Federal Register: March 3, 2003 (Volume 68, Number 41)
Rules and Regulations
Page 9857-9873
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF ENERGY
Federal Energy Regulatory Commission
18 CFR Parts 375 and 388
[Docket Nos. RM02-4-000, PL02-1-000; Order No. 630]
Critical Energy Infrastructure Information
February 21, 2003.
AGENCY: Federal Energy Regulatory Commission, DOE.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Federal Energy Regulatory Commission (Commission) is
issuing this final rule establishing a procedure for gaining access to
critical energy infrastructure information (CEII) that would otherwise
not be available under the Freedom of Information Act (FOIA). These
restrictions and the final rule were necessitated by the terrorist acts
committed on September 11, 2001, and the ongoing terrorism threat. The
final rule adopts a definition of critical infrastructure that
explicitly covers proposed facilities, and does not distinguish among
projects or portions of projects. The rule also details which location
information is excluded from the definition of CEII and which is
included. The rule addresses some issues that are specific to state
agencies, and clarifies that energy market consultants should be able
to get access to the CEII they need. Finally, the rule modifies the
proposed CEII process and delegates responsibility to the CEII
Coordinator to process requests for CEII and to determine what
information qualifies as CEII.
The final rule will affect the way in which companies submit some
information, and will add a new process in addition to the FOIA for
requesters to use to request information that is not already publicly
available. These new steps will help keep sensitive infrastructure
information out of the public domain, decreasing the likelihood that
such information could be used to plan or execute terrorist attacks.
EFFECTIVE DATE: The rule will become effective April 2, 2003.
FOR FURTHER INFORMATION CONTACT: Carol C. Johnson, Wilbur T. Miller,
Office of the General Counsel, Federal Energy Regulatory Commission,
888 First Street, NE., Washington, DC 20426. (202) 502-6457.
SUPPLEMENTARY INFORMATION:
1. In this final rule, the Federal Energy Regulatory Commission
(Commission) amends its regulations to address the appropriate
treatment of critical energy infrastructure information (CEII) in the
aftermath of the September 11, 2001, terrorist attacks on the United
States of America. Under the Policy Statement issued in Docket No.
PL02-1-000 on October 11, 2001 (Policy Statement), the Commission
removed from easy public access certain documents that previously had
been public.\1\ In order to accomplish this step quickly, staff
identified categories of document types that were likely to contain
CEII, and those documents were removed from unrestricted public access.
Persons seeking removed documents were directed to request the records
using the Freedom of Information Act.\2\
---------------------------------------------------------------------------
\1\ See 67 FR 3129 (Jan. 23, 2002), IV FERC Stats. & Regs. ]
35,542.
\2\ 5 U.S.C. 552.
---------------------------------------------------------------------------
2. On January 16, 2002, the Commission issued a Notice of Inquiry
(NOI) in RM02-4-000 to determine what changes, if any, should be made
to its regulations to restrict unfettered general public access to
critical energy infrastructure information, but still permit those with
a need for the information to obtain it in an efficient manner.\3\ On
September 5, 2002, the Commission issued a Notice of Proposed
Rulemaking and Revised Statement of Policy (NOPR) in Docket Nos. RM02-
4-000 and PL02-1-000.\4\ The NOPR proposed procedures for submitting
and requesting CEII, and proposed the creation of a new position of
CEII Coordinator. The final rule adopts most of the procedures proposed
in the NOPR and creates the new position.
---------------------------------------------------------------------------
\3\ See 67 FR 3129, IV FERC Stats. & Regs. ] 35,542.
\4\ See 67 FR 57994 (Sept. 13, 2002), IV FERC Stats. & Regs. ]
32,564.
---------------------------------------------------------------------------
3. The process adopted in the final rule offers a more efficient
alternative to handling requests for previously public documents than
does the FOIA, which the Policy Statement established as the short-term
method for requesting previously public documents. The FOIA was useful
in the short term where a great deal of information had been removed
from public access, some of which the Commission ultimately ascertained
did not actually contain CEII. As discussed in the NOPR, however, the
FOIA process is not well suited for handling CEII requests.\5\ The FOIA
mandates disclosure of agency records unless the record falls within
one of several specifically enumerated exemptions. Therefore, in order
for CEII to be protected from disclosure, it must qualify for a FOIA
exemption. For this reason, it is unlikely that requesters will obtain
CEII through the FOIA process, although they could use the FOIA to
obtain non-CEII portions of documents. In addition, under the FOIA, an
agency may not distinguish among requesters based on their particular
need for the information. Information given to one FOIA requester must
be given to all requesters. The agency also may not restrict the
recipient's use or dissemination of the information. All these factors
make FOIA an unsatisfactory tool for the agency to use if it wishes to
afford requesters with a specific need for information access to exempt
and potentially dangerous information. Therefore, the Commission is
adding Sec. 375.313 to its regulations to authorize a Critical Energy
Infrastructure Information Coordinator to process non-FOIA requests for
CEII and make determinations regarding such requests.\6\
---------------------------------------------------------------------------
\5\ Id. at p. 57995, ] 32,564 at p. 34,539.
\6\ Of course, the Commission emphasizes that requesters always
retain the option of seeking information under the FOIA.
---------------------------------------------------------------------------
[[Page 9858]]
4. The NOPR revised the Policy Statement to restrict public access
to documents containing detailed specifications of proposed facilities
as well as existing facilities, while at the same time determining that
basic location information should not be treated as CEII.\7\ The final
rule formalizes these policies in the regulations.
---------------------------------------------------------------------------
\7\ 67 FR 57994 at p. 57995, FERC Stats. & Regs. ] 32,564 at p.
34,539.
---------------------------------------------------------------------------
5. The Commission is issuing this rule under the authority of the
Federal Power Act \8\ and the Natural Gas Act \9\ as the rule
establishes a procedure for gaining access to documents collected or
created pursuant to those acts that would not otherwise be available
under the Freedom of Information Act, 5 U.S.C. 552. Accordingly, this
order is subject to rehearing under section 313(b) of the Federal Power
Act, 16 U.S.C. 824l(b), and section 19(b) of the Natural Gas Act, 15
U.S.C. 717r(b), and jurisdiction to review the order lies in the United
States Courts of Appeals as provided in those sections.
---------------------------------------------------------------------------
\8\ 15 U.S.C. 717, et seq.
\9\ 16 U.S.C. 791a, et seq.
---------------------------------------------------------------------------
I. Background
A. The Policy Statement
6. The September 11, 2001, terrorist attacks prompted the
Commission to issue a policy statement on October 11, 2001, in PL02-1-
000, addressing the treatment of previously public documents.\10\ The
Commission announced there that it would no longer make available to
the public through its Internet site, the Records and Information
Management System (RIMS), which has been replaced by the Federal Energy
Regulatory Records Information System (FERRIS), or the Public Reference
Room, documents such as oversized maps that detail the specifications
of energy facilities already licensed or certificated under Part I of
the Federal Power Act \11\ and section 7(c) of the Natural Gas Act,\12\
respectively. Rather, anyone requesting such documents was directed to
follow the procedures set forth in section 388.108 of the Commission's
regulations (Requests for Commission records not available through the
Public Reference Room (FOIA Requests)).\13\ The Policy Statement also
instructed staff to report back to the Commission within 90 days on the
impact of this newly announced policy on the agency's business.
---------------------------------------------------------------------------
\10\ See 66 FR 52917 (Oct. 18, 2001), 97 FERC ] 61,030. Shortly
after the attacks, the Commission issued another policy statement in
Docket No. PL01-6-000, in which it provided guidance to regulated
companies regarding extraordinary expenditures necessary to
safeguard national energy supplies. See 96 FERC ] 61,299 (2001). The
Commission recognized there that electric, gas, and oil companies
may need to adopt new procedures, update existing procedures, and
install facilities to further safeguard their systems, and that
these efforts might result in extraordinary expenditures. The
Commission assured these companies that it would give its highest
priority to processing any filing made for the recovery of such
expenditures. See, e.g., Colonial Pipeline Co., 100 FERC ] 61,035
(2002) (approving Colonial's security surcharge mechanism).
\11\ 16 U.S.C. 719a, et seq.
\12\ 15 U.S.C. 717f(c).
\13\ 18 CFR 388.108 (2002).
---------------------------------------------------------------------------
B. Implementation of the Policy Statement
7. To implement the policy, the Commission's staff first disabled
RIMS access to all oversized documents, which frequently contain
detailed infrastructure information, and also removed them from the
Public Reference Room.\14\ Staff next identified and disabled or denied
access to other categories of documents dealing with licensed or exempt
hydropower projects, certificated natural gas pipelines, and electric
transmission lines that appeared likely to include critical energy
infrastructure information. This effort, which was undertaken as
cautiously and methodically as possible, affected tens of thousands of
documents.
---------------------------------------------------------------------------
\14\ OMB Watch has misunderstood what was meant by oversized
documents, stating ``[c]learly file size was used as a criterion for
removal of information,'' terming this a ``blunt and clumsy
approach.'' OMB Watch at p. 3. As explained in the Policy Statement,
the Commission removed ``documents, such as oversized maps.''
``Oversized'' refers to the size of the page itself, not the length
of the document. Oversized documents generally contain maps and
detailed diagrams, both of which were deemed likely to contain CEII,
keeping in mind that location information of existing facilities was
being protected at that time.
---------------------------------------------------------------------------
8. From the issuance of the Policy Statement until mid-January
2003, the Commission received 212 FOIA requests for documents that were
not available to the public because of the Policy Statement. The
Commission has responded to or otherwise resolved all of these
requests. To date, only two CEII requesters have filed timely
administrative appeals of the decisions to withhold documents, both of
which involved requests for FERC Form No. 715. Nothing is pending in
court.
C. The Notice of Inquiry
9. Three months after the Commission issued the Policy Statement,
it issued the Notice of Inquiry (NOI).\15\ The NOI set forth the
Commission's general views on how it intended to treat previously
public documents, and asked specific questions on the scope and
implications of maintaining the confidentiality of certain previously
public documents. The NOI advised infrastructure owners that they could
seek confidential treatment of filings or parts of filings that, in
their opinion, contain CEII, following the existing procedures in Sec.
388.112 of the Commission's regulations,\16\ and by referencing Docket
No. PL02-1-000 on the first page of the filing. Approximately 50
entities responded to the NOI, with a handful of commenters filing some
portion of their filing nonpublic.
---------------------------------------------------------------------------
\15\ See 67 FR 3129, IV FERC Stats. & Regs. ] 35,542.
\16\ 18 CFR 388.112.
---------------------------------------------------------------------------
D. The Notice of Proposed Rulemaking and Revised Policy Statement
10. On September 5, 2002, the Commission issued the Notice of
Proposed Rulemaking and Revised Statement of Policy (NOPR) in Docket
Nos. RM02-4-000 and PL02-1-000.\17\ The NOPR proposed to establish a
CEII Coordinator with delegated authority to process requests for CEII,
and proposed regulations governing submission of CEII and requests for
CEII.\18\ It also revised the Policy Statement to extend CEII
protection to information regarding proposed facilities and eliminate
CEII protection for information that only reveals the location of the
facility.\19\ The Commission received more than forty comments in
response to the NOPR. A list of commenters is attached as Appendix A.
---------------------------------------------------------------------------
\17\ See 67 FR 57994, IV FERC Stats. & Regs. ] 32,564.
\18\ Id. at p. 58001, ] 32,564 at p. 34,550.
\19\ Id. at p. 58000, ] 32,564 at pp. 34,547-48.
---------------------------------------------------------------------------
II. Discussion
A. The Need for Action
11. As was the case with the NOI, most commenters agree that
security considerations make it advisable for the Commission to
continue to protect CEII. A few commenters, however, maintain that such
protection is either unnecessary to protect the public or outweighed by
the benefits of making the information available. Some contend that
CEII will be of little use to terrorists,\20\ an assertion with which
some commenters specifically disagree.\21\ Some commenters believe that
the NOPR did not adequately take into account the value of making
information such as CEII available to the public, and specifically the
media.\22\
[[Page 9859]]
One commenter contends, for example, that the media has used such
information to expose safety hazards in pipelines.\23\
---------------------------------------------------------------------------
\20\ E.g., American Library Association at p. 2; Lydia Olchoff
at p. 1; Reporters Committee for Freedom of the Press and the
Society of Environmental Journalists (Reporters Committee) at p. 3.
\21\ E.g., GE Power Systems Energy Consulting (GE) at pp. 2-3.
\22\ E.g., American Library Association at p. 1; OMB Watch at p.
1, 4.
\23\ Reporters Committee at p. 3-4. The Commission does not,
however, have jurisdiction over pipeline safety issues, which
belongs to the Department of Transportation. See 49 U.S.C. Chapter
601.
---------------------------------------------------------------------------
12. The Commission remains convinced that the responsible course is
for it to protect CEII. The arguments that such protection is
unnecessary are speculative and unconvincing. For instance, one
commenter points to an estimate that seventy percent of infrastructure
attacks come from insiders as evidence that CEII is unlikely to aid an
attack,\24\ while another states that ``the possibility that terrorists
will study government records and take advantage of perceived
weaknesses is speculative.''\25\ The Commission is not prepared to
stake the public's safety on this reasoning. According to the National
Infrastructure Protection Center, the energy sector is considered one
of the most attractive terrorist targets.\26\ According to media
reports, the FBI identified ``multiple casings of sites'' where users
routed through switches in Saudi Arabia, Indonesia, and Pakistan
examined ``emergency phone systems, electrical generation and
transmission, water storage and distribution, nuclear power plants and
gas facilities.''\27\ Where vulnerable areas exist, the Commission
believes its responsibility is to reduce risks rather than to wait for
proof that an attack is imminent or even likely.
---------------------------------------------------------------------------
\24\ American Library Association at p. 2.
\25\ Reporters Committee at p. 3.
\26\ See National Infrastructure Protection Center Advisory 02-
007 (September 10, 2002) (identifying most attractive targets as
transportation and energy sectors and ``[f]acilities or gatherings
that would be recognized worldwide as symbols of American power or
security.'') The National Infrastructure Protection Center's mission
is to serve as the United States government's focal point for threat
assessment, warning, investigation and response for threats or
attacks against critical infrastructures, including energy and water
systems.
\27\ See The Washington Post, Cyber-Attacks by Al Qaeda Feared,
June 27, 2002, p. A01.
