Federal Register: January 26, 2005 (Volume 70, Number 16) Rules and Regulations Page 3599-3614 ----------------------------------------------------------------------- DEPARTMENT OF ENERGY 10 CFR Part 824 [Docket No. SO-RM-00-01] RIN 1992-AA28 Procedural Rules for the Assessment of Civil Penalties for Classified Information Security Violations AGENCY: Office of Security, Department of Energy. ACTION: Final rule. ----------------------------------------------------------------------- SUMMARY: The Department of Energy (DOE) is today publishing a final rule to assist in implementing section 234B of the Atomic Energy Act of 1954. Section 234B makes DOE contractors and their subcontractors subject to civil penalties for violations of DOE rules, regulations and orders regarding the safeguarding and security of Restricted Data and other classified information. EFFECTIVE DATE: February 25, 2005. FOR FURTHER INFORMATION CONTACT: Geralyn Praskievicz, Office of Security, SO-1, U.S. Department of Energy, 1000 Independence Ave., SW., Washington, DC 20585, (202) 586-4451; JoAnn Williams, Office of General Counsel, GC-53, U.S. Department of Energy, 1000 Independence Ave., SW., Washington, DC 20585, (202) 586-6899. SUPPLEMENTARY INFORMATION: I. Introduction. II. DOE's Response to Comments. III. Regulatory Review and Procedural Requirements. A. Review Under Executive Order 12866. B. Review Under the Regulatory Flexibility Act. C. Review Under the Paperwork Reduction Act. D. Review Under the National Environmental Policy Act. E. Review Under Executive Order 12988. F. Review Under Executive Order 13132. G. Review Under the Treasury and General Appropriations Act, 1999. H. Review Under the Treasury and General Appropriations Act, 2001. I. Review Under Executive Order 13084. J. Review Under the Unfunded Mandate Reform Act of 1995. K. Review under Executive Order 13211. L. Congressional Notification. [[Page 3600]] I. Introduction Pursuant to the Atomic Energy Act of 1954 and other laws, DOE carries out a variety of national defense and energy research, development and demonstration activities at facilities around the nation that are owned by the United States Government, under the control and custody of DOE, and operated by management and operating contractors under the supervision of DOE. The use of private industry and educational institutions to operate these kinds of facilities, including the national laboratories and their predecessors, dates back to the Atomic Energy Commission, if not to the Manhattan Project. It has allowed the United States to attract the best minds to do the cutting edge scientific, engineering and technical work critical to DOE's national security mission. By its nature, that work involves highly classified information regarding atomic weapons and other weapons of mass destruction; nuclear naval propulsion; intelligence related to terrorism and other topics of great sensitivity. For more than 50 years, DOE, like its predecessor the Atomic Energy Commission, has had to balance two sets of considerations. On the one hand, DOE must attract the best minds that it can to do cutting edge scientific work at the heart of DOE's national security mission, and DOE must permit its operating and management contractors to function in a manner that permits sufficient dissemination of classified work to be put to the various uses that U.S. national security demands. At the same time, it obviously must take all prudent steps to prevent enemies of this nation from gaining access to work that could be used to the detriment, rather than the enhancement, of vital national security interests. Over the years periodic contractor lapses in adherence to processes designed to safeguard Restricted Data or other classified information have given rise to concerns about the adequacy of efforts by contractors to protect this kind of information. In order to give DOE an additional tool to assure that these processes are being followed, Congress enacted section 234B of the Atomic Energy Act of 1954. This section grants DOE new authority to impose civil penalties for violations of DOE regulations and orders directed to the safeguarding of this kind of information, as well as confirming DOE's preexisting authority to withhold portions of a contractor's fee by reason of poor performance arising out of such violations. DOE had previously promulgated regulations specifying how it would carry out this latter authority, and today's rule specifies the manner in which it will carry out its civil penalty authority. DOE believes that today's regulation will assist in providing greater emphasis on a culture of security awareness in existing DOE operations, and strong incentives for contractors to identify and correct noncompliance conditions and processes in order to protect classified information of vital significance to this nation. It will also facilitate, encourage and support contractor initiatives for the prompt identification and correction of security problems. Section 3147 of the National Defense Authorization Act for Fiscal Year 2000 (Public Law 106-65) added a new section 234B to the Atomic Energy Act of 1954 (the Act) (42 U.S.C. 2282b). Section 234B has two subsections. The first subsection, subsection a., provides that any person who: (1) Has entered into a contract or agreement with DOE, or a subcontract or subagreement thereto, and (2) violates (or whose employee violates) any applicable rule, regulation, or order prescribed or otherwise issued by the Secretary of Energy pursuant to the Act relating to the safeguarding or security of Restricted Data or other classified or sensitive information, shall be subject to a civil penalty not to exceed $100,000 for each such violation. The second subsection, subsection b., requires that each DOE contract contain provisions which provide an appropriate reduction in the fees or amounts paid to the contractor under the contract in the event of a violation by the contractor or contractor employee of any rule, regulation or order relating to the safeguarding or security of Restricted Data or other classified or sensitive information. DOE elected to implement section 234B in two separate rulemakings, one establishing procedural rules to implement subsection a. similar to the procedural rules to achieve compliance with DOE nuclear safety requirements found at 10 CFR part 820, ``Procedural Rules for DOE Nuclear Activities,'' and the other establishing a procurement clause like the existing clause for conditional payment of fee, profit or incentives, 48 CFR (DEAR) 970.5215-3. On February 1, 2001, DOE published a notice of proposed rulemaking (NOPR) (66 FR 8560) to implement subsection b. of section 234B, concerning reductions in fees or amounts paid to contractors in the event of a security violation. DOE received numerous comments in response to that notice, and responded to them in a notice of interim final rulemaking on December 10, 2003 (68 FR 68771). On April 1, 2002, DOE published a NOPR at 67 FR 15339 to solicit comments on its proposed framework for an enforcement program for the civil penalty provisions in subsection a. The NOPR requested written comments by July 1, 2002, and invited oral comments at public hearings held in Las Vegas, Nevada on May 22, 2002, and in Washington, DC on May 29, 2002. Written comments were received from eleven sources and oral comments from two. All comments were from representatives of DOE contractors. DOE responds to the major issues raised in comments in part II of this SUPPLEMENTARY INFORMATION. To a large extent, the regulations in this notice of final rulemaking are self-explanatory. There are, however, several fundamental features which were discussed in the NOPR that bear repeating here. DOE will apply civil penalties only to violations of requirements for the protection of classified information. Classified information is defined as ``Restricted Data'' or ``Formerly Restricted Data'' protected against unauthorized disclosure pursuant to the Act and ``National Security Information'' protected against unauthorized disclosure pursuant to Executive Order 12958, as amended on March 25, 2003, or any predecessor or successor order. Although section 234B refers to ``sensitive information,'' DOE does not employ this term in today's final regulations because: (1) Neither the statute nor its legislative history defines the term; (2) There is no commonly accepted definition of ``sensitive information'' within DOE or the Executive Branch; and (3) the legislative history of subsection a. indicates that the Congress was concerned with unauthorized disclosures of classified information. The additional category of unclassified information that might merit inclusion in a regulation imposing civil penalties is Unclassified Controlled Nuclear Information (UCNI), a category of unclassified government information concerning atomic energy defense programs established by section 148 of the Act (42 U.S.C. 2168). However, DOE already has a preexisting regime in place with respect to such information that includes civil penalties. Section 148 provides that any person who violates a regulation or order issued under that section shall be subject to a civil penalty not to exceed $100,000. DOE implemented the provisions of section 148 in regulations contained in 10 CFR part 1017. Since part 1017 already imposes a civil [[Page 3601]] monetary penalty for unauthorized dissemination of UCNI comparable to the penalty specified in section 234B, DOE determined that it is unnecessary to include UCNI in regulations implementing section 234B. Today's final regulations permit DOE to assess civil penalties for violations of regulations, rules or orders described in Sec. 824.4 of part 824. These are violations of: (1) 10 CFR part 1016 (``Safeguarding of Restricted Data''); (2) 10 CFR part 1045 (``Nuclear Classification and Declassification''); or (3) any other DOE regulation or rule (including any DOE order or manual enforceable under a contractual provision) related to the safeguarding or security of Restricted Data or other classified information that specifically indicates that violation of its provisions may result in a civil penalty pursuant to section 234B, and (4) compliance orders issued pursuant to part 824. In addition, section 161 of the Act broadly authorizes DOE to prescribe regulations and issue orders deemed necessary to protect the common defense and security (42 U.S.C. 2201). Consistent with the proposed rule, part 824 implements this authority by providing that the Secretary may issue a compliance order requiring a person to take corrective action if a person by act or omission causes, or creates a risk of, the loss, compromise or unauthorized disclosure of classified information even if that person has not violated a rule or regulation specified in Sec. 824.4(a) of part 824. Violation of the compliance order may also result in the assessment of a civil penalty if the order so specifies. While the recipient of a compliance order may request the Secretary to rescind or modify the compliance order, the request does not stay the effectiveness of the order unless the Secretary issues a new order to that effect. The compliance order provisions in 10 CFR 824.4(b) and (c) are modeled after a similar mechanism in 10 CFR part 820, the rule implementing procedures for section 234A of the Act with respect to nuclear safety. Today's final rule only applies to contractors and others who have entered into agreements or contracts with DOE or subagreements or subcontracts thereto. This is because subsection a. of section 234B provides that what triggers the availability of a civil penalty is the fact that a ``person * * * has entered into a contract or agreement with the Department of Energy, or a subcontract or subagreement thereto, and * * * violates (or whose employee violates) any applicable rule, regulation or order.'' It is clear from the statutory language, particularly the parenthetical ``or whose employee violates'' that Congress intended contractors and their subcontractors or suppliers to be responsible for the acts or omissions of their employees who fail to observe these rules, regulations, and orders, rather than contemplating the imposition of civil penalties on employees themselves. Consequently, part 824 provides for the assessment of civil penalties against contractors or subcontractors for their employees' actions but not against the employees themselves. The Atomic Energy Act establishes a separate regime of criminal penalties applicable to individuals for the knowing unauthorized communication of Restricted Data. See sections 224 and 227 of the Atomic Energy Act (42 U.S.C. 2274, 2277). Subsection d. of section 234B sets limitations on civil penalties assessed against certain nonprofit entities specified at subsection d. of section 234A (hereafter the ``named contractors''). For each of the named contractors, the statute provides that no civil penalty may be assessed until the entity enters into a new contract with DOE after October 5, 1999 (the date of enactment) or an extension of a current contract with DOE after October 5, 1999. The statute also limits the total amount of civil penalties assessed against the named contractors in any fiscal year to the total amount of fees paid to that entity in that fiscal year. It should be noted that the limitations applicable to the named contractors also apply to their subcontractors and suppliers regardless of whether they are for-profit or nonprofit. The fee that represents the cap for civil penalties of nonprofits will be determined pursuant to the provisions of the specific contracts covered by the limitation on nonprofits in section 234B.d.