979) (Chrysler). The 
Trade Secrets Act applies to formal agency actions as well as 
actions by the agency's individual employees. Courts have found that 
the coverage of the Trade Secrets Act and Exemption 4 are co-
extensive,\24\ meaning that the Trade Secrets Act generally 
prohibits release of information covered by Exemption 4.\25\ 
However, the Trade Secrets Act permits disclosure of trade secret 
information where ``authorized by law.'' \26\ Accordingly, under the 
Trade Secrets Act, protected information may be released where there 
is statutory or regulatory authority for the agency to release it. 
In cases where the authorization for release is found in an agency 
regulation, the inquiry is whether the regulation permitting the 
release is authorized by law.\27\
---------------------------------------------------------------------------

    \24\ See, e.g., Bartholdi Cable Co. v. FCC, 114 F.3d 274 (D.C. 
Cir. 1997); CNA, 830 F.2d at 1152.
    \25\ CNA, 830 F.2d at 1151.
    \26\ Chrysler, 441 U.S. at 301.
    \27\ Id.
---------------------------------------------------------------------------

    The Commission has statutory authority to release trade secret 
information. While both the Federal Power and Natural Gas Acts place 
restrictions on an individual employee's release of information 
gathered in the course of examining records of a company, they 
permit the Commission itself to authorize such a release. The 
Federal Power Act provides:
    The Commission shall at all times have access to and the right 
to inspect and examine all accounts, records, and memoranda of 
licensees and public utilities, and it shall be the duty of such 
licensees and public utilities to furnish to the Commission, within 
such reasonable time as the Commission may order, any information 
with respect thereto which the Commission may by order require, 
including copies of maps, contracts, reports of engineers, and other 
data, records, and papers, and to grant to all agents of the 
Commission free access to its property and its accounts, records and 
memorandum when requested so to do. No member, officer, or employee 
of the Commission shall divulge any fact or information which may 
come to his knowledge during the course of examination of books or 
other accounts, as hereinbefore provided, except insofar as he may 
be directed by the Commission or by a court.\28\
---------------------------------------------------------------------------

    \28\ 16 U.S.C. 825(b); see also 15 U.S.C. 717g(b) (Natural Gas 
Act) and 18 CFR 3c.2(a).
---------------------------------------------------------------------------

    In addition, sections 4 and 312 of the Federal Power Act 
authorize the Commission ``[t]o make public from time to time the 
information secured hereunder and to provide for the publication of 
its reports and investigations in such form and manner as may be 
best adapted for public information and use.'' \29\ Section 14 of 
the Natural Gas Act provides similar authorization. It states:
---------------------------------------------------------------------------

    \29\ 16 U.S.C. 797(d), 825k.
---------------------------------------------------------------------------

    The Commission may permit any person to file with it a statement 
in writing, under oath or otherwise, as it shall determine, as to 
any or all facts and circumstances concerning a matter which may be 
the subject of investigation. The Commission, in its discretion, may 
publish in the manner authorized in section 312 of the Federal Power 
Act * * * information concerning any such matter.\30\
---------------------------------------------------------------------------

    \30\ 15 U.S.C. 717m.
---------------------------------------------------------------------------

    Because these provisions give the Commission broad discretion to 
release information, such release would be authorized by law under 
the Federal Power and Natural Gas Acts and, therefore, permitted 
under the Trade Secrets Act, creating an exception to the normal 
situation where the Trade Secrets Act prohibits release of 
information covered by Exemption 4. This, in turn, would permit the 
Commission to withhold the information from public FOIA disclosure 
under Exemption 4, and still disclose the information to selected 
individuals with appropriate restrictions on use and dissemination 
of that information without violating the Trade Secrets Act.

c. Exemption 7

    Exemption 7 exempts from disclosure certain information compiled 
for law enforcement purposes.\31\ For purposes of CEII, the most 
relevant Exemption 7 provision is 7(F), which allows information to 
be withheld in order to protect a person's life or physical safety. 
In order to invoke Exemption 7, the agency must be able to 
demonstrate that the document at issue involves enforcement of a 
statute or regulation that the agency is authorized to enforce. The 
Commission has very broad authority to enforce the provisions of the 
Federal Power Act and the Natural Gas Act. For instance, under the 
Federal Power Act, the Commission (1) Monitors and investigates 
compliance with licenses, exemptions and preliminary permits it 
issues; \32\ (2) determines just and reasonable rates; \33\ and (3) 
ensures compliance with the Act and regulations issued 
thereunder.\34\ Similarly, with respect to the Natural Gas Act, the 
Commission has broad authority to (1) Determine whether rates and 
charges are just and reasonable; \35\ and (2) enforce violations of 
the statute or regulations issued thereunder.\36\ Thus, given its 
broad enforcement authority, much of the information the Commission 
collects qualifies as information collected for a law enforcement 
purpose. For such law enforcement information to enjoy protection 
under Exemption 7(F), however, the release of the information must 
reasonably be expected to endanger a person's life or safety.
---------------------------------------------------------------------------

    \31\ 5 U.S.C. 552(b)(7).
    \32\ 16 U.S.C. 823b.
    \33\ 16 U.S.C. 824e.
    \34\ 16 U.S.C. 825m, 825o-1.
    \35\ 15 U.S.C. 717c.
    \36\ 15 U.S.C. 717s.
---------------------------------------------------------------------------

    As noted in paragraph 11 of the final rule, there have been 
official warnings that the energy infrastructure could be the target 
of terrorist attacks. Given that an attack on the energy 
infrastructure is a legitimate threat, the Commission concludes that 
release of information that could facilitate or increase the 
likelihood of the success of such an attack could be expected to 
endanger life and safety of people. The failure of a dam could cause 
flooding that would endanger lives, as could the explosion of a 
natural gas pipeline. Interruptions to gas and electric power 
supplies likewise could endanger lives of those reliant on power, 
especially in times of extreme hot or cold weather. For these 
reasons, information identified as CEII may qualify for protection 
under Exemption 7(F).

[FR Doc. 03-4834 Filed 2-28-03; 8:45 am]

BILLING CODE 6717-01-P


PDF Version