---------------------------------------------------------------------------
13. The Commission also is unconvinced that the general public's
need for information warrants the risk of disclosure of CEII. The
``need to know'' has never been absolute: the FOIA itself recognizes
this principle by having nine exemptions, and the NOPR proposed to do
nothing more than rely upon FOIA exemptions in withholding CEII.\28\
The Commission received no convincing arguments in response to the NOPR
that there are practical benefits from public availability of CEII that
would outweigh possible dangers from attacks on energy infrastructure.
Furthermore, this rulemaking is intended to provide an avenue for
disclosure in instances where there might be some benefit. The
Commission has attempted to strike the best balance possible between
the benefits of information and the protection of people and property.
---------------------------------------------------------------------------
\28\ 67 FR 57994 at p. 57996, FERC Stats. & Regs. ] 32,564 at p.
34,541.
---------------------------------------------------------------------------
B. Legal Authority to Protect CEII
14. In the NOI that initiated this rulemaking, the Commission
invited comments on statutes that might affect the Commission's ability
to protect CEII. The FOIA was identified as the statute that could
mandate disclosure of some sensitive information. After receiving
comments from many commenters, the Commission set out its view, in the
NOPR, that one or more of several FOIA exemptions would most likely
apply to CEII,\29\ namely: (1) Exemption 2, which exempts ``records
related solely to the internal personnel rules and practices of an
agency''; \30\ (2) Exemption 4, which protects from disclosure ``trade
secrets and commercial or financial information obtained from a person
and privileged or confidential''; \31\ and (3) Exemption 7, which
protects from disclosure certain law enforcement information, including
information the disclosure of which might jeopardize a person's life or
safety.\32\
---------------------------------------------------------------------------
\29\ Id. at pp. 57997-800, ] 32,564 at pp. 34,542-46.
\30\ 5 U.S.C. 552(b)(2).
\31\ 5 U.S.C. 552(b)(4).
\32\ 5 U.S.C. 552(b)(7)(F).
---------------------------------------------------------------------------
15. Most commenters agree with the Commission's belief that one or
more of these three exemptions would apply to CEII,\33\ and the
Commission adopts the analysis in the NOPR to support its decision
here.\34\ Some, however, either express concerns about the Commission's
analysis of one or more exemptions or outright disagree with that
analysis.\35\ A few commenters assert that the Commission was somehow
overriding the FOIA \36\ by creating an ``extra-legal category of
protected information,'' \37\ or by making CEII non-requestable under
the FOIA.\38\
---------------------------------------------------------------------------
\33\ E.g., American Electric Power System at p. 1; Duke Energy
Corporation (Duke) at p. 7; Edison Electric Institute (EEI) at pp.
6-7; Southern California Edison Company (SCE) at p. 10; Southern
Company Services, Inc. (Southern) at p. 2; Washington Legal
Foundation and Public Interest Clinic, George Mason University
School of Law (Washington Legal Foundation) at pp. 5-6.
\34\ For the public's convenience, the Commission's FOIA
analysis is reiterated in Appendix B.
\35\ E.g., Hydropower Reform Coalition (HRC) at p. 3;
Massachusetts Energy Facilities Siting Board at p. 3; National
Association of Regulatory Utility Commissioners (NARUC) at pp. 3, 7-
10, 12-15; OMB Watch at pp. 4-6; Reporters Committee at pp. 2, 4, 7;
joint comments of the Public Utilities Commission of Ohio, the
Michigan Public Service Commission and the Oklahoma Corporation
Commission (States) at pp. 3, 7-10, 12-17; Whitfield Russell
Associates at p. 8.
\36\ OMB Watch at pp. 4-5; Reporters Committee at pp. 2, 7.
\37\ American Library Association at p. 2.
\38\ OMB Watch at p. 4.
---------------------------------------------------------------------------
16. The comments asserting that the Commission is somehow
attempting to abrogate or circumvent the FOIA reflect a fundamental
misunderstanding of this rulemaking. The Commission expressly
acknowledged in the NOPR its continuing obligation to comply with the
FOIA.\39\ This rule does not exempt any information from disclosure
under that statute unless it falls within an existing exemption,
abrogate in any way the right of any person to submit a request under
the FOIA, or make any document or category of documents non-requestable
or otherwise not subject to the FOIA. It is not the function of this
rule to make any document unavailable that would otherwise be available
absent this rulemaking. Instead, the purpose of this rulemaking is to
establish a mechanism for making available certain categories of
documents that would otherwise be unavailable.
---------------------------------------------------------------------------
\39\ 67 FR 57994 at p. 57996, FERC Stats. & Regs. ] 32,564 at p.
34,541.
---------------------------------------------------------------------------
17. The discussion of the FOIA exemptions in the NOPR reflects the
Commission's view that a re-evaluation of information access policies,
including analysis of the FOIA provisions, is dictated by the changed
understanding of safety issues resulting from the 9/11 tragedy.\40\
That re-evaluation would be needed regardless of any regulation
governing access to CEII. It becomes relevant here as a part of the
reasoning behind this rulemaking, but it should not be mistaken for a
determination as to whether any specific piece of information is
accessible under the FOIA. A FOIA requester has a right to receive an
individualized determination based on the document(s) requested. The
Commission has not made, and cannot properly make, generic
determinations as to whether FOIA exemptions apply. Accordingly,
specific arguments with respect to Exemptions 2, 4, and 7 addressed in
the NOPR,\41\ and raised again here,\42\ are best
[[Page 9860]]
resolved in the context of particular FOIA requests, where submitters
have the opportunity to enumerate potential competitive harm associated
with release, and where the Commission can evaluate the harm of
releasing that particular information. For purposes of this rulemaking,
however, the Commission continues to believe that the types of
information it has identified as CEII are exempt from disclosure under
the FOIA.
---------------------------------------------------------------------------
\40\ Id. at pp. 57996-800, ] 32,564 at pp. 34,541-46.
\41\ Id.
\42\ E.g., NARUC at p. 12; States at p. 13; OMB Watch at p. 5;
Whitfield Russell Associates at p. 8 (harm resulting from terrorist
attacks would not constitute competitive harm under Exemption 4);
Reporters Committee at p. 7; OMB Watch at p. 6 (information that was
previously public is not protected under the FOIA).
---------------------------------------------------------------------------
18. As a separate matter, some commenters raise issues concerning
the Commission's experience with Exemption 7 and question whether it
applies outside the context of criminal investigations.\43\ In
particular, OMB Watch wonders how the Commission could have removed
from public access tens of thousands of documents on the basis that
they were compiled for law enforcement purposes and asks whether the
Commission ever relied upon Exemption 7 prior to the 9/11 attack.\44\
With respect to OMB Watch's first argument, the Commission did not
remove thousands of documents from public access in October 2001 based
on Exemption 7. The Commission removed them because they fit within
certain categories of documents that were identified as likely to
contain information that could be harmful in the hands of terrorists.
The Commission did not do a document-by-document review of these
documents to determine whether they contained information exempt from
disclosure under the FOIA. In response to OMB Watch's second point, the
Commission has relied from time to time on Exemption 7 prior to 9/
11.\45\ More to the point, it has long been recognized that Exemption 7
applies to civil as well as criminal law enforcement.\46\ OMB Watch is
likewise mistaken that the Commission will claim that all information
it collects constitutes law enforcement information.\47\ The Commission
has no such intention because it recognizes that Exemption 7 does not
protect all law enforcement information, but only certain limited
types, such as information the disclosure of which might interfere with
enforcement proceedings or endanger the safety of an individual.\48\
---------------------------------------------------------------------------
\43\ E.g., OMB Watch at p. 7; Reporters Committee at p. 6.
\44\ OMB Watch at p. 7.
\45\ A review of the Commission's Annual FOIA reports for FY
1998 through 2001 indicates that the Commission relied on Exemption
7 in Fiscal Years 2001 and 1998, specifically citing exemption 7(A)
eight times, 7(B) two times, 7(C) three times, 7(D) two times, and
7(E) five times during those two fiscal years. The Commission also
relied on Exemption 7(F) more recently in modifying its practice of
making the entirety of FERC Form No. 715 available to the public.
See Order on Treatment of Information Collected in Form No. 715, 100
FERC ] 61,141 (2002).
\46\ E.g., Detroit Free Press, Inc. v. DOJ, 73 F.3d 93, 96 (6th
Cir. 1996); Williams v. IRS, 479 F.2d 317, 318 (3rd Cir. 1973).
\47\ See OMB Watch at p. 7.
\48\ 5 U.S.C. 552(b)(7).
---------------------------------------------------------------------------
19. Some commenters raise administrative issues. They assert, for
example, that this rulemaking will improperly remove functions from
qualified ``access professionals,'' and that the Commission has not
adequately explained what qualifications the CEII Coordinator must
possess.\49\ These concerns are misplaced. As stated above, FOIA
requests will continue to be processed according to the Commission's
established FOIA procedures and the Commission's FOIA staff. The
Commission's goal in appointing the CEII Coordinator will be the same
as its goal in assigning staff to handle FOIA requests, or for that
matter all of its staff: to ensure that employees are qualified and
properly trained to handle their appointed responsibilities. Moreover,
as explained below in the discussion on the use of a CEII Coordinator,
the Coordinator will be free and indeed encouraged to consult with the
staff who provides advice and recommendations on FOIA responses.
---------------------------------------------------------------------------
\49\ OMB Watch at p. 7; Reporters Committee at pp. 4-5.
---------------------------------------------------------------------------
20. Some commenters ask whether the Commission will automatically
transfer a FOIA request to the CEII Coordinator if it turns out that
the requested information is CEII.\50\ The answer is, generally no. If
a requester files a FOIA request and does not follow the procedures for
seeking access to CEII, the request will be handled as a FOIA request
and, if the requested information is exempt from disclosure, it will be
withheld. The requester will, however, be notified that the
information, although exempt from disclosure under the FOIA, may be
accessible under the CEII procedures. If the requester seeks access
under both the FOIA and CEII procedures, Commission staff will
coordinate the response.
---------------------------------------------------------------------------
\50\ NARUC at p. 24; States at p. 24.
---------------------------------------------------------------------------
21. The Commission received comments questioning whether a utility
must claim CEII status for information in order for it to qualify for
protection under Exemption 4.\51\ The information either is or is not
CEII. Thus, a claim that information is CEII is not necessary for the
information to qualify as such. For the same reason, a claim that
information is CEII will not necessarily qualify it as CEII.
Accordingly, a submitter's ability to claim protection under Exemption
4 in particular is not, and cannot be, conditioned on a claim of CEII
status. Information may qualify for Exemption 4 protection and not be
CEII, just as information may qualify for CEII protection and not fit
within Exemption 4, as long as it fits within another FOIA exemption.
---------------------------------------------------------------------------
\51\ NARUC at p. 13; States at p. 14.
---------------------------------------------------------------------------
22. As stated above, the Commission recognizes that it is bound by
the FOIA. Where the FOIA affords certain rights to submitters of
information, the Commission remains obligated to recognize those
rights, just as it remains obligated to recognize the rights of FOIA
requesters. Nevertheless, if a utility fails to claim CEII status for
information that would qualify as CEII, the risk that the information
will be disclosed is increased because Commission staff may not become
fully aware of the dangers of disclosing it. Commission staff will
endeavor to identify CEII in processing requests, including information
for which submitters have not claimed CEII status, but proper
determinations about what information should be released under the FOIA
will be easier to make where submitters identify information they
believe to constitute CEII.
23. Finally, some requesters express concern whether the Commission
will provide adequate information about decisions not to disclose CEII,
including information that would allow requesters to challenge claims
of competitive harm.\52\ Determinations of competitive harm would occur
as part of the FOIA process and would be subject to existing FOIA
procedures. The Commission informs a FOIA requester of the reason(s)
for withholding information and the requester may appeal that
determination to the Commission's General Counsel and ultimately to a
United States District Court.\53\ This rulemaking makes no changes to
that procedure. Where information that is exempt from disclosure under
the FOIA is found to be CEII, as noted, the Commission will so notify
the requester.
---------------------------------------------------------------------------
\52\ NARUC at pp. 23-24; States at pp. 24-25.
\53\ 18 CFR 388.108(c)(1), 388.110 (2002).
---------------------------------------------------------------------------
C. Definition of CEII
24. The NOPR proposed to define CEII in Sec. 388.113(c)(1) of the
Commission's regulations \54\ as:
---------------------------------------------------------------------------
\54\ 18 CFR 388.113(c)(1) (2002).
Information about proposed or existing critical infrastructure
that: (i) Relates to the production, generation, transportation,
transmission, or distribution of energy; (ii) Could be useful to a
person in planning an attack on critical infrastructure; (iii) Is
exempt from mandatory disclosure under the
[[Page 9861]]
Freedom of Information Act, 5 U.S.C. 552; and (iv) Does not simply
give the location of the critical infrastructure.\55\
---------------------------------------------------------------------------
\55\ 67 FR 57994 at p. 58000, FERC Stats. & Regs. ] 32,564 at p.
34,548.
This definition departed from the prior policy in that it covered
proposed facilities as well as existing facilities, and in that it
excluded from the definition of CEII information regarding the location
of the infrastructure. The majority of comments regarding the proposed
CEII definition involve the meaning of ``critical infrastructure,'' the
exclusion of location information, and the inclusion of information
about proposed facilities.
1. Definition of Critical Infrastructure
25. A crucial element in defining CEII is determining what
qualifies as ``critical infrastructure.'' The NOPR proposed to define
critical infrastructure as:
Systems and assets, whether physical or virtual, that are so
vital to the United States that the incapacity or destruction of
such systems or assets would have a debilitating impact on the
security, national economic security, national public health or
safety, or any combination of those matters.\56\
---------------------------------------------------------------------------
\56\ Id. at pp. 58000-01, ] 32,564 at p. 34,548.
The NOPR proposed definition of critical infrastructure was taken
directly from the USA PATRIOT Act (Act).\57\ In proposing that
definition, the Commission believed that all components of the energy
infrastructure would qualify as critical infrastructure based on a
finding in the Act that ``[p]rivate business, government, and the
national security apparatus increasingly depend on an interdependent
network of critical physical and information infrastructures, including
telecommunications, energy, financial services, water and
transportation sectors.''
---------------------------------------------------------------------------
\57\ Pub. L. 107-56.