(2). DOE has decided not to finalize its proposal to cap civil penalties assessed against other DOE contractors that are nonprofit educational institutions under the United States Internal Revenue Code in the same manner as penalties are capped for the named contractors. The statute identifies only the named contractors as those that should receive this treatment. While Congress gave DOE authority to mitigate civil penalties, DOE has concluded that there is not a strong enough case to warrant using that authority in a categorical fashion to cap these penalties without regard to any other consideration for contractor security violations by entities other than those that Congress determined should have their penalties capped in this fashion. Rather, DOE has concluded that its mitigation authority would be better exercised on a case-by-case basis, taking into account all circumstances, both aggravating and extenuating. The final rule and enforcement policy make clear that DOE plans to exercise that authority to mitigate civil penalties based on many considerations, including an entity's financial circumstances. That should be sufficient to ensure that the civil penalty authority is not exercised in a manner that discourages non-profit institutions from seeking DOE contracts. Finally, our decision is consistent with DOE's proposed regulations for 10 CFR part 851 to implement section 234C of the Atomic Energy Act (civil penalties for worker health and safety violations), the most recent legislation providing DOE civil penalty authority. DOE also has determined on a somewhat different approach from the one in the proposed rule for allocating responsibility among various DOE officials for the performance of certain administrative responsibilities relating to the imposition of civil penalties, including issuance of the preliminary notice of violation, issuance of final notice of violation, and settlement of enforcement actions. DOE's NOPR called for all of these responsibilities to be carried out by the Deputy Secretary on the recommendation of the Director of the Office of Security. DOE has concluded that there is no compelling reason for making the Deputy Secretary responsible for these functions in the first instance. Moreover, DOE believes it is desirable to make the procedures for part 824 consistent with the procedural framework in 10 CFR part 820 (civil penalties for nuclear safety violations) and the proposed part 851 regulations (civil penalties for worker health and safety violations). In both those frameworks, a DOE official subordinate to the Secretary and the Deputy Secretary is the official charged with initiating enforcement and related responsibilities in the case of non-NNSA contractors; in the case of NNSA contractors, the subordinate DOE official makes a recommendation to the NNSA Administrator, who then determines whether or not to accept that recommendation. In the case of a dispute between the responsible DOE official and the NNSA Administrator, the matter may be referred to the Deputy Secretary. The part 824 rule adopted today adopts a similar framework, under which the Secretary designated a subordinate DOE official to carry out the administrative responsibilities in the case of non-NNSA contractors, but in the case of NNSA contractors this official makes a recommendation to the [[Page 3602]] NNSA Administrator who decides whether or not to accept that recommendation. If the NNSA Administrator disagrees with the cognizant DOE official's recommendation, and the disagreement cannot be resolved by the two officials, the DOE official may refer the matter to the Deputy Secretary for resolution. The Secretary of Energy has approved this notice of final rulemaking for publication. II. DOE's Response to Comments The following discussion describes the major issues raised in comments, provides DOE's response to these comments, and sets forth or describes any resulting changes to the rule. DOE has also made a few editorial, stylistic and format changes for clarity and consistency, but DOE does not describe them in detail because they do not substantially change the terms of the proposed regulations. A. Enforcement Policy A number of commenters argued that DOE's proposed enforcement program under section 234B was deficient in that it lacked an important feature of 10 CFR part 820, a general enforcement policy statement. Without a statement of general enforcement policy, these commenters viewed the proposed regulations as vague and thus susceptible to uneven, or unduly harsh application. Commenters feared that this could mean that a single inadvertent mis-classification of a document might result in a civil penalty. Based on consideration of these comments, DOE has included in today's final regulations ``Appendix A to Part 824--General Statement of Enforcement Policy,'' which is closely modeled after ``Appendix A to Part 820.'' Appendix A to part 824 includes the following important features of the part 820 model: 1. Severity Levels Violations of DOE classified information security requirements have varying degrees of security significance. Therefore, the security significance of each violation is to be identified as the first step in the enforcement process. Violations of DOE classified information security requirements are categorized in three levels of severity. These levels are discussed in section V. of appendix A to this part. Table 1.--Severity Level Base Civil Penalties in appendix A provides the base civil penalty amount for each level of violation. 2. Incentives for Both Timely Identification of Potential Noncompliances and Conducting Appropriate Corrective Actions Many comments were received regarding the overall fairness of the proposed regulations and the need to ensure a consistent and equitable enforcement process. Appendix A specifically states that DOE's goal in the compliance arena is to enhance and protect the common defense and security at DOE facilities by fostering a culture among both DOE line organizations and contractors that actively seeks not only to attain compliance with DOE classified information security requirements but also to sustain it. The DOE enforcement program and policy has been developed with the express purpose of achieving a culture committed to the best possible security at DOE's facilities. Appendix A sets out substantial incentives to the contractors for the early self-identification, reporting and prompt correction of problems which constitute, or could lead to, violations. Thus, the application of adjustment factors may result in no civil penalty being assessed for violations that are identified, reported and promptly and effectively corrected by the contractor. On the other hand, ineffective programs for problem identification and correction are unacceptable. For example, if a contractor fails to disclose and promptly correct violations of which it should be aware or should have been aware, substantial civil penalties are warranted and may be sought, including the assessment of civil penalties for continuing violations on a per day basis. B. Timing of the Regulations DOE received several comments that expressed the view that these regulations are premature principally because DOE is imposing new security standards by this rulemaking and contractors deserve additional funding and time to meet these new standards. DOE disagrees with these comments. No new DOE classified information security requirements are being imposed on contractors by these regulations themselves, which only set up the policies and procedures for an enforcement program that may impose civil penalties for requirements established elsewhere. C. Contract Issues 1. Applicability to Violations Prior to Effective Date Several comments objected to civil penalties applying to violations that occurred prior to the effective date of these regulations, 30 days after the date of this publication. Paragraph (b) of section 3147 of the National Defense Authorization Act for Fiscal Year 2000 specifically states that ``[s]ubsection a. of section 234B of the Atomic Energy Act * * * applies to any violation after the date of enactment of this Act.'' Congress specified a different effective date for the application of civil penalties against nonprofit contractors listed in section 234A.d. (after entry into a new contract or extension of a current contract), but did not provide a similar limitation with respect to other DOE contractors. 2. Limitation of Liability for Nonprofits Two issues were raised with respect to the limitation of liability for nonprofits in proposed Sec. 824.2(b). This section would implement subsection d. of section 234B that sets limitations on civil penalties assessed against certain entities specified at subsection d. of section 234A. Some commenters argued that the cap on civil penalties, specifying that the total amount of civil penalties imposed may not exceed the fee for that fiscal year, should apply to all contractors. For reasons similar to those noted above for not finalizing its proposed approach of extending this limitation to all non-profits, DOE has not accepted this position. Rather it has concluded that it should not broaden the category of contractors to whom this limitation applies beyond the specific list identified by Congress. As DOE explained, in all other instances, it will evaluate mitigation on a case-by-case basis taking into account all relevant aggravating and mitigating circumstances. The second issue relates to the limitation of liability for subcontractors of nonprofit contractors. Consistent with sections 234A. and 234B., today's final regulations provide at Sec. 824.2(b)(1) that the limitations on liability apply to all subcontractors and suppliers, whether for-profit or nonprofit, of the seven named entities working at the named sites specified in subsection d. of section 234A. Commenters have indicated that this list in section 234A.d. is not current in that some of the named sites are no longer operated by the named contractors. Therefore, these commenters argue that the limitations on liability should extend to all subcontractors and suppliers of any contractor at the named sites. DOE rejects this view on the ground that Congress expressly cross-referenced, in section 234B.d., the section 234A.d. list of exceptions and that any change in that list should be accomplished, if at all, by legislative amendment. [[Page 3603]] 3. Relationship With Fee Reduction Regulations A number of comments expressed the view that DOE needed to clarify the relationship between these regulations and the regulations of DOE's Office of Procurement and Assistance Management that implement paragraph b. of section 234B. That paragraph requires that each DOE contract contain provisions which provide an appropriate reduction in the fees or amounts paid to the contractor under the contract in the event of a violation by the contractor or contractor employee of any rule, regulation or order relating to the security of classified information. Commenters raising this issue were concerned that contractors might be subjected to both a civil penalty and a reduction in fee for one violation. Congress contemplated this possibility when it enacted both subsections a. and b. of section 234B without a requirement to choose between the two. By contrast, in the later enacted section 234C Congress specifically did require DOE to elect between civil and contractual penalties (see section 234C.d.). Consistent with the omission of any such provision in section 234B, today's regulations neither require nor preclude such a choice. 4. Contract Disputes Act Certain contractors commented in favor of implementing section 234B by using the process and procedures in the Contract Disputes Act, 41 U.S.C. 601-613, rather than the procedures in the proposed rule. In DOE's view, the administration of a system for imposition of civil penalties, as required by a statute, does not fall under the purposes of the Contract Disputes Act. Jurisdiction for agency boards of contract appeals, defined at 41 U.S.C. 607(d), consists only of appeals of contracting officer decisions. Section 234B provides that the powers and limitations applicable to the assessment of civil penalties under section 234A shall apply to the assessment of civil penalties under section 234B. Section 234A gives the Secretary the authority to determine, compromise or modify civil penalties to be imposed under section 234A. after opportunity for an agency hearing pursuant to 5 U.S.C. 554, before an administrative law judge appointed pursuant to 5 U.S.C. 3105. Appeals from these determinations may be made to a U.S. court of appeals. 5. Major Fraud Act The applicability of the Major Fraud Act, 41 U.S.C. 256(k), to civil penalty proceedings for security violations was raised by commenters who stated that DOE needs to clarify how that Act relates to investigations into suspected or alleged violations of DOE classified information security requirements. They recommended that DOE issue an interpretation stating that as long as a contractor is exempt by statute from the payment of civil penalties, the Major Fraud Act shall not be considered applicable by reason of the ``monetary penalty'' provision of that act. The Major Fraud Act does not make distinctions in its reimbursement prohibitions for different categories of contractors. Even those contractors that are exempt from civil penalties under other statutory or regulatory authority are subject to the reimbursement prohibitions of the Major Fraud Act. In other words, once a government-initiated proceeding has commenced which relates to a violation of, or failure to comply with, a law or regulation, the Act's restrictions apply to investigation proceeding costs, even if the outcome of the proceeding cannot be the actual payment of a monetary penalty. The cost principle at 48 CFR (FAR) 31.205-47, which implements the Act, provides that proceeding costs not made unallowable may be reimbursed, but only to the extent that the amounts of such costs do not exceed 80% of the reasonable and allocable proceeding costs incurred by a contractor. 6. Statute of Limitations Some commenters argued that without a ``statute of limitations'' a Management and Operating (M&O) contractor might be held liable for the acts or omissions of a former M&O contractor at a DOE site thus nullifying DEAR 970.5231-4 ``Preexisting Conditions'' which currently provides some protection to contractors new to a facility. DOE's experience with Part 820 regarding nuclear safety violations has not indicated that the absence of a ``statute of limitations'' provision is a problem. DOE will adopt a common sense approach in applying Part 824 and not penalize an M&O contractor for the acts or omissions of a predecessor unless the new contractor knows or should reasonably know that a violation exists. Also, one of the provisions in the ``Preexisting Conditions'' clause places a duty on the new contractor to inspect the facility and timely identify to the contracting officer conditions which could give rise to a liability. D. Applicability DOE has revised proposed Sec. Sec. 824.2 (``Applicability'') and 824.3 (``Definitions'') to address comments requesting clarification of the applicability of the regulations. These comments expressed the view that the regulations were vague and overly broad. DOE agrees that more precise language in two places in these two subsections is warranted. One comment pointed out that proposed Sec. 824.2(a) was too broad in that it made the regulations applicable to ``any entity that is subject to DOE security requirements for the protection of classified information.'' This exceeds the authority conferred by the statute, which is limited to contractors and subcontractors of the Department. Section 824.2(a), as published today, tracks the language of section 234B which states that the regulations apply to any person that has entered into a contract or agreement with DOE, or a subcontract or subagreement thereto. Also, in response to comments raising questions about the applicability of the proposed regulations to the National Nuclear Security Administration (NNSA), Sec. 824.3 now contains a definition of the ``Department of Energy.'' This definition clarifies that these regulations are applicable to contractors of all components of DOE, including the NNSA. E. Definitions In addition to adding a definition of the term ``Department of Energy'' discussed in section D of this supplementary information, DOE has made other changes in the definitions in Sec. 824.3, in response to the comments or for purposes of clarification. DOE has revised the definition of the term ``classified information'' in response to a comment to track more clearly the language in the definition of that term in Executive Order 12958, as amended on March 25, 2003. We have deleted the definition of the term ``contractor'' because the term is not actually used in the operational sections of the regulation. Finally, we also have revised the definition of the term ``Director'' and, as revised, the term means ``the DOE Official, or his or her designee, to whom the Secretary has assigned responsibility for enforcement under this part.'' DOE did not accept the comment that the definition of the term ``person'' is too broad in that it includes parents and affiliates of a contractor. Those making this comment argued that extending liability to parents and affiliates goes beyond what is permitted by section 234B and that this extension of liability is unfair. DOE disagrees. The last sentence of the definition of the term ``person'' in Sec. 820.2, the DOE nuclear safety regulations implementing section 234A, states that, for purposes of civil [[Page 3604]] penalty assessment, the term also includes affiliated entities, such as a parent corporation. Section 234B.c. states that the powers and limitations applicable to the assessment of civil penalties under section 234A, with certain exceptions pertaining to the nonprofit entities identified at subsection d. of that section, shall apply to the assessment of civil penalties under section 234B. Therefore, DOE believes that a broad definition of the term ``person'' is appropriate. F. Sources of Classified Information Protection Requirements It was clear to DOE from a number of comments received about the proposed scope of the regulations that DOE should revise Sec. 824.4 (Civil penalties'') to identify more clearly the DOE security requirements covered by these regulations. In response to one comment, DOE has incorporated language that specifies that Sec. 824.4 applies only to acts or omissions related to ``classified information protection'' requirements, rather than security requirements more generally. DOE agrees with the comment that the reference to 10 CFR part 1046 ``Physical Protection of Security Interests'' should not be included in Sec. 824.4. Section 234B makes civil penalties applicable to classified information protection requirements, not requirements for the DOE protective force, such as medical and physical fitness standards. The two remaining DOE regulations, 10 CFR part 1016 (``Safeguarding of Restricted Data'') and 10 CFR part 1045 (``Nuclear Classification and Declassification'') are the only current DOE regulations containing classified information protection requirements whose violation is a predicate for civil penalties under today's rule. DOE received one comment that DOE should impose civil penalties only for violations of regulations promulgated in accordance with the Administrative Procedure Act (APA), 5 U.S.C. 551 et seq., and of those DOE orders and other documents in the DOE Directive System specifically identified in the contractor's contract with DOE. Other commenters argued that no civil penalties should arise out of the violation of any classified information protection requirement except a requirement set forth in a DOE regulation. In some cases, the commenters did not indicate why DOE should exclude violations of DOE orders as the grounds for assessing a civil penalty. Commenters who did say why they opposed including DOE orders argued that inclusion: (1) Would make the proposed regulations overly broad; (2) would not provide contractors with adequate notice of what requirements DOE intended to enforce with civil penalties; and (3) would differ from DOE's enforcement policy in 10 CFR part 820 which implements section 234A of the Act with respect to nuclear safety violations. In the rule adopted today, DOE has revised the language of the proposed rule to clarify the extent to which civil penalties will be imposed for violations of requirements in DOE orders or manuals as well as for violations of compliance orders. Specifically, Sec. 824.4(a) and (b) have been rewritten to read as follows: Section 824.4 Civil Penalties (a) Any person who violates a classified information protection requirement of any of the following is subject to a civil penalty under this part: (1) 10 CFR part 1016--Safeguarding of Restricted Data; (2) 10 CFR part 1045--Nuclear Classification and Declassification; or (3) Any other DOE regulation or rule (including any DOE order or manual enforceable against the contractor or subcontractor under a contractual provision in that contractor's or subcontractor's contract) related to the safeguarding or security of classified information if the regulation or rule provides that violation of its provisions may result in a civil penalty pursuant to subsection a. of section 234 B. of the Act. (b) If, without violating any regulation or rule under paragraph (a) of this section, a person by any act or omission jeopardizes the security of classified information, the Secretary may issue a compliance order to that person requiring that person to take corrective action and notifying the person that violation of the compliance order is subject to a notice of violation and assessment of a civil penalty. If a person wishes to contest that compliance order, the person must file a notice of appeal with the Secretary within 15 days of receipt of the compliance order.'' DOE believes that this approach appropriately carries out the Congressional policy set out in section 234B. Section 234B stressed two considerations in determining whether a civil penalty should be imposed: the status of the entity on whom the penalty might be imposed as a contractor or subcontractor, and the violation by that entity of an ``applicable rule, regulation or order prescribed or otherwise issued by the Secretary pursuant to this Act relating to the safeguarding or security of Restricted Data or other classified information.'' DOE's security orders and manuals are rules within the meaning of the APA (5 U.S.C. 551(4)). In light of these two considerations, DOE believes the statute is best carried out, with respect to orders and directives, by applying it to violations of those that are applicable to the contractor by virtue of its contract and that provide for the imposition of civil penalties, as well as to violations of any applicable regulations. DOE believes that the revised language should resolve contractor concerns about vagueness and uncertainty as to what are the sources for classified information control requirements that may give rise to violations subject to civil penalties. Certain commenters feared that they might be penalized for violations of verbal, e-mail or other guidance in documents that supplemented DOE orders or manuals. Today's rule makes clear that the contractor will have fair notice since DOE only intends to enforce by civil penalties the provisions of a DOE order or manual enforceable against the contractor under its contract that provides that violations of its classified information protection provisions may result in a civil penalty. DOE considers it the responsibility of its contractors to ``flow down'' to their subcontractors and suppliers the requirements of those orders and directives to which civil penalties apply. In today's rule, DOE is departing from the practice under 10 CFR part 820 regarding the imposition of civil penalties for of nuclear safety violations. Part 820 limits the scope of penalty-bearing nuclear safety requirements to those published in the CFR or set forth in compliance orders. DOE has not taken the step of departing from the approach taken in part 820 lightly. However, DOE does not believe that it can fully implement the kind of comprehensive security enforcement program that both Congress and DOE believe is required for the protection of sensitive national security interests without inclusion of relevant DOE orders and manuals. In the security area, DOE and its predecessor agencies have historically imposed requirements on contractors by internal directives rather than codified regulations. While more may be done by regulation in the future, the current reality is that many significant DOE security requirements are not promulgated by regulation. To fully carry out the program Congress contemplated in light of the serious security issues that face us today, DOE believes it should include provisions in orders and manuals enforceable against the contractor under its contract that [[Page 3605]] provide that their violation carries with it the risk of a civil penalty, thereby allowing it to impose civil penalties for such violations in appropriate circumstances. G. Standard for Violation Several commenters asserted that the language of proposed Sec. 824.4(b) was too vague and overly broad in that it stated that the Secretary may issue a compliance order if a person by act or omission ``jeopardizes'' the security of classified information. DOE agrees with this comment and has modified that provision to track the language of a comparable provision in part 820. The sentence now states that the Secretary may issue a compliance order if a person by act or omission causes, or creates a risk of, the loss, compromise or unauthorized disclosure of classified information. DOE did not accept the comment made by a number of contractors that civil penalties should be assessed only if there is actual loss or compromise of classified information, not just the threat of the loss or compromise. DOE believes this takes an overly narrow view of its contractors' and its own obligations to protect classified information. If a contractor by its acts or omissions places classified information at risk, that contractor has already failed to live up to those obligations. To the extent actual compromise is relevant, it is relevant in the context of the exercise of enforcement discretion. As stated in the enforcement policy at appendix A, DOE may exercise that discretion not to assess a civil penalty or to mitigate the civil penalty under appropriate circumstances, when, for example, the contractor self reports and takes corrective actions. H. Continuing Violations DOE received several comments asserting that section 234B does not specify that a violation that is a continuing violation must constitute a separate violation for purposes of computing the civil penalty. DOE disagrees. Section 234B.c. cross-references section 234A which provides in subsection a. that if any violation is a continuing one, each day of such violation shall constitute a separate violation for the purpose of computing the applicable civil penalty. Consistent with subsection b. of section 234A, which is also picked up by section 234B's cross- reference, DOE does have authority to address inequities that may arise from this through its authority to compromise, modify or remit a penalty. It anticipates that it will exercise that authority based on mitigating factors in Sec. 824.13 and the general enforcement policy in appendix A if the contractor exercises due diligence in identifying and correcting security problems. But as an initial matter, under the statutory provision as Congress enacted it, DOE believes that the cross-reference has the effect of defining each day of violation as a separate violation. DOE also received comments seeking clarification of when a civil penalty will begin, i.e., the date the violation is noticed or first