---------------------------------------------------------------------------
26. Some commenters agree with the proposed CEII definition, with
EEI noting that ``[e]lectricity is an essential public service that
sustains public health and welfare, including * * * the provision of
power for heating and air conditioning, water supply, street and
building, hospital services, food storage and processing, computers,
and other electrical equipment,'' and as such, is vital to the nation's
health, security, and economy.\58\ Other commenters, however, are
concerned that the language could be read to extend CEII coverage only
to very large or ``vital'' projects. For example, the Interstate
Natural Gas Association of America (INGAA) requests that the Commission
revise the definition of ``critical infrastructure'' to include ``all
facilities used in the production, generation, transportation,
transmission, or distribution of energy.'' \59\ Conversely, the HRC
recommends that the Commission consider ``only certain documents of
high-risk, high priority cases to be available for CEII protections.''
\60\ Some commenters recommend that the Commission leave it up to the
infrastructure owner to determine whether its project qualifies as
critical infrastructure,\61\ while other commenters voice concern that
the definition of CEII is too broad.\62\ In this regard, Reporters
Committee states that ``[b]y defining CEII in a way that can have all
major energy infrastructure fall under the CEII rubric, FERC maximizes
the control it maintains over information.'' \63\
---------------------------------------------------------------------------
\58\ EEI at p. 2.
\59\ INGAA at p. 3.
\60\ HRC at p. 5.
\61\ E.g., MidAmerican Energy at p. 3; National Grid USA at p.
5.
\62\ E.g., HRC at p. 4; Reporters Committee at p. 8; Society of
Professional Journalists at p. 2.
\63\ Reporters Committee at p. 8.
---------------------------------------------------------------------------
27. No matter how broadly or narrowly the Commission defines
critical infrastructure, in order to qualify for protection as CEII,
the information must be useful to terrorists in planning an attack, be
exempt from disclosure under the FOIA, and not merely give the location
of the infrastructure. This effectively limits the scope of CEII
protection. Moreover, the Commission does not want to define CEII in an
ambiguous way that will invite disputes over which facilities are
covered. The definition of critical infrastructure should encompass all
facilities and components of facilities, not just facilities above a
certain threshold. Even though a project may be small, destruction of
the project could have serious consequences, particularly where it is
part of a larger overall system. It is also important to the Commission
that computer systems that control or are part of the energy
infrastructure are covered. Therefore, the final rule defines critical
infrastructure in new Sec. 388.113(c)(2) of the Commission's
regulations \64\ as ``existing and proposed systems and assets, whether
physical or virtual, the incapacity or destruction of which would
negatively affect security, economic security, public health or safety,
or any combination of those matters.''
---------------------------------------------------------------------------
\64\ See new 18 CFR 388.113(c)(2).
---------------------------------------------------------------------------
2. Information on Location of Facilities
28. The majority of commenters object to the Commission's decision
not to classify location information as CEII.\65\ In this regard, some
question the Commission's assumption that location information is still
publicly available in the wake of September 11.\66\ Others posit that
the Commission should be a trailblazer, protecting location information
even where it is publicly available elsewhere.\67\ Certain commenters
argue that while the Commission should not protect information that is
publicly available from other sources, such as USGS or commercial maps,
other location information may warrant protection.\68\ Still others
contend that information above a certain level of detail should be
protected,\69\ for example, ``location of
[[Page 9862]]
key communication facilities, control centers, and switching
facilities,'' \70\ and information that ``identifies major transmission
interconnections and other system components.'' \71\
---------------------------------------------------------------------------
\65\ E.g., American Gas Association at pp. 1-2; Bonneville Power
Administration (BPA) at pp. 3-4; Duke at p. 14; INGAA at pp. 8-11;
MidAmerican Energy Company (MidAmerican) at pp. 6-7; National Grid
USA at pp. 3 and 5; National Hydropower Association at p. 5;
Northwest Natural Gas Company (Northwest Natural) at pp. 4-8;
Pacific Gas & Electric (PG&E) at p. 1; Williston Basin Interstate
Pipeline Company (Williston Basin) at pp. 4-6.
\66\ E.g., BPA at p. 4; Duke at p. 13 (citing articles claiming
that numerous groups, including the Bureau of Transportation
Statistics, the Department of Energy (DOE), the International
Nuclear Safety Center, the Department of Transportation (DOT), the
National Imagery and Mapping Agency and the United States Geological
Survey, removed geographic information from open public access after
September 11); EEI at pp. 8-9 (stating that DOE has removed
information regarding nuclear facilities containing weapons-grade
plutonium or highly enriched uranium, DOT has removed interactive
oil pipeline maps, and the Energy Information Agency has removed
similar information); and INGAA at p. 10.
\67\ E.g., American Gas Association at p. 2; Northwest Natural
at pp. 7-8; INGAA at pp. 10-11; PG&E at p. 1; Williston Basin at pp.
4-5. These commenters believe that if the Commission protects this
information, others may follow suit, eventually ``aging'' the
information in the public domain, making it less useful to potential
terrorists. The Commission appreciates these commenters' views, but
believes that while this information might gradually become outdated
in the public domain, the probability is remote given the
availability of GPS equipment and commercial satellite images.
\68\ E.g., PJM Interconnection (PJM) at p. 2, SCE at p. 5. For
its part, INGAA, an advocate of protecting location information,
concedes ``[t]o the extent that maps and/or location information are
generally and readily available to the public and contain only non-
detailed information of the location of energy facilities [such as
state- or county-level maps],'' such information could be excluded
from the definition of CEII. INGAA at p. 8.
\69\ E.g., GE at p. 6 (location of certain types of equipment,
such as ``phase-angle regulators or critical FACTS devices'' should
be protected); MidAmerican at p. 6; National Hydropower Association
at p. 5 (protect information that provides ``details of the
sensitive parts of facilities''); North American Electric
Reliability Council (NERC) at pp. 4-5 (protect ``detailed network
topology maps and the details of the interactions performed by
Supervisory Control and Data Acquisition (SCADA) and Energy
Management Systems (EMS)''; Northwest Natural at p. 5 (``assumes
that medium to highly detailed facility location maps'' will be
protected); PG&E at p. 6.
\70\ BPA at p. 4.
\71\ National Grid USA at p. 3.
---------------------------------------------------------------------------
29. The Commission has considered the commenters' arguments and
suggestions especially with respect to protecting information that may
otherwise be available to the public. For this purpose, a check of the
Internet revealed that some of the information that had been removed
after September 11 is once again available. For instance, the
International Nuclear Safety Center currently has interactive maps
available on its web site,\72\ and the United States Geological Survey
lists a variety of maps for sale, including 7.5 minutes maps.\73\
Although some information, such as the DOT pipeline maps have not been
restored to public access, the Commission believes that there are
publicly available sources that would enable a terrorist to locate most
energy infrastructure. Without further guidance from the Congress or
the Administration, the Commission is reluctant to withhold from public
access location information that is otherwise available.
---------------------------------------------------------------------------
\72\ See http://www.insc.anl.gov/pwrmaps/map/world_map.php.
\73\ See http://mapping.usgs.gov/digitalbackyard/
topobkyd.html#5.
---------------------------------------------------------------------------
30. The Commission concludes nevertheless that there is some
``location'' information that does warrant protection as CEII. The
Commission intends to release location information generally needed to
participate in the National Environmental Policy Act (NEPA) process,
while protecting information containing technical details not usually
needed by most NEPA participants. Accordingly, the Commission considers
the following types of gas and hydropower location information as
outside the definition of CEII: (1) USGS 7.5-minutes topographic maps
showing the location of pipelines, dams, or other aboveground
facilities; (2) alignment sheets showing the location of pipeline and
aboveground facilities, right of way dimensions, and extra work areas;
(3) drawings showing site or project boundaries, footprints, building
locations and reservoir extent; and (4) general location maps. In order
to alleviate commenters' concerns about making this information so
easily available, the Commission instructs filers to segregate this
non-CEII location information into a separate volume or appendix, label
it clearly ``Non-Internet Public,'' and submit it with instructions
that it not be placed on the Internet.\74\ To the extent permissible
and practical, the Commission will adhere to those instructions, but
the information will still be publicly available through the Public
Reference Room.
---------------------------------------------------------------------------
\74\ Until instructed otherwise, filers may not submit non-
Internet public documents through the electronic filing process.
Document submitted through that process are automatically placed in
public FERRIS, and are visible on the Internet.
---------------------------------------------------------------------------
31. Conversely, the Commission considers the following gas
information to qualify as CEII because it provides more than just
location: (1) Diagrams of valve and piping details at compressor
stations, meter stations, LNG facilities, and pipeline
interconnections; (2) flow diagrams and other drawings or diagrams
showing similar details such as volumes and operating pressures like
those found in Exhibit G; (3) environmental resource reports for LNG
facilities, and (4) drawings matching labels with specific buildings at
the site, e.g., central gas control centers or gas control buildings.
32. Similarly, examples of hydropower location-related information
that the Commission considers to be CEII include: (1) General design
drawings of the principal project works (e.g., plan, elevation,
profile, and section of dam and powerplant), such as those found in
Exhibit F; (2) maps of projects (including location of project works
with respect to water bodies, permanent monuments, or other structures
that can be noted on the map and recognized in the field), such as
those found in Exhibit G; (3) drawings showing technical details of a
project, such as plans and specifications, supporting design reports,
Part 12 independent consultant reports,\75\ facility details,
electrical transmission systems, and communication and control center
information; (4) locations of critical or vulnerable components of the
project; (5) innundation information; and (6) global positioning system
(GPS) coordinates of any project features (precise surveyed or GPS
coordinates at or above two decimal points of accuracy of equipment and
structures).
---------------------------------------------------------------------------
\75\ See 18 CFR part 12, subpart D.
---------------------------------------------------------------------------
33. A filing such as a license or certificate application could
contain a variety of information falling into one or more of the
following categories: public, non-Internet public information,
nonpublic CEII, and other nonpublic privileged. In that case, the
preferred method of filing would be to segregate each type of
information into separate volumes or appendices, each clearly marked
with the appropriate heading, and with a cover letter explaining the
treatment each volume/appendix should receive as follows:
[sbull] The public volume/appendix should be marked ``Public,''
although public is the default treatment for unmarked documents
[sbull] The non-internet public volume/appendix containing non-
CEII location information should be marked ``Non-Internet Public''
[sbull] The CEII volume/appendix should be marked ``Contains
Critical Energy Infrastructure Information--Do Not Release,'' in
accordance with Sec. 388.112(b), and
[sbull] Any other nonpublic privileged volumes/appendices should
be marked ``Contains Privileged Information--Do Not Release.''
Filers should note that any filing containing non-Internet public, CEII
or other privileged information currently may not be submitted using
the electronic filing process.
34. The electric transmission grid differs from dams and pipelines
in that the Commission does not have regulatory responsibilities over
the siting or licensing of these facilities. Therefore, the Commission
is not charged with conducting the NEPA reviews on these facilities.
For that reason, there is far less need for the public as a whole to
have unfettered access to location information submitted to the
Commission regarding the electric grid. Some companies state that
portions of FERC Form No. 715, Annual Transmission Planning and
Evaluation Report, should fall outside the definition of CEII because
it is location information.\76\ The Commission disagrees. Certain
information in Part 3 of FERC Form No. 715 is not intended primarily to
identify the location of the facilities, but rather to show the
interrelationship of facilities. Therefore, the Commission considers
Part 3 transmission system maps and diagrams used by the utility for
transmission planning to be CEII.
---------------------------------------------------------------------------
\76\ E.g., Commonwealth Associates, Inc. at p. 2; Whitfield
Russell Associates at p. 8.
---------------------------------------------------------------------------
3. Information Regarding Proposed Facilities
35. In the NOPR, the Commission reversed its earlier position that
information relating to proposed facilities should not be treated as
CEII.\77\ As noted in the NOPR, ``[t]he major concern initially about
withholding information about proposed projects was that people might
not be able to participate effectively in the National Environmental
Policy Act (NEPA) process.'' \78\ After the Policy Statement was issued
in October 2001, the
[[Page 9863]]
Commission treated information that identified location of existing,
certificated or licensed facilities as CEII. It recognized that it
would be nearly impossible for people to participate effectively in the
NEPA process without access to specific information regarding the
location of the proposed facility, the area it affects, and the
resources it impacts. For that reason, the Policy Statement
contemplated the release of CEII regarding proposed facilities, and
then the protection of the information as CEII once a certificate or
license was issued.\79\ This resulted in a fairly cumbersome process
and raised the concern that a patient terrorist could collect CEII-type
information on proposed projects and then use that information to cause
harm to the project and the people living and working in its vicinity
once it was built.
---------------------------------------------------------------------------
\77\ 67 FR 57994 at p. 58000, FERC Stats. & Regs. ] 32,564 at p.
34,548.
\78\ Id.
\79\ 66 FR 52917 (Oct. 18, 2001), 97 FERC ] 61,030.
---------------------------------------------------------------------------
36. In the NOPR, recognizing the inconsistency in this approach,
the Commission revised the Policy Statement to restrict access to
detailed technical information relating to proposed facilities, while
at the same time revising the policy to cease protecting location
information as CEII.\80\ The majority of commenters approve of the
decision to include proposed facilities,\81\ with only the HRC
explicitly disagreeing.\82\ As explained in the NOPR, the Commission
believes that as long as basic location information is not treated as
CEII, protection of other sensitive information about proposed
facilities will help protect the infrastructure without interfering
with the NEPA process.\83\ For example, most NEPA commenters will want
to know the location of a proposed pipeline and the footprint of
aboveground facilities, but few will need diagrams of valve and piping
details, or flow diagrams, or need to know which building will house
security and which one will house the computer operations center. Those
who do have such a need may file a request for that information using
the CEII request procedures in new Sec. 388.113(d) of the Commission's
regulations.\84\
---------------------------------------------------------------------------
\80\ 67 FR 57994 at p. 57995, FERC Stats. and Regs. ] 32,564 at
p. 34,539.
\81\ E.g., EEI at p. 9; Industrials (Process Gas Consumers
Group, American Forest & Paper Ass'n, American Iron & Steel
Institute, Georgia Industrial Group, Florida Industrial Gas Users,
Industrial Gas Users of Florida, and United States Gypsum Company)
at p. 4; INGAA at p. 4; National Hydropower Association at p. 5;
Southern at p. 3; Washington Legal Foundation at p. 2; Williston
Basin at p. 4.