occurred, and when will it end. The civil penalty begins on the date the act or omission that gives rise to the violation first occurred, but in no case before October 5, 1999. It ends when corrective action has been completed. I. Preliminary Notice of Violation DOE has revised proposed Sec. 824.5, ``Notice of violation.'' DOE revised the rule to accommodate comments objecting to the use of criminal law enforcement terminology in the preliminary notice of a civil violation. Specifically, commenters objected to the words ``accused'' and ``charged.'' Therefore, the preliminary notice of violation will notify the person of the date, facts, and nature of each act or omission, ``constituting the alleged violation,'' not ``with which the person is charged.'' Section 824.6(d) now refers to a person ``notified of an alleged violation,'' rather than ``accused of a violation.'' In response to numerous comments, DOE has also decided that Sec. Sec. 824.6 and 824.7 in this final rule should more closely follow the procedures in part 820 with which DOE contractors are familiar. Therefore, DOE has replaced procedures regarding a ``notice of violation'' in proposed Sec. 824.5 with more extensive and detailed procedures regarding a ``preliminary notice of violation'' and a ``final notice of violation'' in Sec. Sec. 824.6 and 824.7. These sections set forth more precisely the responsibilities of both the agency and the recipient of either type of notice and the effect of various actions by the agency or the recipient. J. Discovery The one comment DOE received regarding discovery argued that a contractor should have equal rights with the agency. More specifically, the comment suggested that the authority of the Deputy Secretary to issue subpoenas in Sec. 824.5 should be deleted and that language should be added to Sec. 824.10(d) to provide that the Hearing Officer may issue subpoenas on behalf of the contractor. DOE has accepted this comment with respect to the Hearing Officer's authority, but DOE believes that the officials responsible for the administration of the civil penalty rule also should possess the authority to issue subpoenas since, for example, there may be a need to issue subpoenas in the investigatory stage of a case prior to a hearing. As discussed above in section I, while the NOPR called for the Deputy Secretary to carry out the administrative responsibilities under part 824 in the case of both non-NNSA contractors and NNSA contractors, the final rule makes a subordinate DOE official designated by the Secretary responsible for exercising the rule's procedural functions when non-NNSA contractors are involved, and the Administrator of NNSA, on the recommendation of the Director, responsible for exercising the rule's principal procedural functions when NNSA contractors are involved. K. Burden of Proof One comment suggested that DOE revise proposed Sec. 824.7 to make clear that the purpose of the hearing is not for the contractor ``to answer under oath or affirmation'' the allegations. DOE agrees and the proposed section, renumbered Sec. 824.8 now states that any person who receives a final notice of violation under Sec. 824.7 may request a hearing concerning the allegations contained in that notice. Another comment stated that proposed Sec. 824.11(e) should provide that DOE not only has the burden of proving, by a preponderance of the evidence, that a violation has occurred, but also the appropriateness of the amount of the proposed civil penalty. DOE has accepted this comment and revised what is now Sec. 824.12(e) to track the language of 10 CFR part 820.29(d) with which contractors are familiar. Section 824.12(e) now reads as follows: ``DOE has the burden of going forward with and of proving by a preponderance of the evidence that the violation occurred as set forth in the final notice of violation and that the proposed civil penalty is appropriate. The person to whom the final notice of violation has been addressed has the burden of presenting and of going forward with any defense to the allegations set forth in the final notice of violation. Each matter of controversy shall be determined by the Hearing Officer upon a preponderance of the evidence.'' L. Classified Evidence at the Hearing One comment objected on due process grounds to language that could be interpreted to mean that the Hearing Officer could exclude pertinent testimony from the hearing if the [[Page 3606]] testimony is classified. This was not DOE's intent, and DOE has revised proposed Sec. 824.11(d) to clarify how the Hearing Officer is to treat classified information and other information protected from public disclosure by law or regulation. Section 824.12(d) now provides as follows: ``The Hearing Officer must use procedures appropriate to safeguard and prevent unauthorized disclosure of classified information or any other information protected from public disclosure by law or regulation, with minimum impairment of rights and obligations under this part. The classified or otherwise protected status of any information shall not, however, preclude its being introduced into evidence. The Hearing Officer may issue such orders as may be necessary to consider such evidence in camera, including the preparation of a supplemental initial decision to address issues of law or fact that arise out of that portion of the evidence that is classified or otherwise protected.'' M. Mitigation Section 824.13 sets out the mitigating factors that the Hearing Officer will consider in determining the amount of the civil penalty. The mitigating factors listed are identical to those in section 234A of the Act, since section 234B provides that, ``the powers and limitations applicable to the assessment of civil penalties under section 234A shall apply.'' DOE has added the general enforcement policy at appendix A to explain further how DOE intends to determine the amount of a civil penalty and what actions a contractor may take to influence that penalty. DOE believes that Sec. 824.13, combined with appendix A, adequately addresses all appropriate mitigation factors. Accordingly, DOE has rejected comments urging that such factors as lack of funding or intentional misconduct of an employee be added to the list in Sec. 824.13. N. Final Agency Action and Judicial Review DOE received one comment suggesting that the proposed regulations should be amended to specify clearly when the agency's final action has occurred in order for the contractor to calculate the deadline for seeking judicial review of the agency's action. DOE has revised the regulations to expand and clarify the stages in the enforcement process, including what constitutes a final order enforceable against a person (see Sec. Sec. 824.7 and 824.13). Additionally, although the proposed regulations provided that judicial review of a Hearing Officer's initial decision would be available only after a party appealed that decision to the Secretary, the final regulations do not provide for a losing party to appeal the Hearing Officer's initial decision to the Secretary. Instead, the regulations permit the Secretary, at his discretion, within thirty days after the Hearing Officer files the initial decision, to review the initial decision and file a final order. If the Secretary does not choose to review the initial decision within 30 days of its filing, then it becomes a final agency action. O. Miscellaneous One comment sought clarification as to whether DOE Headquarters and a DOE local office could each assess a penalty for the same offense. Only DOE Headquarters has authority to assess civil penalties. DOE received one comment asking whether security violations revealed during audits and inspections may give rise to civil penalties. Audits and inspections may form the basis for an allegation or finding of violation under part 824, just as is the case with respect to nuclear safety violations under part 820. III. Regulatory Review and Procedural Requirements A. Review Under Executive Order 12866 Today's regulatory action has been determined not to be a ``significant regulatory action'' under Executive Order 12866, ``Regulatory Planning and Review,'' (58 FR 51735, October 4, 1993). Accordingly, today's action was not subject to review under the Executive Order by the Office of Information and Regulatory Affairs of the Office of Management and Budget. B. Review Under the Regulatory Flexibility Act The rule was reviewed under the Regulatory Flexibility Act of 1980, Public Law 96-354, which requires preparation of an initial regulatory flexibility analysis for any rule that is likely to have significant economic impact on a substantial number of small entities. This rulemaking applies principally to large entities who are M&O contractors and establishes procedures but does not itself impose costs on the contractors or subcontractors. Therefore, DOE certifies that this regulation will not have a significant economic impact on a substantial number of small entities and, therefore, no regulatory flexibility analysis has been prepared. C. Review Under the Paperwork Reduction Act No new information or record keeping requirements are imposed by this rulemaking. Accordingly, no Office of Management and Budget clearance is required under the Paperwork Reduction Act. (44 U.S.C. 3501 et seq.) D. Review Under the National Environmental Policy Act DOE has concluded that promulgation of this rule falls into a class of actions that would not individually or cumulatively have a significant impact on the human environment, as determined by DOE's regulations implementing the National Environmental Policy Act of 1969 (42 U.S.C. 4321 et seq.). Specifically, this rule deals only with agency procedures, and, therefore is covered under the Categorical Exclusion in paragraph A6 to subpart D, 10 CFR part 1021. Accordingly, neither an environmental assessment nor an environmental impact statement is required. E. Review Under Executive Order 12988 With respect to the promulgation of new regulations, section 3(a) of Executive Order 12988, ``Civil Justice Reform,'' 61 FR 4729 (February 7, 1996) imposes on Executive agencies the general duty to: (1) Eliminate drafting errors and ambiguity; (2) write regulations to minimize litigation; and (3) provide a clear legal standard for affected conduct rather than a general standard and to promote simplification and burden reduction. With regard to the review required by section 3(a), section 3(b) of Executive Order 12988 specifically requires that Executive agencies make every reasonable effort to ensure that a regulation: (1) Clearly specifies its preemptive effect, if any; (2) clearly specifies any effect on existing federal law or regulation; (3) provides a clear legal standard for affected conduct while promoting simplification and burden reduction; (4) specifies its retroactive effect, if any; (5) adequately defines key terms; and (6) addresses other important issues affecting clarity and general draftsmanship under any guidelines issued by the Attorney General. Section 3(c) of Executive Order 12988 requires Executive agencies to review regulations in light of the applicable standards in section 3(a) and 3(b) to determine whether they are met or if it is unreasonable to meet one or more of them. DOE has completed the required reviews and has determined that, to the extent allowed by law, the rule meets the relevant standards of Executive Order 12988. [[Page 3607]] F. Review Under Executive Order 13132 Executive Order 13132 (64 FR 43255, August 4, 1999) imposes certain requirements on agencies formulating and implementing policies or regulations that preempt State law or that have federalism implications. Agencies are required to examine the constitutional and statutory authority supporting any action that would limit the policymaking discretion of the States and carefully assess the necessity for such actions. DOE has examined today's rule and has determined that it does not preempt State law and does not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. No further action is required by Executive Order 13132. G. Review Under Treasury and General Government Appropriations Act, 1999 Section 654 of the Treasury and General Government Appropriations Act, 1999 (Public Law 105-277) requires Federal agencies to issue a Family Policymaking Assessment for any proposed rule that may affect family well-being. Today's rulemaking would not have any impact on the autonomy or integrity of the family as an institution. Accordingly, DOE has not prepared a family policymaking assessment. H. Review Under the Treasury and General Government Appropriations Act, 2001 The Treasury and General Government Appropriations Act, 2001 (44 U.S.C. 3516, note) provides for agencies to review most dissemination of information to the public under guidelines established by each agency pursuant to general guidelines issued by OMB. OMB's guidelines were published at 67 FR 8452 (Feb. 22, 2002), and DOE's guidelines were published at 67 FR 62446 (Oct 7, 2002). DOE has reviewed today's notice under the OMB and DOE guidelines, and has concluded that is consistent with applicable policies in those guidelines. I. Review Under Executive Order 13084 Under Executive Order 13084 (Consultation and Coordination with Indian Tribal Governments), DOE may not issue a discretionary rule that significantly or uniquely affects Indian tribal governments and imposes substantial direct compliance costs. This rulemaking would not have such effects. Accordingly, Executive Order 13084 does not apply to this rulemaking. J. Review Under the Unfunded Mandates Reform Act of 1995 Title II of the Unfunded Mandates Reform Act of 1995 requires each agency to prepare a written assessment of the effects of any Federal mandate in a proposed or final rule that may result in the expenditure by State, local, and tribal governments and the private sector, of $100 million in any single year. DOE has determined that today's regulatory action does not impose a Federal mandate on State, local, or tribal governments or on the private sector. K. Review Under Executive Order 13211 Executive Order 13211, ``Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution or Use'' (66 FR 28355, May 22, 2001) requires Federal agencies to prepare and submit to the Office of Information and Regulatory Affairs (OIRA), Office of Management and Budget, a Statement of Energy Effects for any proposed significant energy action. A ``significant energy action'' is defined as any action by an agency that promulgated or is expected to lead to promulgation of a final rule, and that: (1) Is a significant regulatory action under Executive Order 12866, or any successor order; and (2) is likely to have a significant adverse effect on the supply, distribution, or use of energy, or (3) is designated by the Administrator of OIRA as a significant energy action. For any proposed significant energy action, the agency must give a detailed statement of any adverse effects on the energy supply, distribution, or use should the proposal be implemented, and of reasonable alternatives to the action and their expected benefits on energy supply, distribution, and use. Today's regulatory action is not a significant energy action. Accordingly, DOE has not prepared a Statement of Energy Effects. L. Congressional Notification As required by 5 U.S.C. 801, DOE will report to Congress promulgation of the rule prior to its effective date. The report will state that it has been determined that the rule is not a ``major rule'' as defined by 5 U.S.C. 804. List of Subjects in 10 CFR Part 824 Government contracts, Nuclear materials, Penalties, Security measures. Issued in Washington, DC on January 18, 2005. Glenn S. Podonsky, Director, Office of Security and Safety Performance Assurance. 0 For the reasons set forth in the preamble, DOE hereby amends chapter III of title 10 of the Code of Federal Regulations by adding a new part 824 as set forth below. PART 824--PROCEDURAL RULES FOR THE ASSESSMENT OF CIVIL PENALTIES FOR CLASSIFIED INFORMATION SECURITY VIOLATIONS Sec. 824.1 Purpose and scope. 824.2 Applicability. 824.3 Definitions. 824.4 Civil penalties. 824.5 Investigations. 824.6 Preliminary notice of violation. 824.7 Final notice of violation. 824.8 Hearing. 824.9 Hearing Counsel. 824.10 Hearing Officer. 824.11 Rights of the person at the hearing. 824.12 Conduct of the hearing. 824.13 Initial decision. 824.14 Special procedures. 824.15 Collection of civil penalties. 824.16 Direction to NNSA contractors. Appendix A to part 824--general statement of enforcement policy Authority: 42 U.S.C. 2201, 2282b, 7101 et seq., 50 U.S.C. 2401 et seq. Sec. 824.1 Purpose and scope. This part implements subsections a., c., and d. of section 234B. of the Atomic Energy Act of 1954 (the Act), 42 U.S.C. 2282b. Subsection a. provides that any person who has entered into a contract or agreement with the Department of Energy, or a subcontract or subagreement thereto, and who violates (or whose employee violates) any applicable rule, regulation or order under the Act relating to the security or safeguarding of Restricted Data or other classified information, shall be subject to a civil penalty not to exceed $100,000 for each violation. Subsections c. and d. specify certain additional authorities and limitations respecting the assessment of such penalties. Sec. 824.2 Applicability. (a) General. These regulations apply to any person that has entered into a contract or agreement with DOE, or a subcontract or sub- agreement thereto. (b) Limitations. DOE may not assess any civil penalty against any entity (including subcontractors and suppliers thereto) specified at subsection d. of section 234A of the Act until the entity enters, after October 5, 1999, into a new contract with DOE or an extension of a current contract with DOE, and the total amount of civil penalties may not exceed the total amount of fees paid by the DOE to that entity in that fiscal year. (c) Individual employees. No civil penalty may be assessed against a [[Page 3608]] person which enters into an agreement with DOE. Sec. 824.3 Definitions. As used in this part: Act means the Atomic Energy Act of 1954 (42 U.S.C. 2011 et seq.). Administrator means the Administrator of the National Nuclear Security Administration. Classified information means Restricted Data and Formerly Restricted Data protected against unauthorized disclosure pursuant to the Act and National Security Information that has been determined pursuant to Executive Order 12958, as amended March 25, 2003, or any predecessor or successor executive order to require protection against unauthorized disclosure and that is marked to indicate its classified status when in documentary form. DOE means the United States Department of Energy, including the National Nuclear Security Administration. Director means the DOE Official, or his or her designee, to whom the Secretary has assigned responsibility for enforcement of this part. Person means any person as defined in section 11.s. of the Act, 42 U.S.C. 2014, and includes any affiliate or parent corporation thereof, who enters into a contract or agreement with DOE, or is a party to a contract or subcontract under a contract or agreement with DOE. Secretary means the Secretary of Energy. Sec. 824.4 Civil penalties. (a) Any person who violates a classified information protection requirement of any of the following is subject to a civil penalty under this part: (1) 10 CFR part 1016--Safeguarding of Restricted Data; (2) 10 CFR part 1045--Nuclear Classification and Declassification; or (3) Any other DOE regulation or rule (including any DOE order or manual enforceable against the contractor or subcontractor under a contractual provision in that contractor's or subcontractor's contract) related to the safeguarding or security of classified information if the regulation or rule provides that violation of its provisions may result in a civil penalty pursuant to subsection a. of section 234B. of the Act. (b) If, without violating a classified information protection requirement of any regulation or rule under paragraph (a) of this section, a person by an act or omission causes, or creates a risk of, the loss, compromise or unauthorized disclosure of classified information, the Secretary may issue a compliance order to that person requiring the person to take corrective action and notifying the person that violation of the compliance order is subject to a notice of violation and assessment of a civil penalty. If a person wishes to contest the compliance order, the person must file a notice of appeal with the Secretary within 15 days of receipt of the compliance order. (c) The Director may propose imposition of a civil penalty for violation of a requirement of a regulation or rule under paragraph (a) of this section or a compliance order issued under paragraph (b) of this section, not to exceed $100,000 for each violation. (d) If any violation is a continuing one, each day of such violation shall constitute a separate violation for the purpose of computing the applicable civil penalty. (e) The Director may enter into a settlement, with or without conditions, of an enforcement proceeding at any time if the settlement is consistent with the objectives of DOE's classified information protection requirements. Sec. 824.5 Investigations. The Director may conduct investigations and inspections relating to the scope, nature and extent of compliance by a person with DOE security requirements specified in Sec. 824.4(a) and (b) and take such action as the Director deems necessary and appropriate to the conduct of the investigation or inspection, including signing, issuing and serving subpoenas. Sec. 824.6 Preliminary notice of violation. (a) In order to begin a proceeding to impose a civil penalty under this part, the Director shall notify the person by a written preliminary notice of violation sent by certified mail, return receipt requested, of: (1) The date, facts, and nature of each act or omission constituting the alleged violation; (2) The particular provision of the regulation, rule or compliance order involved in each alleged violation; (3) The proposed remedy for each alleged violation, including the amount of any civil penalty proposed; and, (4) The right of the person to submit a written reply to the Director within 30 calendar days of receipt of such preliminary notice of violation. (b) A reply to a preliminary notice of violation must contain a statement of all relevant facts pertaining to an alleged violation. The reply must: (1) State any facts, explanations and arguments which support a denial of the alleged violation; (2) Demonstrate any extenuating circumstances or other reason why a proposed remedy should not be imposed or should be mitigated; (3) Discuss the relevant authorities which support the position asserted, including rulings, regulations, interpretations, and previous decisions issued by DOE; (4) Furnish full and complete answers to any questions set forth in the preliminary notice; and (5) Include copies of all relevant documents. (c) If a person fails to submit a written reply within 30 calendar days of receipt of a preliminary notice of violation: (1) The person relinquishes any right to appeal any matter in the preliminary notice; and (2) The preliminary notice, including any remedies therein, constitutes a final order. (d) The Director, at the request of a person notified of an alleged violation, may extend for a reasonable period the time for submitting a reply or a hearing request letter. Sec. 824.7 Final notice of violation. (a) If a person submits a written reply within 30 calendar days of receipt of a preliminary notice of violation, the Director must make a final determination whether the person violated or is continuing to violate a classified information security requirement. (b) Based on a determination by the Director that a person has violated or is continuing to violate a classified information security requirement, the Director may issue to the person a final notice of violation that concisely states the determined violation, the amount of any civil penalty imposed, and further actions necessary by or available to the person. The final notice of violation also must state that the person has the right to submit to the Director, within 30 calendar days of the receipt of the notice, a written request for a hearing under Sec. 824.8 or, in the alternative, to elect the procedures specified in section 234A.c.(3) of the Act, 42 U.S.C. 2282a.c.(3). (c) The Director must send a final notice of violation by certified mail, return receipt requested, within 30 calendar days of the receipt of a reply. (d) Subject to paragraphs (h) and (i) of this section, the effect of final notice shall be: (1) If a final notice of violation does not contain a civil penalty, it shall be deemed a final order 15 days after the final notice is issued. (2) If a final notice of violation contains a civil penalty, the person must submit to the Director within 30 days after the issuance of the final notice: [[Page 3609]] (i) A waiver of further proceedings; (ii) A request for an on-the-record hearing under Sec. 824.8; or (iii) A notice of intent to proceed under section 234A.c.(3) of the Act, 42 U.S.C. 2282a.(c)(3). (e) If a person waives further proceedings, the final notice of violation shall be deemed a final order enforceable against the person. The person must pay the civil penalty set forth in the notice of violation within 60 days of the filing of waiver unless the Director grants additional time. (f) If a person files a request for an on-the-record hearing, then the hearing process commences. (g) If the person files a notice of intent to proceed under section 234A.c.(3) of the Act, 42 U.S.C. 2282a.(c)(3), the Director, by order, shall assess the civil penalty set forth in the Notice of Violation. (h) The Director may amend the final notice of violation at any time before the time periods specified in paragraphs (d)(1) or (d)(2) expire. An amendment shall add fifteen days to the time period under paragraph (d) of this section. (i) The Director may withdraw the final notice of violation, or any part thereof, at any time before the time periods specified in paragraphs (d)(1) or (d)(2) expire. Sec. 824.8 Hearing. (a) Any person who receives a final notice of violation under Sec. 824.7 may request a hearing concerning the allegations contained in the notice. The person must mail or deliver any written request for a hearing to the Director within 30 calendar days of receipt of the final notice of violation. (b) Upon receipt from a person of a written request for a hearing, the Director shall: (1) Appoint a Hearing Counsel; and (2) Select an administrative law judge appointed under section 3105 of Title 5, U.S.C., to serve as Hearing Officer. Sec. 824.9 Hearing Counsel. The Hearing Counsel: (a) Represents DOE; (b) Consults with the person or the person's counsel prior to the hearing; (c) Examines and cross-examines witnesses during the hearing; and (d) Enters into a settlement of the enforcement proceeding at any time if settlement is consistent with the objectives of the Act and DOE security requirements. Sec. 824.10 Hearing Officer. The Hearing Officer: (a) Is responsible for the administrative preparations for the hearing; (b) Convenes the hearing as soon as is reasonable; (c) Administers oaths and affirmations; (d) Issues subpoenas, at the request of either party or on the Hearing Officer's motion; (e) Rules on offers of proof and receives relevant evidence; (f) Takes depositions or has depositions taken when the ends of justice would be served; (g) Conducts the hearing in a manner which is fair and impartial; (h) Holds conferences for the settlement or simplification of the issues by consent of the parties; (i) Disposes of procedural requests or similar matters; (j) Requires production of documents; and (k) Makes an initial decision under Sec. 824.13. Sec. 824.11 Rights of the person at the hearing. The person may: (a) Testify or present evidence through witnesses or by documents; (b) Cross-examine witnesses and rebut records or other physical evidence, except as provided in Sec. 824.12(d); (c) Be present during the entire hearing, except as provided in Sec. 824.12(d); and (d) Be accompanied, represented and advised by counsel of the person's choosing. Sec. 824.12 Conduct of the hearing. (a) DOE shall make a transcript of the hearing; (b) Except as provided in paragraph (d) of this section, the Hearing Officer may receive any oral or documentary evidence, but shall exclude irrelevant, immaterial or unduly repetitious evidence; (c) Witnesses shall testify under oath and are subject to cross- examination, except as provided in paragraph (d) of this section; (d) The Hearing Officer must use procedures appropriate to safeguard and prevent unauthorized disclosure of classified information or any other information protected from public disclosure by law or regulation, with minimum impairment of rights and obligations under this part. The classified or otherwise protected status of any information shall not, however, preclude its being introduced into evidence. The Hearing Officer may issue such orders as may be necessary to consider such evidence in camera including the preparation of a supplemental initial decision to address issues of law or fact that arise out of that portion of the evidence that is classified or otherwise protected. (e) DOE has the burden of going forward with and of proving by a preponderance of the evidence that the violation occurred as set forth in the final notice of violation and that the proposed civil penalty is appropriate. The person to whom the final notice of violation has been addressed shall have the burden of presenting and of going forward with any defense to the allegations set forth in the final notice of violation. Each matter of controversy shall be determined by the Hearing Officer upon a preponderance of the evidence. Sec. 824.13 Initial decision. (a) The Hearing Officer shall issue an initial decision as soon as practicable after the hearing. The initial decision shall contain findings of fact and conclusions regarding all material issues of law, as well as reasons therefor. If the Hearing Officer determines that a violation has occurred and that a civil penalty is appropriate, the initial decision shall set forth the amount of the civil penalty based on: (1) The nature, circumstances, extent, and gravity of the violation or violations; (2) The violator's ability to pay; (3) The effect of the civil penalty on the person's ability to do business; (4) Any history of prior violations; (5) The degree of culpability; and (6) Such other matters as justice may require. (b) The Hearing Officer shall serve all parties with the initial decision by certified mail, return receipt requested. The initial decision shall include notice that it constitutes a final order of DOE 30 days after the filing of the initial decision unless the Secretary files a Notice of Review. If the Secretary files a notice of Notice of Review, he shall file a final order as soon as practicable after completing his review. The Secretary, at his discretion, may order additional proceedings, remand the matter, or modify the amount of the civil penalty assessed in the initial decision. DOE shall notify the person of the Secretary's action under this paragraph in writing by certified mail, return receipt requested. The person against whom the civil penalty is assessed by the final order shall pay the full amount of the civil penalty assessed in the final order within thirty days (30) unless otherwise agreed by the Director. Sec. 824.14 Special procedures. A person receiving a final notice of violation under Sec. 824.7 may elect in writing, within 30 days of receipt of [[Page 3610]] such notice, the application of special procedures regarding payment of the penalty set forth in section 234A.c.(3) of the Act, 42 U.S.C. 2282a(c)(3). The Director shall promptly assess a civil penalty, by order, after the date of such election. If the civil penalty has not been paid within sixty calendar days after the assessment has been issued, the DOE shall institute an action in the appropriate District Court of the United States for an order affirming the assessment of the civil penalty. Sec. 824.15 Collection of civil penalties. If any person fails to pay an assessment of a civil penalty after it has become a final order or after the appropriate District Court has entered final judgment for DOE under Sec. 824.14, DOE shall institute an action to recover the amount of such penalty in an appropriate District Court of the United States. Sec. 824.16 Direction to NNSA contractors. (a) Notwithstanding any other provision of this part, the NNSA Administrator, rather than the Director, signs, issues, serves, or takes the following actions that direct NNSA contractors or subcontractors. (1) Subpoenas; (2) Orders to compel attendance; (3) Disclosures of information or documents obtained during an investigation or inspection; (4) Preliminary notices of violation; and (5) Final notices of violations. (b) The Administrator shall act after consideration of the Director's recommendation. If the Administrator disagrees with the Director's recommendation, and the disagreement cannot be resolved by the two officials, the Director may refer the matter to the Deputy Secretary for resolution. APPENDIX A TO PART 824--GENERAL STATEMENT OF ENFORCEMENT POLICY I. Introduction a. This policy statement sets forth the general framework through which DOE will seek to ensure compliance with its classified information security regulations and rules and classified information security-related compliance orders (hereafter collectively referred to as classified information security requirements). The policy set forth herein is applicable to violations of classified information security requirements by DOE contractors and their subcontractors (hereafter collectively referred to as DOE contractors). This policy statement is not a regulation and is intended only to provide general guidance to those persons subject to the classified information security requirements. It is not intended to establish a formulaic approach to the initiation and resolution of situations involving noncompliance with these requirements. Rather, DOE intends to consider the particular facts of each noncompliance situation in determining whether enforcement penalties are appropriate and, if so, the appropriate magnitude of those penalties. DOE reserves the option to deviate from this policy statement when appropriate in the circumstances of particular cases. b. Both the Department of Energy Organization Act, 42 U.S.C. 7101, and the Atomic Energy Act of 1954 (the Act), 42 U.S.C. 2011, require DOE to protect and provide for the common defense and security of the United States in conducting its nuclear activities, and grant DOE broad authority to achieve this goal. c. The DOE goal in the compliance arena is to enhance and protect the common defense and security at DOE facilities by fostering a culture among both DOE line organizations and contractors that actively seeks to attain and sustain compliance with classified information security requirements. The enforcement program and policy have been developed with the express purpose of achieving a culture of active commitment to security and voluntary compliance. DOE will establish effective administrative processes and incentives for contractors to identify and report noncompliances promptly and openly and to initiate comprehensive corrective actions to resolve both the noncompliances themselves and the program or process deficiencies that led to noncompliance. d. In the development of the DOE enforcement policy, DOE believes that the reasonable exercise of its enforcement authority can help to reduce the likelihood of serious security incidents. This can be accomplished by providing greater emphasis on a culture of security awareness in existing DOE operations and strong incentives for contractors to identify and correct noncompliance conditions and processes in order to protect classified information of vital significance to this nation. DOE wants to facilitate, encourage, and support contractor initiatives for the prompt identification and correction of problems. These initiatives and activities will be duly considered in exercising enforcement discretion. e. Section 234B of the Act provides DOE with the authority to impose civil penalties and also with the authority to compromise, modify, or remit civil penalties with or without conditions. In implementing section 234B, DOE will carefully consider the facts of each case of noncompliance and will exercise appropriate judgment in taking any enforcement action. Part of the function of a sound enforcement program is to assure a proper and continuing level of security vigilance. The reasonable exercise of enforcement authority will be facilitated by the appropriate application of security requirements to nuclear facilities and by promoting and coordinating the proper contractor attitude toward complying with those requirements. II. Purpose The purpose of the DOE enforcement program is to promote and protect the common defense and security of the United States by: a. Ensuring compliance by DOE contractors with applicable classified information security requirements. b. Providing positive incentives for a DOE contractor's: (1) Timely self-identification of security deficiencies, (2) Prompt and complete reporting of such deficiencies to DOE, (3) Root cause analyses of security deficiencies, (4) Prompt correction of security deficiencies in a manner which precludes recurrence, and (5) Identification of modifications in practices or facilities that can improve security. c. Deterring future violations of DOE requirements by a DOE contractor. d. Encouraging the continuous overall improvement of operations at DOE facilities. III. Statutory Authority Section 234B of the Act subjects contractors, and their subcontractors and suppliers, to civil penalties for violations of DOE regulations, rules and orders regarding the safeguarding and security of Restricted Data and other classified information. IV. Procedural Framework a. 10 CFR part 824 sets forth the procedures DOE will use in exercising its enforcement authority, including the issuance of notices of violation and the resolution of contested enforcement actions in the event a DOE contractor elects to adjudicate contested issues before an administrative law judge. b. Pursuant to 10 CFR part 824.6, the Director initiates the civil penalty process by issuing a preliminary notice of violation that specifies a proposed civil penalty. The DOE contractor is required to respond in writing to the preliminary notice of violation, either admitting the violation and waiving its right to contest the proposed civil penalty and paying it; admitting the violation, but asserting the existence of mitigating circumstances that warrant either the total or partial remission of the civil penalty; or denying that the violation has occurred and providing the basis for its belief that the preliminary notice of violation is incorrect. After evaluation of the DOE's contractor response, the Director may determine that no violation has occurred; that the violation occurred as alleged in the preliminary notice of violation, but that the proposed civil penalty should be remitted in whole or in part; or that the violation occurred as alleged in the preliminary notice of violation and that the proposed civil penalty is appropriate notwithstanding the asserted mitigating circumstances. In the latter two instances, the Director will issue a final notice of violation or a final notice of violation with proposed civil penalty. c. An opportunity to challenge a proposed civil penalty either before an administrative law judge or in a United States District Court is provided in 42 U.S.C. 2282a(c). Part 824 sets forth the procedures associated with an administrative hearing, should the contractor opt for that method of challenging the proposed civil penalty. [[Page 3611]] V. Severity of Violations a. Violations of classified information security requirements have varying degrees of security significance. Therefore, the relative importance of each violation must be identified as the first step in the enforcement process. Violations of classified information security requirements are categorized in three levels of severity to identify their relative security significance. Notices of violation are issued for noncompliance and propose civil penalties commensurate with the severity level of the violation(s) involved. b. Severity Level I has been assigned to violations that are the most significant and Severity Level III violations are the least significant. Severity Level I is reserved for violations of classified information security requirements which involve actual or high potential for adverse impact on the national security. Severity Level II violations represent a significant lack of attention or carelessness toward responsibilities of DOE contractors for the protection of classified information which could, if uncorrected, potentially lead to an adverse impact on the national security. Severity Level III violations are less serious, but are of more than minor concern: i.e., if left uncorrected, they could lead to a more serious concern. In some cases, violations may be evaluated in the aggregate and a single severity level assigned for a group of violations. c. Isolated minor violations of classified information security requirements will not be the subject of formal enforcement action through the issuance of a notice of violation. However, these minor violations will be identified as noncompliances and tracked to assure that appropriate