\82\ HRC at p. 4.
\83\ See 67 FR 57994 at p. 58000, FERC Stats. & Regs. ] 32,564
at p. 34,548.
\84\ See new 18 CFR 388.113(d).
---------------------------------------------------------------------------
37. Duke Energy suggests that the Commission clarify that the
definition of CEII extends to ``component parts of such systems or
assets or * * * formal proposals to create such systems or assets
including component parts thereof,'' \85\ voicing concern that the
requirement that the infrastructure be vital to the nation's health,
security, and economy ``presupposes that the ``infrastructure'' in
question is already in place,'' effectively excluding information about
proposed facilities.\86\ As discussed above, the Commission is changing
the definition of critical infrastructure in new Sec. 388.113(c)(2) of
its regulations \87\ to encompass ``existing and proposed systems and
assets, whether physical or virtual, the incapacity or destruction of
which would negatively affect security, economic security, public
health or safety, or any combination of those matters.'' This revised
definition makes it clear that information regarding proposed
facilities may be protected as CEII.
---------------------------------------------------------------------------
\85\ Duke Energy at p. 12.
\86\ Id. at pp. 10-11.
\87\ See new 18 CFR 388.113(c)(2).
---------------------------------------------------------------------------
D. Requester's Status and Need for the Information
38. The NOPR proposed a procedure that would not restrict CEII to
certain types of applicants, but would take an applicant's identity and
need into account.\88\ A person seeking access to CEII under proposed
Sec. 388.113 would be required to submit information about his
identity and need for the information.\89\ The NOPR emphasized the
importance of intervenors, landowners and other persons being able to
participate meaningfully in Commission proceedings.\90\ The Commission
also expressed its belief that market participants who are not
participants in proceedings would be able to access necessary
information, either under proposed Sec. 388.113 or through other
means, such as the Open Access Same-time Information System
(OASIS).\91\ The NOPR also proposed to permit owners and operators to
get information about their own facility without the need to file a
request under the CEII process, and to require agents of an owner/
operator to obtain information from the owner/operator.\92\ The NOPR
pointed out that these requirements would have no application to FOIA
requests.\93\
---------------------------------------------------------------------------
\88\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at p.
34,549.
\89\ Id. at p. 58001, ] 32,564 at p. 34,550.
\90\ Id. at p. 58001, ] 32,564 at pp. 34,549-50.
\91\ Id. at p. 58001, ] 32,564 at p. 34,550.
\92\ Id. at p. 58001, ] 32,564 at pp. 34,549-50.
\93\ Id. at p. 58001, ] 32,564 p. 34,549.
---------------------------------------------------------------------------
39. Several commenters express concern over the ability of energy
market consultants and other participants to obtain data that is
important to efforts to expand the energy infrastructure and develop
new energy resources.\94\ Among the concerns is the possibility that
transmission owners might restrict access to CEII in an unfair manner
so as to deprive some market participants of the ability to conduct
needed research.\95\ Some commenters suggest that the Commission adopt
a method of pre-qualification for market participants who are not
participants in Commission proceedings or include consultants and other
market participants in a list of categories of CEII users who would be
permitted access.\96\
---------------------------------------------------------------------------
\94\ E.g., BPA Power Administration at p. 5; Pace Global Energy
Services at p. 3; Reliant Resources, Inc. (Reliant) at pp. 2-4.
\95\ E.g., Reliant at pp. 4-5.
\96\ E.g., Pace Global Energy Services at p. 3; GE at p. 4;
Reliant at pp. 4-5.
---------------------------------------------------------------------------
40. The procedures proposed in the NOPR were intended to provide
access to CEII to requesters with legitimate need for the
information.\97\ Generally speaking, market participants seeking to
develop new or expanded energy resources would present such a need.
Certainly, continued development of energy infrastructure is one aspect
of the nation's defense against attacks upon that infrastructure. The
Commission prefers to proceed on a case-by-case basis rather than
creating categories of ``pre-approved'' users, because such an approach
is better tailored to ensuring that inappropriate users do not gain
access to CEII. The Commission understands that extensive delays in
obtaining data could hinder development of energy resources, and has no
intention of allowing the CEII process to result in any undue delays in
the processing of facilities applications. In addition, once the CEII
Coordinator has approved access to CEII on the part of a particular
requester on a few occasions, subsequent requests by the same requester
for similar information should, in most cases, require less time to
process.
---------------------------------------------------------------------------
\97\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at p.
34,550.
---------------------------------------------------------------------------
41. One matter requires clarification. As National Grid USA points
out,\98\ owner/operators often are corporations that can act only
through agents. The reference to ``agent or representative'' in Sec.
388.113(d)(2) of the Commission's
[[Page 9864]]
regulations \99\ is not intended to refer to employees or officials of
an owner/operator. They would be covered by Sec. 388.113(d)(1) of the
Commission's regulations.\100\ That subsection has been clarified
accordingly.
---------------------------------------------------------------------------
\98\ National Grid USA at p. 9.
\99\ See 18 CFR 388.113(d)(2).
\100\ See 18 CFR 388.113(d)(1).
---------------------------------------------------------------------------
E. Verification and Access Issues
1. CEII Coordinator
42. Most commenters approve of the creation of a CEII Coordinator
position \101\ with some indicating that the agency was better suited
to respond to requests than the industry.\102\ However, a few
commenters believe that owners, operators, and applicants should have
more of a role in granting access to CEII. For example, the National
Hydropower Association requests that the Commission amend the
regulations to permit owners, operators, and applicants to serve as
CEII Coordinator in some circumstances,\103\ and EEI advocates that
submitters of information be able to object to intervenor requests for
CEII.\104\ The Commission believes that the National Hydropower
Association's suggestion would impermissibly interfere with the
Commission's administration of the program. EEI's suggestion, however,
is consistent with the proposed CEII Coordinator process, which is
adopted here. Accordingly, under Sec. 18 CFR 388.112(d) of the
Commission's regulations,\105\ submitters are given an opportunity to
comment on requests for CEII that they submitted.
---------------------------------------------------------------------------
\101\ E.g., EEI at pp. 10-11; Electric Power Supply Association
(EPSA) at p. 4; Industrials at pp. 3-4; INGAA at pp. 5 and 7;
MidAmerican at pp. 3-4; National Hydropower Association at pp. 3-4;
NERC at p. 3; Washington Legal Foundation at p. 2; Whitfield Russell
Associates at p. 9.
\102\ E.g., American Electric Power at p. 1; Industrials at pp.
3-4; Reliant at p. 5.
\103\ National Hydropower Association at pp. 3-4.
\104\ EEI at p. 14.
\105\ 18 CFR 388.112(d).
---------------------------------------------------------------------------
43. At least one commenter, Reporters Committee, disagrees with the
establishment of a CEII Coordinator, voicing concern that the proposed
process removes access decisions from the hands of experienced access
professionals and permits the agency to avoid the FOIA time
limits.\106\ As discussed above in paragraph 18, the CEII Coordinator
will have access to the same professional staff who evaluate and draft
recommended decisions on FOIA requests, so that expertise will be
utilized. Also, the time frames set out in new Sec. 388.113(d)(3)(iii)
of the Commission's regulations \107\ for the CEII Coordinator to
process a request are the same as provided by the Commission's
regulations for processing FOIA requests. To be sure, missing the CEII
deadlines does not have the same legal implications as missing the FOIA
deadlines.\108\ Nevertheless, the Commission is committed to processing
requests for CEII as timely as possible as if it were under the same
legal obligations as imposed under the FOIA. Also, of course, if a
requester is concerned about the timing for a CEII response running
beyond the FOIA statutory time limits, the requester always has the
option of filing a FOIA request and seeking access under that statute.
---------------------------------------------------------------------------
\106\ Reporters Committee at p. 4.
\107\ 18 CFR 388.113(d)(3)(iii).
\108\ A FOIA requester may treat an agency's failure to respond
within the statutory time limit as constructive exhaustion of
administrative remedies, and proceed directly to court without first
filing an administrative appeal. See 5 U.S.C. Sec. 552(a)(6)(C)(i).
Normally, a requester must file an administrative appeal prior in
order to exhaust his or her administrative remedies prior to filing
in court. See Stebbins v. Nationwide Mutual Ins. Co., 757 F.2d 364,
366 (D.C. Cir. 1985) (per curiam).
---------------------------------------------------------------------------
44. Certain commenters request clarification of the authority of
the Coordinator. Southern believes that the NOPR did not make it clear
that the CEII Coordinator has the authority to make determinations of
when information qualifies as CEII. The Commission agrees that the
proposed version of Sec. 375.313 of its regulations \109\ did not
specifically delegate this authority to the Coordinator. The final rule
revises proposed 18 CFR 375.313 to add this delegation, and includes
language in new Sec. 388.113(d)(3)(ii) of the Commission's regulations
\110\ to explicitly add this step into the processing of CEII requests.
---------------------------------------------------------------------------
\109\ 18 CFR 375.313.
\110\ See new 18 CFR 388.113(d)(3)(ii).
---------------------------------------------------------------------------
45. Other commenters request that the Commission provide more
concrete standards or guidance for the Coordinator. For example,
National Grid USA recommends that the Commission provide ``standards
that will govern the CEII Coordinator's decision whether to release
CEII,'' explaining that stated criteria may give requesters insight
into which requests will be granted and reduce fruitless requests.\111\
The National Hydropower Association, the NERC, PJM, and Southern also
request that the Commission provide criteria for the Coordinator to use
in determining whether information qualifies as CEII, whether a
requester has a need for the information, and whether to require a non-
disclosure agreement (NDA) as a condition of release.\112\ The
Commission believes that the standards the Coordinator should use to
determine whether information qualifies as CEII are adequately detailed
in the definition in new Sec. 388.113(c)(1) of its regulations.\113\
That is, does the information relate to the production, generation,
transportation, transmission, or distribution of energy; could it be
useful to a person in planning an attack on critical infrastructure; is
it exempt from disclosure under the FOIA; and does it do more than
provide location information?
---------------------------------------------------------------------------
\111\ National Grid USA at pp. 6-7.
\112\ National Hydropower Association at p. 4; NERC at p. 5; PJM
at p. 1; Southern at pp. 4-6.
\113\ See new 18 CFR 388.113(c)(1).
---------------------------------------------------------------------------
46. Commenters also ask that the Commission develop guidelines for
the Coordinator to use in determining whether to release information to
a particular requester.\114\ The Commission does not intend to provide
within the regulation itself a list of the types of requesters who
would be deemed to have a need for CEII. First of all, that
determination is fact specific. However, in the preamble to the NOPR
and this final rule, the Commission has indicated that intervenors,
market participants, energy market consultants, state agencies,
landowners, environmental groups, and market participants may be found
to have a need for information in a particular situation.\115\ It will
be in the requester's best interest to explain as fully as possible why
he or she needs the information in question. One factor that the
Coordinator should factor into a decision is whether the requester's
need for the information outweighs the potential harm from release of
the information. For instance, if the Commission developed a
hierarchical listing of the most critical portions of the
infrastructure, it would be highly unlikely to release that information
to most requesters, although it might be released to the FBI or the
Office of Homeland Security. The final rule has been changed to reflect
this balancing in new Sec. 388.113(d)(3)(ii) of the Commission's
regulations.\116\
---------------------------------------------------------------------------
\114\ E.g., PJM at p. 1; Southern at pp. 4-5.
\115\ 67 FR 57994 , FERC Stats. & Regs. ] 32,564.
\116\ See 18 CFR 388.113(d)(3)(ii).
---------------------------------------------------------------------------
2. Use of PINS and Passwords
47. Some commenters are concerned that adequate security measures
be taken to protect access to CEII. For instance, certain commenters
favor the use of a password system to provide Internet access to
CEII.\117\ GE believes it may be beneficial to maintain records on each
individual's access to CEII to facilitate investigation of potential
inappropriate access.\118\ Other
[[Page 9865]]
commenters have concerns about the security issues associated with
providing Internet access to CEII.\119\ For the time being, the
Commission does not plan to give requesters access to Commission
databases containing CEII. If and when that time comes, it is expected
that identifications and passwords will be used.
---------------------------------------------------------------------------
\117\ E.g., Duke at p. 17; National Hydropower Association at p.
8; GE at p. 5; SCE at p. 8.
\118\ See GE at p. 5.
\119\ E.g., National Hydropower Association at p. 8; GE at p. 5.
---------------------------------------------------------------------------
3. Verification/Checks on Requesters
48. In the NOPR, the Commission proposed to require each individual
requester to obtain access to information instead of granting access on
an organization-by-organization basis.\120\ Several commenters urge the
Commission to rethink its decision not to grant requesters generic
access to nonpublic information. Some note that such generic access
would reduce burdens on the Commission and requesters.\121\ INGAA,
among others, believes that access decisions should be made on a case-
by-case basis,\122\ while GE recommends a hybrid approach that would
allow entities with ``continuous legitimate need for information'' to
gain generic access, while utilizing a case-by-case system for those
with more occasional need for the information.\123\ For the time being,
the Commission is most comfortable granting access on a case-by-case
basis. As mentioned in the discussion on standards to be used by the
Coordinator, whether someone has a need for information can vary from
circumstance to circumstance. The Commission's goal is to limit CEII
access to those with a need for the information. Even though a
requester may not be a terrorist, the more people who have access to
information, the greater likelihood that it may find its way into the
wrong hands. As also noted above, someone who requests access
frequently will probably be cleared more quickly than a first-time
requester, so the burden of multiple requests should not be too great.
---------------------------------------------------------------------------
\120\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 at
p. 34,550.
\121\ E.g., Duke Energy at p. 17; EPSA at p. 4.
\122\ See INGAA at p. 7; PJM at p. 2.
\123\ See GE at p. 3.
---------------------------------------------------------------------------
49. In the NOPR, the Commission concluded that since the majority
of requesters were expected to be entities and individuals who were
well known to the Commission, it was not necessary to use the services
of outsiders to verify the identity and legitimacy of requesters.\124\
The Commission is reconsidering that position and is in the process of
evaluating existing databases that it may use to screen
requesters.\125\ For that reason, the Commission is revising proposed
Sec. 388.113(d)(3)(i) to add a requirement that the requester provide
his or her date and place of birth and to request that each requester
provide his or her social security number \126\ in addition to the
other information initially proposed in the NOPR.\127\ This will help
verify that the name that the individual provides is their true name,
thus facilitating an accurate screening.