corrective/remedial action is taken to prevent their recurrence, and evaluated to determine if generic or specific problems exist. If circumstances demonstrate that a number of related minor noncompliances have occurred in the same time frame (e.g., all identified during the same assessment), or that related minor noncompliances have recurred despite prior notice to the DOE contractor and sufficient opportunity to correct the problem, DOE may choose in its discretion to consider the noncompliances in the aggregate as a more serious violation warranting a Severity Level III designation, a notice of violation and a possible civil penalty. d. The severity level of a violation will depend, in part, on the degree of culpability of the DOE contractor with regard to the violation. Thus, inadvertent or negligent violations will be viewed differently from those in which there is gross negligence, deception or willfulness. In addition to the significance of the underlying violation and level of culpability involved, DOE will also consider the position, training and experience of the person involved in the violation. Thus, for example, a violation may be deemed to be more significant if a senior manager of an organization is involved rather than a foreman or non-supervisory employee. In this regard, while management involvement, direct or indirect, in a violation may lead to an increase in the severity level of a violation and proposed civil penalty, the lack of such involvement will not constitute grounds to reduce the severity level of a violation or mitigate a civil penalty. Allowance of mitigation in such circumstances could encourage lack of management involvement in DOE contractor activities and a decrease in protection of classified information. e. Other factors which will be considered by DOE in determining the appropriate severity level of a violation are the duration of the violation, the past performance of the DOE contractor in the particular activity area involved, whether the DOE contractor had prior notice of a potential problem, and whether there are multiple examples of the violation in the same time frame rather than an isolated occurrence. The relative weight given to each of these factors in arriving at the appropriate severity level will depend on the circumstances of each case. f. DOE expects contractors to provide full, complete, timely, and accurate information and reports. Accordingly, the severity level of a violation involving either failure to make a required report or notification to DOE or an untimely report or notification will be based upon the significance of, and the circumstances surrounding, the matter that should have been reported. A contractor will not normally be cited for a failure to report a condition or event unless the contractor was actually aware or should have been aware of the condition or event which it failed to report. VI. Enforcement Conferences a. Should DOE determine, after completion of all assessment and investigation activities associated with a potential or alleged violation of classified information security requirements, that there is a reasonable basis to believe that a violation has actually occurred, and the violation may warrant a civil penalty, DOE will normally hold an enforcement conference with the DOE contractor involved prior to taking enforcement action. DOE may also elect to hold an enforcement conference for potential violations which would not ordinarily warrant a civil penalty but which could, if repeated, lead to such action. The purpose of the enforcement conference is to assure the accuracy of the facts upon which the preliminary determination to consider enforcement action is based, discuss the potential or alleged violations, their significance and causes, and the nature of and schedule for the DOE contractor's corrective actions, determine whether there are any aggravating or mitigating circumstances, and obtain other information which will help determine the appropriate enforcement action. b. DOE contractors will be informed prior to a meeting when that meeting is considered to be an enforcement conference. Such conferences are informal mechanisms for candid pre-decisional discussions regarding potential or alleged violations and will not normally be open to the public. In circumstances for which immediate enforcement action is necessary in the interest of the national security, such action will be taken prior to the enforcement conference, which may still be held after the necessary DOE action has been taken. VII. Enforcement Letter a. In cases where DOE has decided not to issue a notice of violation, DOE may send an enforcement letter to the contractor signed by the Director. The enforcement letter is intended to communicate the basis of the decision not to pursue further enforcement action for a noncompliance. The enforcement letter is intended to point contractors to the desired level of security performance. It may be used when the Director concludes the specific noncompliance at issue is not of the level of significance warranted for issuance of a notice of violation. The enforcement letter will typically describe how the contractor handled the circumstances surrounding the noncompliance and address additional areas requiring the contractor's attention and DOE's expectations for corrective action. The enforcement letter notifies the contractor that, when verification is received that corrective actions have been implemented, DOE will close the enforcement action. In the case of NNSA contractors or subcontractors, the enforcement letter will take the form of advising the contractor or subcontractor that the Director has consulted with the NNSA Administrator who agrees that further enforcement action should not be pursued if verification is received that corrective actions have been implemented by the contractor or subcontractor. b. In many investigations, an enforcement letter may not be required. When DOE decides that a contractor has appropriately corrected a noncompliance or that the significance of the noncompliance is sufficiently low, it may close out an investigation without such enforcement letter. A closeout of a noncompliance with or without an enforcement letter may only take place after the Director has issued a letter confirming that corrective actions have been completed. In the case of NNSA contractors or subcontractors, the Director's letter will take the form of confirming that corrective actions have been completed and advising that the Director has consulted with the NNSA Administrator who agrees that no enforcement action should be pursued. VIII. Enforcement Actions The nature and extent of the enforcement action is intended to reflect the seriousness of the violation involved. For the vast majority of violations for which DOE assigns severity levels as described previously, a notice of violation will be issued, requiring a formal response from the recipient describing the nature of and schedule for corrective actions it intends to take regarding the violation. 1. Notice of Violation a. A Notice of Violation (preliminary or final) is a document setting forth the conclusion that one or more violations of classified information security requirements have occurred. Such a notice normally requires the recipient to provide a written response which may take one of several positions described in Section IV of this policy statement. In the event that the recipient concedes the occurrence of the violation, it is required to describe corrective [[Page 3612]] steps which have been taken and the results achieved; remedial actions which will be taken to prevent recurrence; and the date by which full compliance will be achieved. b. DOE will use the notice of violation as the standard method for formalizing the existence of a possible violation and the notice of violation will be issued in conjunction with the proposed imposition of a civil penalty. In certain limited instances, as described in this section, DOE may refrain from the issuance of an otherwise appropriate notice of violation. However, a notice of violation normally will be issued for willful violations, for violations where past corrective actions for similar violations have not been sufficient to prevent recurrence and there are no other mitigating circumstances. c. DOE contractors are not ordinarily cited for violations resulting from matters not within their control, such as equipment failures that were not avoidable by reasonable quality assurance measures, proper maintenance, or management controls. With regard to the issue of funding, however, DOE does not consider an asserted lack of funding to be a justification for noncompliance with classified information security requirements. Should a contractor believe that a shortage of funding precludes it from achieving compliance with one or more of these requirements, it may request, in writing, an exemption from the requirement(s) in question from the appropriate Secretarial Officer (SO). If no exemption is granted, the contractor, in conjunction with the SO, must take appropriate steps to modify, curtail, suspend or cease the activities which cannot be conducted in compliance with the classified information security requirement(s) in question. d. DOE expects the contractors which operate its facilities to have the proper management and supervisory systems in place to assure that all activities at DOE facilities, regardless of who performs them, are carried out in compliance with all classified information security requirements. Therefore, contractors normally will be held responsible for the acts or omissions of their employees and subcontractor employees in the conduct of activities at DOE facilities. 2. Civil Penalty a. A civil penalty is a monetary penalty that may be imposed for violations of applicable classified information security requirements, including compliance orders. Civil penalties are designed to emphasize the need for lasting remedial action, deter future violations, and underscore the importance of DOE contractor self-identification, reporting and correction of violations. b. Absent mitigating circumstances as described below, or circumstances otherwise warranting the exercise of enforcement discretion by DOE as described in this section, civil penalties will be proposed for Severity Level I and II violations. Civil penalties also will be proposed for Severity Level III violations which are similar to previous violations for which the contractor did not take effective corrective action. ``Similar'' violations are those which could reasonably have been expected to have been prevented by corrective action for the previous violation. DOE normally considers civil penalties only for similar Severity Level III violations that occur over an extended period of time. c. DOE will impose different base level civil penalties considering the severity level of the violation(s). Table 1 shows the daily base civil penalties for the various categories of severity levels. However, as described in Section V, the imposition of civil penalties will also take into account the gravity, circumstances, and extent of the violation or violations and, with respect to the violator, any history of prior similar violations and the degree of culpability and knowledge. d. Regarding the factor of ability of DOE contractors to pay the civil penalties, it is not DOE's intention that the economic impact of a civil penalty is such that it puts a DOE contractor out of business. Contract termination, rather than civil penalties, is used when the intent is to terminate a contractor's management of a DOE facility. The deterrent effect of civil penalties is best served when the amount of such penalties takes this factor into account. However, DOE will evaluate the relationship of entities affiliated with the contractor (such as parent corporations) when it asserts that it cannot pay the proposed penalty. e. DOE will review each case involving a proposed civil penalty on its own merit and adjust the base civil penalty values upward or downward appropriately. As indicated in paragraph 2.c of this section, Table 1 identifies the daily base civil penalty values for different severity levels. After considering all relevant circumstances, civil penalties may be escalated or mitigated based upon the adjustment factors described below in this section. In no instance will a civil penalty for any one violation exceed the $100,000 statutory limit per violation. However, it should be noted that if a violation is a continuing one, under the statute, each day the violation continued constitutes a separate violation for purposes of computing the civil penalty. Thus, the per violation cap will not shield a DOE contractor that is or should have been aware of an ongoing violation and has not reported it to DOE and taken corrective action despite an opportunity to do so from liability significantly exceeding $100,000. Further, as described in this section, the duration of a violation will be taken into account in determining the appropriate severity level of the base civil penalty. Table 1.