---------------------------------------------------------------------------
\124\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 at
p. 34,550.
\125\ One possibility is to use the Interagency Border
Inspection Service (IBIS) database, which keeps track of information
on suspect individuals, businesses, etc., and which may also be used
to access the FBI's National Crime Information Center containing
records on wanted persons, criminal histories, etc.
\126\ Under the section 7(a)(1) of the Privacy Act, 5 U.S.C.
552a, an agency may not deny a right or benefit provided by law
because an individual did not provide his or her social security
numbers. Therefore, a requester has the option of not disclosing his
or her social security number.
\127\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at
p. 34,550.
---------------------------------------------------------------------------
F. State Agency Issues
50. As indicated in the NOI and the NOPR, there are some unique
issues with respect to state agency access to CEII.\128\ A primary
concern is the ability of state agencies, which likely will be subject
to their own FOIA rules, to protect CEII received from the Commission.
State Commissions \129\ also raise the following additional issues:
---------------------------------------------------------------------------
\128\ 67 FR 3129 at pp. 3132-33, FERC Stats. & Regs. ] 35,542 at
pp. 35,830-33; 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564
at p. 34,551.
\129\
Whether and on what basis FERC proposes that its CEII rule will
preempt state open records laws and rules?
Whether State Commissions will automatically be permitted to
obtain all CEII data from FERC or whether State Commission access
may be limited on a ``need to know'' basis?
Whether FERC's rule will adequately preclude utilities from
invoking the FERC rule to avoid providing CEII data to State
Commissions?
Whether State Commissions will have requisite access to CEII
data from utilities not within a State Commission's jurisdiction
(e.g., for purposes of examining regional transmission or generation
capability)?
Whether State Commissions or their staff will be required to
enter into an NDA, and if so, on what terms? \130\
\130\ NARUC also raises two miscellaneous issues which go beyond
the scope of this rule. First, NARUC encourages the Commission to
clarify how the CEII rule relates to the Commission's Standard
Market Design (SMD) NOPR, ``Remedying Undue Discrimination Through
Open Access Transmission Service and Standard Electricity Market
Design,'' IV FERC Stats. & Regs. ] 32,563 (2002). Without more, and
given the comprehensive nature of the SMD NOPR, the Commission is
uncertain as to what NARUC's specific concerns are. The Commission
believes, however, that there is nothing in this final rule that
conflicts with the goals of the SMD NOPR. Second, NARUC suggests
that the Commission set a benchmark for what reasonable costs of
complying with the CEII rule may be passed through in companies'
rates. To start with, not every one who complies with this rule will
necessarily be a jurisdictional company whose rates the Commission
sets. To the extent jurisdictional companies do incur costs to
comply with the rule, the Commission believes that the current rules
and policies for recovery of administrative costs are adequate to
address the recovery of such compliance costs.
---------------------------------------------------------------------------
51. As an initial matter, the Commission emphasizes that its goal
is to cooperate as fully as possible with the State Commissions, which
share the Commission's objective to ensure that CEII does not get into
the wrong hands. That said, the Commission grants the National
Association of Regulatory Commissioners' (NARUC's) requested
clarification on the Federal preemption issue. NARUC states that the
Commission has no basis to preempt authority over the totality of
access to information regarding gas and electric utility regulation,
and that much of the information at issue is not ``Federal
information,'' that is, generated by or for the Federal government, but
instead is generated by non-Federal entities that have provided similar
or identical information to state regulators.\131\ The Commission
agrees.
---------------------------------------------------------------------------
\131\ NARUC at pp. 17-18.
---------------------------------------------------------------------------
52. The NOPR discussion on preemption related to state agency
requests to FERC for CEII that the Commission had generated or
collected.\132\ As NARUC correctly points out, ``the NOPR itself
declares that FERC's rule does not propose to alter the traditional
ability of State Commissions to obtain such data directly'' from the
companies.\133\ Therefore, as requested by NARUC, the Commission
confirms that it does not intend that public utilities may rely on this
rule to refuse to provide information directly to State Commissions.
---------------------------------------------------------------------------
\132\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. [para]32,564
at p. 34,551.
\133\ NARUC at p. 18.
---------------------------------------------------------------------------
53. In addition, State Commissions will be presumed to have a need
to know information within their state involving issues within their
responsibilities. They also may submit requests for information
regarding entities outside of their jurisdictions with an explanation
of the need. Such requests should be capable of being resolved in a
timely manner. On the other hand, as discussed below, release of CEII
to State Commissions and other State Agencies will normally be subject
to signing an NDA. It does not make sense for the Commission to release
the
[[Page 9866]]
information to the State Agencies with no agreement to protect the
information, at least to the extent permitted by law. The Commission
has no intention of asking a state agency to ignore state law, but
merely to give the Commission notice and an opportunity to take action
to prevent release of the information.
G. Timing Issues
54. The NOPR proposed to provide in Sec. 388.112(d) of the
Commission's regulations \134\ notice and an opportunity for a CEII
submitter to comment when a request was received for its information,
and to provide in Sec. 388.112(e) \135\ notification to the submitter
prior to release.\136\ Under the proposal, a submitter would have at
least five days in which to submit its comments, and at least five-days
notice prior to release of information submitted as CEII.\137\ Several
commenters claim that these time limits are too short, and advocate
having at least 10 days to comment, and up to 30 days notice prior to
release.\138\ At the same time, other commenters are concerned that the
time frames are too long in some circumstances, for instance, where a
time for filing a protest or intervention may expire in the
interim.\139\ At least one, Duke Energy, raises the possibility that
the Commission could extend other deadlines where someone is delayed in
getting access to information.\140\
---------------------------------------------------------------------------
\134\ 18 CFR 388.112(d).
\135\ 18 CFR 388.112(e).
\136\ 67 FR 57994 at p. 58003, FERC Stats & Regs. [para]32,564
at p. 34,552.
\137\ ID. at pp. 58002-03, [para]32,564 at p. 34,552.
\138\ E.g., Duke Energy at p. 5 (advocating a ten-day comment
period); EEI at p. 12 (advocating at least 15 days notice prior to
release); National Hydropower Association at pp. 7-8, 12 (advocating
at least ten business days to comment and ten business days notice
prior to release); NERC at p. 4 (advocating 30 days to respond to
determination to release CEII to non-governmental requester);
Southern at p. 10 (advocating 30 days notice prior to release).
\139\ See, e.g., Industrials at pp. 6-8; Massachusetts Energy
Facilities Siting Board at p. 5; Transmission Access Policy Study
Group at pp. 5-6.
\140\ Duke Energy at p. 17.
---------------------------------------------------------------------------
55. The Commission has considered these arguments and examined the
filings that have very short time limits, for instance responses to
rate filings under Sections 205 of the Federal Power Act,\141\ or
Section 4 of the Natural Gas Act,\142\ and does not believe anyone will
be prejudiced by the time frames proposed in the NOPR. It is unlikely
there will be CEII in most of these filings, and if there is, there
should still be sufficient information available for parties to make
the required filings in a timely manner. This same issue could arise
whenever a company claims confidential treatment for a portion of its
filing. To date, that has not proved to be an obstacle to meaningful,
timely participation by other parties, and there is no reason to expect
that the CEII regulation will cause a problem where none has existed
previously.
---------------------------------------------------------------------------
\141\ 16 U.S.C. 824d.
\142\ 15 U.S.C. 717c.
---------------------------------------------------------------------------
56. The Commission also has examined the arguments that the
proposed time limits do not give submitters adequate time to respond.
First of all, the rule provides minimum times. Where circumstances
permit, the Coordinator may give submitters a longer amount of time.
However, the shorter minimum is needed to permit a quick turnaround
where necessary and to facilitate response within the FOIA time limits.
Prior to 9/11, the five-day minimums existed in Sec. 388.112 of the
Commission's regulations for other requests for nonpublic
treatment.\143\ For years parties have been able to respond within the
time permitted. The Commission sees no reason to extend these time
limits for cases involving CEII.
---------------------------------------------------------------------------
\143\ See 18 CFR 388.112(d) and (e).
---------------------------------------------------------------------------
H. Use of Non-Disclosure Agreements (NDAs)
57. The NOPR proposed to require most CEII requesters to sign an
NDA as a condition of gaining access to CEII.\144\ The major exception
was laid out in proposed 18 CFR 388.113(d)(2), which provided that
owner/operators would be exempt from the requirement to sign an NDA
prior to gaining access to CEII regarding their own projects.\145\ The
reason for this is that they have at least as great an incentive to
protect this information as the Commission has, and probably have
access to even more damaging information in the event a rogue employee
wanted to cause harm to the facility. The Commission adopts here the
proposed exception for owner/operators, and also retains the
requirement that agents/representatives (other than employees or
officers) of owner/operators obtain CEII directly from the owner/
operator, who will be in a better position to judge the agent/
representative's need for the information and to impose restrictions on
its use.
---------------------------------------------------------------------------
\144\ 67 FR 57994 at p. 58002, FERC Stats. Regs. ] 32,564 at pp.
34,551-52.
\145\ Id.
---------------------------------------------------------------------------
58. In addition, as explained in the NOPR, NDAs for Federal agency
CEII requesters will differ from others in part because the Commission
will remind the requester of his or her responsibilities under the
Federal Records Act,\146\ and will require that the requesting agency
refer any subsequent FOIA requests for information provided by the
Commission back to the Commission for a determination as to whether the
information is subject to release under the FOIA.\147\ Similarly, NDAs
for State Agency requesters will specify that the information is
Federal information that is ``on loan'' to the State Agency and that
the Commission has the right to request return of the information. The
Commission will also require that the State Agency notify the
Commission whenever a request for the information is received.
---------------------------------------------------------------------------
\146\ 44 U.S.C. Sec. 3510(b).
\147\ 67 FR 57994 at p. 58002, FERC Stats. & Regs. ] 32,564 at
p. 34,551.
---------------------------------------------------------------------------
59. Several commenters ask the Commission to elaborate on possible
penalties for violation of an NDA.\148\ There are two that readily come
to mind. First, a violation of an NDA could result in the Commission's
refusing to give similar information to the violator in the future
under the CEII process. Indeed, the Commission would be violating the
public's trust if a requester were permitted to violate his or her
obligations under an NDA with impunity. Second, the Commission could
rightly bar someone from representing people before the Commission for
a stated period of time under Sec. 385.2102(a)(2) of the Commission's
regulations.\149\
---------------------------------------------------------------------------
\148\ E.g., EEI at p. 15; Duke at pp. 16-17; MidAmerican at p.
3.
\149\ See 18 CFR 385.2102(a)(2).
---------------------------------------------------------------------------
I. Submission of CEII to the Commission
60. In the NOPR, the Commission proposed to make submission of CEII
a subcategory of submission of documents subject to claims of privilege
under Sec. 388.112 of its regulations,\150\ with the same number of
copies and the same requirement for a written statement supporting the
request for privileged treatment.\151\ As adopted here, CEII
submissions under that section have to indicate that the information is
CEII, paralleling the existing requirement for information submitted
with a request for privileged treatment.\152\ The Commission proposed
to have the submitter determine how best to segregate CEII and non-
CEII, such as by creating a separate nonpublic appendix or simply
redacting CEII from the public filing.\153\ The Commission further
cautioned that it would take disciplinary action against submitters
[[Page 9867]]
who abuse the CEII process by claiming CEII status for extensive
portions of non-CEII.\154\ Under both the NOPR and the final rule, a
claim of privilege has the same effect regardless of whether the
privileged information is CEII or other nonpublic information.\155\
Under Sec. 388.112 of the Commission's regulations,\156\ the portions
for which privileged treatment is sought will be placed in the
nonpublic file, and will not be released before the submitter has an
opportunity to comment on its release, and receives notice of the
impending release.
---------------------------------------------------------------------------
\150\ 18 CFR 388.112.
\151\ 67 FR 57994 at p. 58003, FERC Stats. & Regs. ] 32,564 at
p. 34,552.
\152\ Id.
\153\ Id.
\154\ Id.
\155\ See id.
\156\ See new 18 CFR 388.112.
---------------------------------------------------------------------------
61. Some commenters dislike the practice of creating public and
nonpublic documents, expressing concern over potential confusion
between versions. These commenters urge the Commission to redesign its
forms so that CEII and other nonpublic information are included as a
separate attachment.\157\ Commonwealth Associates, Inc. (CAI) objects
to allowing submitters to designate CEII, out of fear that system
owners/operators will abuse the process by making CEII available to
their agents, while forcing others to wait for a decision by the CEII
Coordinator by making sweeping claims of CEII status. CAI suggests that
the Commission determine CEII status in the first instance. Other
commenters suggest that the Commission specify penalties for violations
of the CEII procedures.\158\
---------------------------------------------------------------------------
\157\ E.g., NERC at p. 3; National Hydropower Association at pp.
11-12.
\158\ E.g., EEI at p. 15; MidAmerican at p. 3.
---------------------------------------------------------------------------
62. The Commission believes, as it did in formulating the NOPR,
that the process for submitting CEII will work best if it tracks as
closely as possible the existing procedures for submitting other
privileged information, procedures that have proven satisfactory over
time. It consequently is reluctant to depart from those procedures for
fear of creating confusion and encountering unforeseen problems. The
suggestion that the CEII Coordinator, rather than the owner of the
information, designate CEII in the first instance, rather than reduce
any prejudice from delays, will more likely increase the delays.
Commission staff would be required to examine every page of a
submission to make the determination, as opposed to examining only
those portions that are claimed to constitute CEII.
63. The concern that some submitters will make unjustified claims
of CEII status is not one that the Commission takes lightly, as it
indicated in the NOPR.\159\ The Commission will take action against
submitters who abuse the system. It does not intend, however, to
specify the form that action may take, as it will depend on the
circumstances. Admittedly, the Commission's ability to impose penalties
is not extensive, but it can disqualify a person from practice before
the Commission in the event of ``unethical or improper professional
conduct.''\160\
---------------------------------------------------------------------------
\159\ 67 FR 57994 at p. 58003, FERC Stats. & Regs. ] 32,564 at
p. 34,552.
\160\ 18 CFR 385.2102(a)(2).
---------------------------------------------------------------------------
64. With respect to the process of separating CEII from non-CEII,
the Commission agrees with the commenters preferring a separate
appendix for documents containing protected information rather than two
entire copies, one public and one nonpublic. Accordingly, the
Commission will modify Sec. 388.112(b) of its regulations \161\ to
state a strong preference for an appendix containing protected
information. The Commission will, however, leave the option of separate
public and nonpublic versions for situations where the use of an
appendix would render the document difficult to read. This revision
will apply to non-CEII protected information as well. As stated above,
the Commission believes that the procedures for CEII and non-CEII
protected information should be as similar as possible to avoid
confusion.
---------------------------------------------------------------------------
\161\ See new 18 CFR 388.112(b).
---------------------------------------------------------------------------
65. The suggestion that the Commission redesign its forms to place
CEII in attachments or appendices is outside the scope of this
rulemaking. As discussed below, however, the Commission does intend to
re-examine its forms and reports to determine whether changes are
needed to provide better protection for CEII. This issue can be
addressed at that time. For now, the Commission will add a requirement
to Sec. 388.112 of its regulations \162\ that all submissions for
which CEII status is claimed be stamped ``Contains CEII--Do Not
Release'' on every page containing CEII rather than just on the front
page. A similar provision will be added for other types of protected
information as well. In addition, the Commission is revising Sec.
388.112(b)(2) of its regulations \163\ to direct those who file on
electronic media \164\ to provide a list of the names of each file
containing CEII or other privileged material, and to mark the outside
of the media (CD, diskette, tape) itself to indicate CEII or other
privileged material. Hopefully these additional steps will prevent
inadvertent disclosure of material.
---------------------------------------------------------------------------
\162\ See new 18 CFR 388.112.
\163\ See 18 CFR 388.112(b)(2).
\164\ At the present time, nonpublic documents are filed on
electronic media such as CDs, diskettes, and tapes. At some point in
the future, the Commission will accept nonpublic and non-Internet
public documents through its electronic filing process. Certain
filers also use Commission-created submission software (e.g., FERC
Form No. 2 software) that enables the filer to ``flag'' certain
fields for nonpublic treatment. The Commission will be examining
that software and revising it and the associated filing instructions
to permit filers to flag CEII and non-Internet Public information as
well.
---------------------------------------------------------------------------
J. Challenges to CEII Status
66. As with the submission of CEII, the NOPR proposed to handle
challenges to CEII status through the existing procedures of Sec.
388.112 of the Commission's regulations.\165\ Under proposed Sec.
388.112(d), the CEII Coordinator would afford the submitter notice in
the event of a request for CEII, and give the submitter at least five
days in which to oppose the request.\166\ Under proposed Sec.
388.112(e), if the CEII Coordinator denies the claim of privilege, the
submitter would receive notice of the denial at least five days prior
to release of the information.\167\
---------------------------------------------------------------------------
\165\ 67 FR 57994 at pp. 58002-3, FERC Stats. & Regs. ] 32,564
at p. 34,552.
\166\ Id. at p. 58003, ] 32,564 at p. 34,552.
\167\ Id. at pp. 58002-3, ] 32,564 at p. 34,552.
---------------------------------------------------------------------------
67. Several commenters have concerns about the time frames proposed
in Sec. 388.112 of the Commission's regulations.\168\ They assert that
a five-day notice period is insufficient, both for the time in which a
submitter must respond to a request for CEII and for the notice of a
proposed release. For the former, commenters favor a 10-day notice
period.\169\ For the latter, commenters prefer anywhere from a 10 to
30-day notice period.\170\ The Commission also received suggestions
that the time run from receipt of notice and that the notice be
``actual'' rather than constructive, such as in a Federal Register
notice.\171\ Some commenters also suggest that the Commission provide
for an automatic stay of a decision to release CEII in the event of a
request for rehearing, arguing that the time limit for making such a
request is 30 days and that the information will otherwise be released
before that time runs.\172\
---------------------------------------------------------------------------
\168\ See 18 CFR 388.112.
\169\ E.g., Duke at p. 5; National Hydropower Association at pp.
7-8, 12.
\170\ E.g., EEI at p. 12; National Hydropower Association at pp.
7-8; National Grid USA at p. 10; NERC at p. 4; Southern at p. 10.
\171\ National Hydropower Association at pp. 7-8, 12.
\172\ E.g., National Hydropower Association at pp. 7-8, 12;
National Grid USA at p. 10.
---------------------------------------------------------------------------
68. The Commission continues to believe that the currently existing
procedures are adequate. The
[[Page 9868]]
Commission has not encountered a problem with submitters of privileged
information subject to a FOIA request not being able to respond timely.
These time frames come into play in situations involving confidential
business information that is highly sensitive to submitters. If the
current time frames are adequate in such situations, they should be
adequate where CEII is requested. It should be noted that the
Commission does send notice directly to the submitter, usually by
facsimile as well as by mail and frequently alerts the submitter by
telephone too, and does not rely on constructive notice.
69. Moreover, as discussed in the NOPR,\173\ decisions by the CEII
Coordinator, which will be made pursuant to authority delegated here in
new Sec. 375.313 of the Commission's regulations,\174\ will be subject
to requests to the Commission for rehearing.\175\ As is true for all
orders issued under delegated authority, the time limit for a request
for rehearing is thirty days.\176\ In addition, the Commission's rules
specifically provide that a request for rehearing does not stay the
order being challenged unless the Commission orders otherwise.\177\ The
Commission has found these procedures to be workable in various
contexts over the years and believes they will continue to function
well in connection with requests for CEII.
---------------------------------------------------------------------------
\173\ 67 FR 57994 at p. 58001, FERC Stats. & Regs. ] 32,564 at
p. 34,550.
\174\ 18 CFR 375.313.
\175\ 18 CFR 385.1902(a).
\176\ 18 CFR 385.713(b).
\177\ 18 CFR 385.713(e).
---------------------------------------------------------------------------
K. Other Issues
70. In response to the NOPR, several commenters suggested that the
Commission review the information that it collects to determine if such
collections are necessary. They reason that if the Commission does not
have the information, it cannot be subject to disclosure under the
FOIA. Southern is concerned about this, particularly where the
information may be available through the Open Access Same-time
Information System (OASIS).\178\ The Commission agrees with these
commenters' logic. As noted in the NOPR, the Commission will be
examining its information collections to see where collections can be
scaled back or eliminated without compromising fulfillment of its
statutory responsibilities.\179\ This will most likely be done in
conjunction with the periodic Office of Management and Budget clearance
process.
---------------------------------------------------------------------------
\178\ Southern at p. 11.
\179\ 67 FR 57994 at p. 58000, n. 41, FERC Stats. & Regs. ]
32,564 at p. 34,547, n. 41.
---------------------------------------------------------------------------
71. Commenters also seek Commission action to amend requirements
that companies make information available where the Commission is
protecting the same information from disclosure.\180\ Conversely, at
least one commenter, the Transmission Access Policy Study Group,
requested that the Commission confirm that it is not eliminating
requirements that companies make this information available.\181\ The
Commission intends to eliminate the inconsistent treatment, and will be
making future modifications to its regulations to effect these changes.
Until those regulations are changed, the requirements remain in place
unless a company successfully obtains a waiver from the requirement.
---------------------------------------------------------------------------
\180\ E.g., INGAA at p. 12; Puget Sound Energy, Inc. at pp. 5-6.
\181\ Transmission Access Policy Study Group at p. 7.
---------------------------------------------------------------------------
III. Information Collection Statement
72. The Office of Management and Budget's (OMB's) regulations
require that OMB approve certain information collection requirements
imposed by agency rule. \182\ In the NOPR, the Commission estimated the
annual public reporting burden as follows:
---------------------------------------------------------------------------
\182\ 5 CFR part 1320 (2002).
----------------------------------------------------------------------------------------------------------------
Number of Number of Hours per Total annual
Data collection respondents responses response hours
----------------------------------------------------------------------------------------------------------------
FERC-603........................................ 200 200 .25 50
----------------------------------------------------------------------------------------------------------------
Total Annual Hours for Collection (reporting + record keeping, if
appropriate) = 50 hours. Information Collection Costs: The NOPR
estimated the cost to comply with these requirements. It projected the
average annualized cost of all respondents to be: Annualized Capital
Startup Costs: The Commission estimated that to respond to this
information collection will be a one-time cost of $12.50 per
respondent. (50 hours @ $50 hourly rate / 200).
73. None of the commenters challenged the estimates provided in the
NOPR. On October 1, 2002, OMB approved without change, the Commission's
request for approval of the information collection required by the
proposed rule, and assigned it OMB No. 1902-0197. The only information
collection changes from the NOPR to the final rule are the added
requirement in new Sec. 388.113(d)(3)(i) of the Commission's
regulations \183\ that requesters provide their date and place of birth
and the request that they provide their social security number. OMB
regulations provide an exemption where a person is required to provide
only facts that are necessary for identification.\184\ The requirement
that a requester provide his or her date and place of birth and the
request that a requester provide his or her social security number are
intended to verify the identity of the requester. For that reason, this
collection need not be resubmitted to OMB for approval.
---------------------------------------------------------------------------
\183\ See new 18 CFR 388.113(d)(3)(i).
\184\ 5 CFR 1320.3(h)(1).
---------------------------------------------------------------------------
IV. Environmental Analysis
74. The Commission is required to prepare an Environmental
Assessment or an Environmental Impact Statement for any action that may
have a significant adverse effect on the human environment.\185\
Included in the exclusions are rules that are clarifying, corrective,
or procedural or that do not substantively change the effect of the
regulations being amended.\186\ This rule is procedural in nature and
therefore falls under this exception; consequently, no environmental
consideration is necessary.
---------------------------------------------------------------------------
\185\ Order No. 486, Regulations Implementing the National
Environmental Policy Act, 52 FR 47897 (Dec. 17, 1987), FERC Stats. &
Regs. Preambles 1986-1990 ] 30,783 (1987).
\186\ 18 CFR 380.4(a)(2)(ii).
---------------------------------------------------------------------------
V. Regulatory Flexibility Act Certification
75. The Regulatory Flexibility Act of 1980 (RFA) \187\ generally
requires a description and analysis of final rules that will have
significant economic impact on a substantial number of small entities.
The Commission is not required to make such analyses if a rule would
not have such an effect. The Commission certifies that this rule does
not have such an impact on small entities.
---------------------------------------------------------------------------
\187\ 5 U.S.C. 601-612.
---------------------------------------------------------------------------
[[Page 9869]]
VI. Document Availability
76. In addition to publishing the full text of this document in the
Federal Register, the Commission provides all interested persons an
opportunity to view and/or print the contents of this document via the
Internet through FERC's Home Page (http://www.ferc.gov) and in FERC's
Internet through FERC's Home Page (http://www.ferc.gov) and in FERC's
Public Reference Room during normal business hours (8:30 a.m. to 5 p.m.
eastern time) at 888 First Street, NE., Room 2A, Washington, DC 20426.
77. From FERC's Home Page on the Internet, this information is
available in the Federal Energy Regulatory Records Information System
(FERRIS). The full text of this document is available on FERRIS in PDF
and WordPerfect format for viewing, printing, and/or downloading. To
access this document in FERRIS, type the docket number of this document
excluding the last three digits in the docket number field.
78. User assistance is available for FERRIS and the FERC's website
during normal business hours from FERC Online Support (by phone at 1-
866-208-3673 (toll-free) or 202-502-6652, or by e-mail at
FERCOnlineSupport@ferc.gov) or the Public Reference Room at (202) 502-
8371 Press 0, TTY (202) 502-8659. E-Mail the Public Reference Room at
public.referenceroom@ferc.gov.
VII. Effective Date
79. These regulations are effective April 2, 2003.
80. The provisions of 5 U.S.C. 801 regarding Congressional review
of final rules does not apply to this final rule, because the rule
concerns agency procedure and practice and will not substantially
affect the rights of non-agency parties.
List of Subjects in 18 CFR Parts 375 and 388
18 CFR Part 375
Authority delegations (Government agencies), Seals and insignia,
Sunshine Act.
18 CFR Part 388
Confidential business information, Freedom of information.
By the Commission.
Magalie R. Salas,
Secretary.
In consideration of the foregoing, the Commission amends parts 375
and 388, chapter I, title 18, Code of Federal Regulations, as follows.
PART 375--THE COMMISSION
1. The authority citation for part 375 continues to read as
follows:
Authority: 5 U.S.C. 551-557; 15 U.S.C. 717-717w, 3301-3432; 16
U.S.C. 791-825r, 2601-2645, 42 U.S.C. 7101-7352.
2. Add Sec. 375.313 to subpart C to read as follows:
Sec. 375.313 Delegations to the Critical Energy Infrastructure
Information Coordinator.
The Commission authorizes the Coordinator or the Coordinator's
designee to:
(a) Receive and review all requests for critical energy
infrastructure information as defined in Sec. 388.113(c)(1).
(b) Make determinations as to whether particular information fits
within the definition of CEII found at Sec. 388.113(c)(1).
(c) Make determinations as to whether a particular requester's need
for and ability and willingness to protect critical energy
infrastructure information warrants limited disclosure of the
information to the requester.
(d) Establish reasonable conditions on the release of critical
energy infrastructure information.
(e) Release critical energy infrastructure information to
requesters who satisfy the requirements in paragraph (b) of this
section and agree in writing to abide by any conditions set forth by
the Coordinator pursuant to paragraph (c) of this section.
PART 388--INFORMATION AND REQUESTS
3. The authority citation for part 388 continues to read as
follows:
Authority: 5 U.S.C. 301-305, 551, 552 (as amended), 553-557; 42
U.S.C. 7101-7352.
4. Section 388.112 is revised to read as follows:
Sec. 388.112 Requests for privileged treatment of documents submitted
to the Commission.
(a) Scope. (1) Any person submitting a document to the Commission
may request privileged treatment by claiming that some or all of the
information contained in a particular document is exempt from the
mandatory public disclosure requirements of the Freedom of Information
Act, 5 U.S.C. 552, and should be withheld from public disclosure.
(2) Any person submitting documents containing critical energy
infrastructure information (CEII) as defined in Sec. 388.113 should
follow the procedures specified in this section.
(b) Procedures. A person claiming that information is privileged
under paragraph (a) of this section must file:
(1) For documents submitted in hard copy,
(i) A written statement requesting privileged treatment for some or
all of the information in a document, and the justification for
nondisclosure of the information;
(ii) One of the following:
(A) In all cases where the privileged information or CEII can, as a
practical matter, be segregated into a separate document or appendix:
(1) Fourteen copies of the original document, indicating in bold
print on the front page either ``Privileged Information Contained in
Attachment'' or ``Critical Energy Infrastructure Information Contained
in Attachment,'' and
(2) One separate document or appendix, indicating in bold print on
the front page either ``Contains Privileged Information--Do Not
Release'' or ``Contains Critical Energy Infrastructure Information--Do
Not Release,'' with every page in the document or appendix marked
either ``Privileged Information--Do Not Release'' or ``Critical Energy
Infrastructure Information--Do Not Release,'' or
(B) In cases where the privileged information or CEII cannot
reasonably or coherently be separated into a separate document or
appendix:
(1) The original document, indicating in bold print on the front
page either ``Contains Privileged Information--Do Not Release,'' or
``Contains Critical Energy Infrastructure Information--Do Not Release''
and, on every page containing privileged information or CEII, the
marking ``Privileged Information--Do Not Release,'' or ``Critical
Energy Infrastructure Information--Do Not Release,'' with the
privileged information or CEII clearly identified, and
(2) Fourteen copies of the document without the information for
which privileged treatment is sought, and with a statement indicating
that information has been removed for privileged treatment, and
(iii) The name, title, address telephone number, e-mail address,
and facsimile number of the person or persons to be contacted regarding
the request for privileged treatment of documents submitted to the
Commission.
(2) For documents submitted on electronic media,
(i) A written statement requesting privileged treatment for some or
all of the information on the electronic media,
[[Page 9870]]
and the justification for non-disclosure of the information;
(ii) One of the following:
(A) In all cases where the privileged information or CEII can, as a
practical matter, be segregated into a separate document or appendix:
(1) One copy of the electronic media and fourteen paper copies of a
filing all without the privileged information or CEII, and all marked
either ``Privileged Information Contained in Separate Attachment'' or
``Critical Energy Infrastructure Information Contained in Separate
Attachment,'' and
(2) One copy of the electronic media and one paper copy of a
separate document or appendix, in both cases marked on media itself and
on the front page either ``Contains Privileged Information--Do Not
Release'' or ``Contains Critical Energy Infrastructure Information--Do
Not Release,'' with every page in the document or appendix marked
either ``Privileged Information--Do Not Release'' or ``Critical Energy
Infrastructure Information--Do Not Release,'' and
(3) An index identifying each file on the media and whether it is
public, contains Critical Energy Infrastructure Information, or
contains other privileged information; or
(B) In cases where the privileged information or CEII cannot
reasonably or coherently be separated into a separate document or
appendix:
(1) One copy of a complete filing on the electronic media and a
paper copy, both marked on the media itself and on the front page
either ``Contains Privileged Information--Do Not Release''or ``Contains
Critical Energy Infrastructure Information--Do Not Release,'' with
every page containing privileged information or CEII marked either
``Privileged Information--Do Not Release'' or ``Critical Energy
Infrastructure Information--Do Not Release'' and with the privileged
information or CEII clearly and specifically identified, and
(2) One copy of the electronic media without the information for
which privileged treatment is sought and with a statement that
information has been removed for privileged treatment, together with
fourteen paper copies without the information for which privileged
treatment is sought,
(3) An index identifying each file on the media and whether it is
public, contains Critical Energy Infrastructure Information, or
contains other privileged information, and
(iii) The name, title, address, telephone number, e-mail address,
and facsimile number of the person or persons to be contacted regarding
the request for privileged treatment of documents submitted to the
Commission.
(c) Effect of privilege claim--(1)For documents filed with the
Commission. (i) The Secretary of the Commission will place documents
for which privileged treatment is sought in accordance with paragraph
(b)(1)(ii) of this section in a nonpublic file, while the request for
privileged treatment is pending. By placing documents in a nonpublic
file, the Commission is not making a determination on any claim for
privilege. The Commission retains the right to make determinations with
regard to any claim of privilege, and the discretion to release
information as necessary to carry out its jurisdictional
responsibilities.
(ii) The Secretary of the Commission will place the request for
privileged treatment described in paragraph (b) of this section and a
copy of the original document with the privileged information removed
in a public file while the request for privileged treatment is pending.
(2) For documents submitted to Commission staff. The notification
procedures of paragraphs (d), (e), and (f) of this section will be
followed by staff before making a document public.
(d) Notification of request and opportunity to comment. When a FOIA
or CEII requester seeks a document for which privilege is claimed, or
when the Commission itself is considering release of the information,
the Commission official who will decide whether to make the document
public will notify the person who submitted the document and give the
person an opportunity (at least five days) in which to comment in
writing on the request. A copy of this notice will be sent to the
requester.
(e) Notification before release. Notice of a decision by the
Commission, the Chairman of the Commission, the Director, Office of
External Affairs, the General Counsel or General Counsel's designee, a
presiding officer in a proceeding under part 385 of this chapter, or
any other appropriate official to deny a claim of privilege, in whole
or in part, will be given to any person claiming that information is
privileged no less than five days before public disclosure. The notice
will briefly explain why the person's objections to disclosure are not
sustained by the Commission. A copy of this notice will be sent to the
FOIA or CEII requester.
(f) Notification of suit in Federal courts. When a FOIA requester
brings suit to compel disclosure of information for which a person has
claimed privileged treatment, the Commission will notify the person who
submitted the documents of the suit.
5. Add Sec. 388.113 to read as follows:
Sec. 388.113. Accessing critical energy infrastructure information.
(a) Scope. This section governs access to critical energy
infrastructure information (CEII). The rules governing submission of
CEII are contained in 18 CFR 388.112(b). The Commission reserves the
right to restrict access to previously filed documents as well as
Commission-generated documents containing CEII.
(b) Purpose. The procedures in this section are available at the
requester's option as an alternative to the FOIA procedures in Sec.
388.108 where the information requested is exempted from disclosure
under the FOIA and contains CEII.
(c) Definitions. For purposes of this section:
(1) Critical energy infrastructure information means information
about proposed or existing critical infrastructure that:
(i) Relates to the production, generation, transportation,
transmission, or distribution of energy;
(ii) Could be useful to a person in planning an attack on critical
infrastructure;
(iii) Is exempt from mandatory disclosure under the Freedom of
Information Act, 5 U.S.C. 552; and
(iv) Does not simply give the location of the critical
infrastructure.
(2) Critical infrastructure means existing and proposed systems and
assets, whether physical or virtual, the incapacity or destruction of
which would negatively affect security, economic security, public
health or safety, or any combination of those matters.
(d) Optional procedures for requesting critical energy
infrastructure information.
(1) An owner/operator of a facility, including employees and
officers of the owner/operator, may obtain CEII relating to its own
facility directly from Commission staff without going through the
procedures outlined in paragraph (d)(3) of this section.
(2) An agent or representative of an owner/operator must obtain
information from the owner/operator.
(3) If any other requester has a particular need for information
designated as CEII, the requester may request the information using the
following procedures:
(i) File a written request with the Commission's CEII Coordinator.
The request shall contain the following: Requester's name, date and
place of
[[Page 9871]]
birth, title, address, and telephone number; the name, address, and
telephone number of the person or entity on whose behalf the
information is requested; a detailed statement explaining the
particular need for and intended use of the information; and a
statement as to the requester's willingness to adhere to limitations on
the use and disclosure of the information requested. Requesters are
also requested to include their social security number for
identification purposes.
(ii) Once the request is received, the CEII Coordinator will
determine if the information is CEII, and, if it is, whether to release
the CEII to the requester. The CEII Coordinator will balance the
requester's need for the information against the sensitivity of the
information. If the requester is determined to be eligible to receive
the information requested, the CEII Coordinator will determine what
conditions, if any, to place on release of the information. Where
appropriate, the CEII Coordinator will forward a non-disclosure
agreement (NDA) to the requester for execution. Once the requester
signs any required NDA, the CEII Coordinator will make the critical
energy infrastructure information available to the requester. The CEII
Coordinator's decisions regarding release of CEII are subject to
rehearing as provided in Sec. 385.713 of this chapter.
(iii) The CEII Coordinator will attempt to respond to the requester
under this section according to the timing required for responses under
the Freedom of Information Act in Sec. 388.108(c), and will provide
notice to the submitter in accordance with Sec. 388.112(d) and (e).
Appendix A
List of Commenters
Adirondack Mountain Club
American Electric Power System
American Gas Association
American Library Association
Bonneville Power Administration (BPA)
Commonwealth Associates, Inc.
City Public Service of San Antonio
Duke Energy Corporation (Duke)
Edison Electric Institute (EEI), including the EEI Alliance of
Energy Suppliers, and EEI Transmission Group
Electric Power Supply Association (EPSA)
Exelon Generation Corporation on behalf of its public utility
subsidiaries PECO Energy Company and Commonwealth Edison Company
Federation of American Scientists
Hydropower Reform Coalition (HRC)
The Industrials: Process Gas Consumers Group, American Forest &
Paper Ass'n, American Iron & Steel Institute, Georgia Industrial
Group, Florida Industrial Gas Users, Industrial Gas Users of
Florida, and United States Gypsum Company
Interstate Natural Gas Association of America (INGAA)
Massachusetts Energy Facilities Siting Board
MidAmerican Energy Company (MidAmerican)
National Association of Regulatory Utility Commissioners (NARUC)
National Grid USA
National Hydropower Association
New York State Public Service Commission
North American Electric Reliability Council (NERC)
Northwest Natural Gas Company (Northwest Natural)
Oklahoma Corporation Commission
Oklahoma Gas and Electric Company
Lydia Olchoff
OMB Watch
Pace Global Energy Services
Pacific Gas & Electric Company (PG&E)
PJM Interconnection, L.L.C. (PJM)
GE Power Systems Energy Consulting (GE)
Puget Sound Energy, Inc.
Reliant Resources, Inc. (Reliant)
Reporters Committee for Freedom of the Press and The Society of
Environmental Journalists (Reporters Committee)
Southern California Edison Company (SCE)
Society of Professional Journalists
Southern Company Services, Inc., acting for itself and as agent for
Alabama Power Company, Georgia Power Company, Gulf Power Company,
Mississippi Power Company, Savannah Electric and Power Company, and
Southern Power Company (Southern)
Public Utilities Commission of Ohio, the Michigan Public Service
Commission and the staff of the Oklahoma Corporation Commission
(States)
Transmission Access Policy Study Group
Washington Legal Foundation and Public Interest Clinic, George Mason
University School of Law (Washington Legal Foundation)
Williston Basin Interstate Pipeline Company (Williston Basin)
Whitfield Russell Associates
Appendix B
Applicability of Freedom of Information Act Exemptions to Critical
Energy Infrastructure Information
The Commission's actions in the NOPR and the final rule are
based on its position that CEII includes only information that is
exempt from disclosure under FOIA. The exemptions most likely to
apply to CEII are Exemptions 2, 4, and 7. A discussion of the
potential applicability of each follows.
a. Exemption 2
Exemption 2 exempts from disclosure ``records related solely to
the internal personnel rules and practices of an agency.'' \1\
According to guidance from the Department of Justice (DOJ), ``[a]ny
agency assessment of, or statement regarding, the vulnerability of
such a critical asset should be protected pursuant to Exemption 2.''
\2\ DOJ has counseled agencies that ``a wide range of information
can be withheld under Exemption 2's 'circumvention' aspect.'' \3\
DOJ also has instructed agencies to take full advantage of the
breadth of Exemption 2's protection for critical infrastructure
information.\4\
---------------------------------------------------------------------------
\1\ 5 U.S.C. 552(b)(2).
\2\ DOJ 2001 FOIA Post 19, posted October 15, 2001. DOJ is the
Federal agency responsible for the administration of the FOIA.
\3\ Id.
\4\ Id.
---------------------------------------------------------------------------
The Commission has concluded that a portion of the CEII is
exempt from disclosure under Exemption 2 of FOIA. Illustratively,
the Commission is expanding its efforts to help facility owners and
operators assess security risks and protect facilities from
attack.\5\ Information developed or created by the Commission as
part of these efforts is likely to fall within the ambit of
Exemption 2. Documents describing inspections of regulated
facilities likewise will fall within Exemption 2 if they assess or
describe vulnerabilities of the project.
---------------------------------------------------------------------------
\5\ The Commission has jurisdiction over the safety of
hydroelectric projects under sections 4(e), 10(a), and 10(c) of the
Federal Power Act, 16 U.S.C. 797(e), 803(a), (c).
---------------------------------------------------------------------------
b. Exemption 4
Exemption 4 protects from public disclosure ``trade secrets and
commercial or financial information obtained from a person and
privileged or confidential.'' \6\ The Commission has determined that
much of the CEII falls within the scope of Exemption 4, on the basis
that release of the information could cause competitive harm to
submitters, impair the Commission's ability to obtain similar
information in the future, or impair the effectiveness of the
Commission's programs.
---------------------------------------------------------------------------
\6\ 5 U.S.C. 552(b)(4).
---------------------------------------------------------------------------
There are two primary issues regarding the application of
Exemption 4 to CEII. First, whether the fact that this sort of
information had been publicly available in the past undermines an
argument that it is now confidential, and second, whether the Trade
Secrets Act \7\ prohibits the Commission from sharing this
information on a ``need-to-know'' basis.
---------------------------------------------------------------------------
\7\ 18 U.S.C. 1905.
---------------------------------------------------------------------------
The Commission concludes that the fact that this information has
been previously public does not defeat Exemption 4. Americans live
in a different world today than they did prior to September 11,
2001. Americans have had to face the harsh realities of terrorism on
their soil. This has forced the nation to reassess its vulnerability
to terrorist threats. Government agencies as well as private
companies have had to reconsider the extent to which they make
information freely available to others.
Specifically, under National Parks & Conservation Assoc. v.
Morton, 49 F.2d 765 (DC Cir. 1974) (National Parks) and Critical
Mass Energy Project v. NRC, 975 F.2d 871 (DC Cir. 1992) (Critical
Mass), the initial inquiry in Exemption 4 cases is whether the
information was submitted to the government voluntarily or whether
it was compelled to be submitted. For voluntary submissions, the
information is entitled to protection if it ``would customarily not
be released to the public by the person from whom it was
[[Page 9872]]
obtained.'' \8\ This test focuses on the submitter's current
treatment of the information, not past treatment. Therefore, if, in
the post-September 11 world, the company would not release the
information to the public, the Commission should not release the
information.
---------------------------------------------------------------------------
\8\ Critical Mass, 975 F.2d at 878.
---------------------------------------------------------------------------
For compelled submissions, there is a three-pronged test--the
competitive harm prong, the impairment prong, and the program
effectiveness prong. If any of the three tests is met, the
information is exempt from mandatory disclosure under FOIA even
though it may have been previously public.\9\ Under the competitive
harm prong, there must be evidence of actual competition, and a
likelihood of substantial competitive injury.\10\ This inquiry tends
to be fact specific, so it is not possible to identify with
certainty which categories of CEII would meet the test. However, as
utilities transition from monopolies to competitive markets, it may
be easier for them to demonstrate actual competition. The inquiry is
whether the submitter is facing competition at the time the
Commission received the request for the information, not whether
there was competition when the information was first submitted to
the Commission. If the competitive situation has changed, the
likelihood of competitive harm would be analyzed using the current
situation, not past conditions. Where competition is found to exist,
the next issue is whether release of the information is likely to
result in substantial competitive injury to the submitter. Again,
the likelihood of competitive injury would be examined at the time
the Commission received the request for the information. Whether the
information could have harmed the submitter two years earlier is
irrelevant; what is relevant is whether release of the information
at the time of the request would cause competitive harm to the
submitter.\11\
---------------------------------------------------------------------------
\9\ While most of the submissions to a regulatory agency like
FERC may appear to be compelled, this may not necessarily be the
case. DOJ has recognized that the ``existence of agency authority to
require submission of information does not automatically mean such a
submission is `required'; the agency authority must actually be
exercised in order for a particular submission to be deemed
`required.' '' DOJ Freedom of Information Act Guide & Privacy Act
Overview, May 2002 ed., at 202. Courts have found submissions to be
voluntary where the agency had issued a subpoena but not sought to
enforce it, see McDonnell Douglas Corp. v. EEOC, 922 F. Supp. 235
(E.D. Mo. 1996), and where the agency did not have authority to
enforce the information collection because the information request
violated the Paperwork Reduction Act, 44 U.S.C. 3501, see Center for
Auto Safety v. NHTSA, 244 F.3d 144 (D.C. Cir. 2001). At bottom, the
question of whether the information has been submitted voluntarily
or was compelled must be analyzed on a case-by-case basis.
\10\ See CNA Fin. Corp. v. Donovan, 830 F.2d 1132 (D.C. Cir.
1987) (CNA).
\11\ The Commission's analysis of a submitter's competitive
situation under FOIA is not the same as, and indeed is less rigid
than, the analysis it must perform to establish lack of market power
for charging market based rates. For FOIA purposes, the competition
requirement is satisfied if the submitter faces some level of actual
competition. See Niagara Mohawk Power Corp. v. DOE, 169 F.3d 16, 19
(D.D.C. 1999) (Niagara).
---------------------------------------------------------------------------
The test most frequently applied under the competitive harm
prong is whether use of the information by competitors is likely to
harm the submitter.\12\ This may be fairly challenging to
demonstrate in the case of CEII because the primary concern is that
the information could be used to plan an attack on the
infrastructure, not that it could be used to steal customers or
undercut prices. On the other hand, a submitter may be able to show
competitive harm where use of the information by someone other than
a competitor could cause financial harm to the submitter.\13\ As
relevant here, a terrorist attack on the energy infrastructure could
cause financial harm to the owners and operators of the facilities
because of lost opportunity costs as well as repair costs.
---------------------------------------------------------------------------
\12\ See, e.g., CNA, 830 F.2d at 1152 & n.158; Public Citizen
Health Research Group v. FDA, 704 F.2d 1280, 1291 (D.C. Cir. 1983).
\13\ See Nadler v. FDIC, 899 F. Supp. 158, 163 (S.D.N.Y. 1995)
(Nadler), aff'd, 92 F.3d 93 (2d Cir. 1996).
---------------------------------------------------------------------------
For compelled submissions, the impairment prong is satisfied
where disclosure may affect the reliability or quality of the
information received.\14\ The more subjective the filing
requirement, the more likely that disclosure of the information
could impair the Commission's ability to get thorough and accurate
information in the future.\15\ As noted by EEI in its comments on
the NOI, regulated entities may have discretion regarding how to
construct their filings.\16\ If companies are worried that
information they submit will be subject to public disclosure, they
may choose not to submit the same level of detail that they might
otherwise submit. In such circumstances, and assuming the
submissions would otherwise comply with the Commission's
regulations, the information may be exempt from disclosure under the
impairment prong of Exemption 4.
---------------------------------------------------------------------------
\14\ Id.
\15\ See Niagara Mohawk, 169 F.3d at 18 (holding that impairment
is unlikely to be found where ``data sought appears to take the form
of hard, cold numbers on energy use and production, the fudging of
which may strain all but the deliberately mendacious.'').
\16\ EEI NOI comments at p. 42.
---------------------------------------------------------------------------
Critical Mass recognized that in addition to the competitive
harm and impairment prongs, there may be other instances where non-
disclosure is warranted in order to protect other governmental
interests, such as program effectiveness.\17\ Recently, in Public
Citizen Health Research Group v. NIH,\18\ the district court relied
on Critical Mass in determining that ``impairment of the
effectiveness of a government program is a proper factor for
consideration in conducting an analysis under'' Exemption 4. The
court held that the National Institutes of Health's royalty
information was protected under Exemption 4 because release of the
information would make companies reluctant to enter into agreements
with NIH, thus impairing the effectiveness of NIH's licensing
program.\19\ The court reached a similar conclusion in Judicial
Watch, Inc. v. Export-Import Bank, where release of certain
financial information from foreign export credit agencies was held
to be exempt from disclosure because release would make the credit
agencies look for financing outside of the United States,
undermining the agency's statutory purpose of fostering domestic
economic growth by supporting export transactions.\20\
---------------------------------------------------------------------------
\17\ See Critical Mass, 975 F.2d 879 (``It should be evident
from this review that the two interests identified in that National
Parks test are not exclusive.'').
\18\ 209 F. Supp. 2d 37 at 52 (D.D.C. Mar. 12, 2002)
(alternative holding).
\19\ Id. at 54.
\20\ 108 F. Supp. 2d 19, 30 (D.D.C. 2000).
---------------------------------------------------------------------------
Applying these recent decisions here, indiscriminate release of
CEII could impair the effectiveness of the Commission's programs,
which are meant to satisfy its mandate to regulate and oversee
energy industries in the economic and environmental interest of the
American public.\21\ Inappropriate release of CEII could make the
infrastructure more vulnerable to attack, threatening those
industries and resulting in potentially devastating economic and
environmental consequences. Release of CEII also could make
regulated entities less forthcoming in the information they provide
to the Commission, especially where they have discretion as to what
they submit.\22\ Restricted flow of information between the
Commission and the companies could impair the Commission's programs
that rely on such information. This is of particular concern in
today's world, where the Commission is seeking additional
information from licensees to assure that the infrastructure is
sited and built safely and remains protected. Finally, release of
CEII could harm the relationship between Commission staff and the
regulated companies, impairing trust, and causing the parties to
deal with each other in a more adversarial manner than necessary.
For all of these reasons, much, if not all of the CEII would be
exempt from disclosure under the third prong of Exemption 4 as it
relates to compelled submissions.
---------------------------------------------------------------------------
\21\ See http://www.ferc.gov/About/mission/mission_intro.htm
\21\ See http://www.ferc.gov/About/mission/mission_intro.htm
(2002).
\22\ See Nadler, 899 F. Supp. 158, 162.
---------------------------------------------------------------------------
A second issue is whether the Trade Secrets Act prohibits the
Commission from sharing Exemption 4 material on an as-needed basis.
The Trade Secrets Act states in relevant part that:
Whoever, being an officer or employee of the United States or of
any department or agency thereof, publishes, divulges, discloses or
makes known in any manner or to any extent not authorized by law any
information coming to him in the course of his employment or
official duties or by reason of any examination or investigation
made by, or return, report or record made to or filed with, such
department or agency or officer or employee thereof, which concerns
or relates to trade secrets, processes, operations, style of work,
or apparatus, or to the identify, confidential statistical data,
amount or source of any income, profits, losses or expenditures of
any person, firm, partnership, corporation, or association; * * * to
be seen or examined by any person except as provided by law; shall
be fined not more than $1,000, or imprisoned not more than one year,
or both;
[[Page 9873]]
and shall be removed from office or employment.\23\
---------------------------------------------------------------------------
\23\ 18 U.S.C. 1905.
---------------------------------------------------------------------------
See Chrysler Corp. v. Brown, 441 U.S. 281, 301(1979) (Chrysler). The
Trade Secrets Act applies to formal agency actions as well as
actions by the agency's individual employees. Courts have found that
the coverage of the Trade Secrets Act and Exemption 4 are co-
extensive,\24\ meaning that the Trade Secrets Act generally
prohibits release of information covered by Exemption 4.\25\
However, the Trade Secrets Act permits disclosure of trade secret
information where ``authorized by law.'' \26\ Accordingly, under the
Trade Secrets Act, protected information may be released where there
is statutory or regulatory authority for the agency to release it.
In cases where the authorization for release is found in an agency
regulation, the inquiry is whether the regulation permitting the
release is authorized by law.\27\
---------------------------------------------------------------------------
\24\ See, e.g., Bartholdi Cable Co. v. FCC, 114 F.3d 274 (D.C.
Cir. 1997); CNA, 830 F.2d at 1152.
\25\ CNA, 830 F.2d at 1151.
\26\ Chrysler, 441 U.S. at 301.
\27\ Id.
---------------------------------------------------------------------------
The Commission has statutory authority to release trade secret
information. While both the Federal Power and Natural Gas Acts place
restrictions on an individual employee's release of information
gathered in the course of examining records of a company, they
permit the Commission itself to authorize such a release. The
Federal Power Act provides:
The Commission shall at all times have access to and the right
to inspect and examine all accounts, records, and memoranda of
licensees and public utilities, and it shall be the duty of such
licensees and public utilities to furnish to the Commission, within
such reasonable time as the Commission may order, any information
with respect thereto which the Commission may by order require,
including copies of maps, contracts, reports of engineers, and other
data, records, and papers, and to grant to all agents of the
Commission free access to its property and its accounts, records and
memorandum when requested so to do. No member, officer, or employee
of the Commission shall divulge any fact or information which may
come to his knowledge during the course of examination of books or
other accounts, as hereinbefore provided, except insofar as he may
be directed by the Commission or by a court.\28\
---------------------------------------------------------------------------
\28\ 16 U.S.C. 825(b); see also 15 U.S.C. 717g(b) (Natural Gas
Act) and 18 CFR 3c.2(a).
---------------------------------------------------------------------------
In addition, sections 4 and 312 of the Federal Power Act
authorize the Commission ``[t]o make public from time to time the
information secured hereunder and to provide for the publication of
its reports and investigations in such form and manner as may be
best adapted for public information and use.'' \29\ Section 14 of
the Natural Gas Act provides similar authorization. It states:
---------------------------------------------------------------------------
\29\ 16 U.S.C. 797(d), 825k.
---------------------------------------------------------------------------
The Commission may permit any person to file with it a statement
in writing, under oath or otherwise, as it shall determine, as to
any or all facts and circumstances concerning a matter which may be
the subject of investigation. The Commission, in its discretion, may
publish in the manner authorized in section 312 of the Federal Power
Act * * * information concerning any such matter.\30\
---------------------------------------------------------------------------
\30\ 15 U.S.C. 717m.
---------------------------------------------------------------------------
Because these provisions give the Commission broad discretion to
release information, such release would be authorized by law under
the Federal Power and Natural Gas Acts and, therefore, permitted
under the Trade Secrets Act, creating an exception to the normal
situation where the Trade Secrets Act prohibits release of
information covered by Exemption 4. This, in turn, would permit the
Commission to withhold the information from public FOIA disclosure
under Exemption 4, and still disclose the information to selected
individuals with appropriate restrictions on use and dissemination
of that information without violating the Trade Secrets Act.
c. Exemption 7
Exemption 7 exempts from disclosure certain information compiled
for law enforcement purposes.\31\ For purposes of CEII, the most
relevant Exemption 7 provision is 7(F), which allows information to
be withheld in order to protect a person's life or physical safety.
In order to invoke Exemption 7, the agency must be able to
demonstrate that the document at issue involves enforcement of a
statute or regulation that the agency is authorized to enforce. The
Commission has very broad authority to enforce the provisions of the
Federal Power Act and the Natural Gas Act. For instance, under the
Federal Power Act, the Commission (1) Monitors and investigates
compliance with licenses, exemptions and preliminary permits it
issues; \32\ (2) determines just and reasonable rates; \33\ and (3)
ensures compliance with the Act and regulations issued
thereunder.\34\ Similarly, with respect to the Natural Gas Act, the
Commission has broad authority to (1) Determine whether rates and
charges are just and reasonable; \35\ and (2) enforce violations of
the statute or regulations issued thereunder.\36\ Thus, given its
broad enforcement authority, much of the information the Commission
collects qualifies as information collected for a law enforcement
purpose. For such law enforcement information to enjoy protection
under Exemption 7(F), however, the release of the information must
reasonably be expected to endanger a person's life or safety.
---------------------------------------------------------------------------
\31\ 5 U.S.C. 552(b)(7).
\32\ 16 U.S.C. 823b.
\33\ 16 U.S.C. 824e.
\34\ 16 U.S.C. 825m, 825o-1.
\35\ 15 U.S.C. 717c.
\36\ 15 U.S.C. 717s.
---------------------------------------------------------------------------
As noted in paragraph 11 of the final rule, there have been
official warnings that the energy infrastructure could be the target
of terrorist attacks. Given that an attack on the energy
infrastructure is a legitimate threat, the Commission concludes that
release of information that could facilitate or increase the
likelihood of the success of such an attack could be expected to
endanger life and safety of people. The failure of a dam could cause
flooding that would endanger lives, as could the explosion of a
natural gas pipeline. Interruptions to gas and electric power
supplies likewise could endanger lives of those reliant on power,
especially in times of extreme hot or cold weather. For these
reasons, information identified as CEII may qualify for protection
under Exemption 7(F).
[FR Doc. 03-4834 Filed 2-28-03; 8:45 am]
BILLING CODE 6717-01-P