--Severity level Base Civil Penalties ------------------------------------------------------------------------ Base civil penalty amount (percentage of Severity level maximum civil penalty per violation per day) ------------------------------------------------------------------------ I.................................................... 100 II................................................... 50 III.................................................. 10 ------------------------------------------------------------------------ 3. Adjustment Factors a. DOE's enforcement program is not an end in itself, but a means to achieve compliance with classified information security requirements, and civil penalties are not assessed for revenue purposes, but rather to emphasize the importance of compliance and to deter future violations. The single most important goal of the DOE enforcement program is to encourage early identification and reporting of security deficiencies and violations of classified information security requirements by the DOE contractors themselves rather than by DOE, and the prompt correction of any deficiencies and violations so identified. With respect to their own practices and those of their subcontractors, DOE believes that DOE contractors are in the best position to identify and promptly correct noncompliance with classified information security requirements. DOE expects that these contractors should have in place internal compliance programs which will ensure the detection, reporting and prompt correction of security-related problems that may constitute, or lead to, violations of classified information security requirements before, rather than after, DOE has identified such violations. Thus, DOE contractors are expected to be aware of and to address security problems before they are discovered by DOE. Obviously, protection of classified information is enhanced if deficiencies are discovered (and promptly corrected) by the DOE contractor, rather than by DOE, which may not otherwise become aware of a deficiency until later on, during the course of an inspection, performance assessment, or following an incident at the facility. Early identification of classified information security-related problems by DOE contractors can also have the added benefit of allowing information which could prevent such problems at other facilities in the DOE complex to be shared with other appropriate DOE contractors. b. Pursuant to this enforcement philosophy, DOE will provide substantial incentive for the early self-identification, reporting and prompt correction of problems which constitute, or could lead to, violations of classified information security requirements. Thus, application of the adjustment factors set forth below may result in no civil penalty being assessed for violations that are identified, reported, and promptly and effectively corrected by the DOE contractor. c. On the other hand, ineffective programs for problem identification and correction are unacceptable. Thus, for example, where a contractor fails to disclose and promptly correct violations of which it was aware or should have been aware, substantial civil penalties are warranted and may be sought, including the assessment of civil penalties for continuing violations on a per day basis. d. Further, in cases involving factors of willfulness, repeated violations, patterns of systematic violations, flagrant DOE- identified violations or serious breakdown in management controls, DOE intends to apply its full statutory enforcement authority where such action is warranted. Based on the degree of such factors, DOE may escalate the amount of civil penalties up to the statutory [[Page 3613]] maximum of $100,000 per violation per day for continuing violations. 4. Identification and Reporting Reduction of up to 50% of the base civil penalty shown in Table 1 may be given when a DOE contractor identifies the violation and promptly reports the violation to the DOE. In weighing this factor, consideration will be given to, among other things, the opportunity available to discover the violation, the ease of discovery and the promptness and completeness of any required report. No consideration will be given to a reduction in penalty if the DOE contractor does not take prompt action to report the problem to DOE upon discovery, or if the immediate actions necessary to restore compliance with classified information security requirements or place the facility or operation in a safe configuration are not taken. 5. Self-Identification and Tracking Systems a. DOE strongly encourages contractors to self-identify noncompliances with classified information security requirements before the noncompliances lead to a string of similar and potentially more significant events or consequences. When a contractor identifies a noncompliance through its own self- monitoring activity, DOE will normally allow a reduction in the amount of civil penalties, regardless of whether prior opportunities existed for contractors to identify the noncompliance. DOE normally will not allow a reduction in civil penalties for self- identification if DOE intervention was required to induce the contractor to report a noncompliance. b. Self-identification of a noncompliance is possibly the single most important factor in considering a reduction in the civil penalty amount. Consideration of self-identification is linked to, among other things, whether prior opportunities existed to discover the violation, and if so, the age and number of such opportunities; the extent to which proper contractor controls should have identified or prevented the violation; whether discovery of the violation resulted from a contractor's self-monitoring activity; the extent of DOE involvement in discovering the violation or in prompting the contractor to identify the violation; and the promptness and completeness of any required report. Self- identification is also considered by DOE in deciding whether to pursue an investigation. 6. Self-Disclosing Events a. DOE expects contractors to demonstrate acceptance of responsibility for security of classified information and to pro- actively identify noncompliance conditions in their programs and processes. In deciding whether to reduce any civil penalty proposed for violations revealed by the occurrence of a self-disclosing event (e.g. belated discovery of the disappearance of classified information or material subject to accountability rules), DOE will consider the ease with which a contractor could have discovered the noncompliance, i.e. failure to comply with classified information accountability rules, that contributed to the event and the prior opportunities that existed to discover the noncompliance. When the occurrence of an event discloses noncompliances that the contractor could have or should have identified before the event, DOE will not generally allow a reduction in civil penalties for self- identification. If a contractor simply reacts to events that disclose potentially significant consequences or downplays noncompliances which did not result in significant consequences, such contractor actions do not lead to the improvement in protection of classified information contemplated by the Act. b. The key test is whether the contractor reasonably could have detected any of the underlying noncompliances that contributed to the event. Failure to utilize events and activities to address noncompliances may result in higher civil penalty assessments or a DOE decision not to reduce civil penalty amounts. 7. Corrective Action To Prevent Recurrence The promptness (or lack thereof) and extent to which the DOE contractor takes corrective action, including actions to identify root causes and prevent recurrence, may result in up to a 50% increase or decrease in the base civil penalty shown in Table 1. For example, very extensive corrective action may result in reducing the proposed civil penalty as much as 50% of the base value shown in Table 1. On the other hand, the civil penalty may be increased as much as 50% of the base value if initiation or corrective action is not prompt or if the corrective action is only minimally acceptable. In weighing this factor, consideration will be given to, among other things, the appropriateness, timeliness and degree of initiative associated with the corrective action. The comprehensiveness of the corrective action will also be considered, taking into account factors such as whether the action is focused narrowly to the specific violation or broadly to the general area of concern. 8. DOE's Contribution to a Violation There may be circumstances in which a violation of a classified information security requirement results, in part or entirely, from a direction given by DOE personnel to a DOE contractor to either take, or forbear from taking an action at a DOE facility. In such cases, DOE may refrain from issuing a notice of violation, and may mitigate, either partially or entirely, any proposed civil penalty, provided that the direction upon which the DOE contractor relied is documented in writing, contemporaneously with the direction. It should be emphasized, however, that no interpretation of a classified information security requirement is binding upon DOE unless issued in writing by the General Counsel. Further, as discussed in this section of this policy statement, lack of funding by itself will not be considered as a mitigating factor in enforcement actions. 9. Exercise of Discretion Because DOE wants to encourage and support DOE contractor initiative for prompt self-identification, reporting and correction of problems, DOE may exercise discretion as follows: a. In accordance with the previous discussion, DOE may refrain from issuing a civil penalty for a violation which meets all of the following criteria: (1) The violation is promptly identified and reported to DOE before DOE learns of it; (2) The violation is not willful or a violation that could reasonably be expected to have been prevented by the DOE contractor's corrective action for a previous violation; (3) The DOE contractor, upon discovery of the violation, has taken or begun to take prompt and appropriate action to correct the violation; and (4) The DOE contractor has taken, or has agreed to take, remedial action satisfactory to DOE to preclude recurrence of the violation and the underlying conditions which caused it. b. DOE may refrain from proposing a civil penalty for a violation involving a past problem that meets all of the following criteria: (1) It was identified by a DOE contractor as a result of a formal effort such as an annual self assessment that has a defined scope and timetable which is being aggressively implemented and reported; (2) Comprehensive corrective action has been taken or is well underway within a reasonable time following identification; and (3) It was not likely to be identified by routine contractor efforts such as normal surveillance or quality assurance activities. c. DOE will not issue a notice of violation for cases in which the violation discovered by the DOE contractor cannot reasonably be linked to the conduct of that contractor, provided that prompt and appropriate action is taken by the DOE contractor upon identification of the past violation to report to DOE and remedy the problem. d. DOE may refrain from issuing a notice of violation for an act or omission constituting noncompliance that meets all of the following criteria: (1) It was promptly identified by the contractor; (2) It is normally classified at a Severity Level III; (3) It was promptly reported to DOE; (4) Prompt and appropriate corrective action will be taken, including measures to prevent recurrence; and (5) It was not a willful violation or a violation that could reasonably be expected to have been prevented by the DOE contractor's corrective action for a previous violation. e. DOE may refrain from issuing a notice of violation for an act or omission constituting noncompliance that meets all of the following criteria: (1) It was an isolated Severity Level III violation identified during an inspection or evaluation conducted by the Office of Independent Oversight and Performance Assurance, or a DOE security survey, or during some other DOE assessment activity; (2) The identified noncompliance was properly reported by the contractor upon discovery; (3) The contractor initiated or completed appropriate assessment and corrective actions within a reasonable period, usually before the termination of the onsite inspection or integrated performance assessment; and [[Page 3614]] (4) The violation was not willful or one which could reasonably be expected to have been prevented by the DOE contractor's corrective action for a previous violation. f. In situations where corrective actions have been completed before termination of an inspection or assessment, a formal response from the contractor is not required and the inspection or integrated performance assessment report serves to document the violation and the corrective action. However, in all instances, the contractor is required to report the noncompliance through established reporting mechanisms so the noncompliance issue and any corrective actions can be properly tracked and monitored. g. If DOE initiates an enforcement action for a violation at a Severity Level II or III and, as part of the corrective action for that violation, the DOE contractor identifies other examples of the violation with the same root cause, DOE may refrain from initiating an additional enforcement action. In determining whether to exercise this discretion, DOE will consider whether the DOE contractor acted reasonably and in a timely manner appropriate to the security significance of the initial violation, the comprehensiveness of the corrective action, whether the matter was reported, and whether the additional violation(s) substantially change the security significance or character of the concern arising out of the initial violation. h. The preceding paragraphs are solely intended to be examples indicating when enforcement discretion may be exercised to forego the issuance of a civil penalty or, in some cases, the initiation of any enforcement action at all. However, notwithstanding these examples, a civil penalty may be proposed or notice of violation issued when, in DOE's judgment, such action is warranted on the basis of the circumstances of an individual case. [FR Doc. 05-1303 Filed 1-25-05; 8:45 am] BILLING CODE 6450-01-P
Federal Register: February 23, 2005 (Volume 70, Number 35) Rules and Regulations Page 8716 ======================================================================= ----------------------------------------------------------------------- DEPARTMENT OF ENERGY 10 CFR Part 824 [Docket No. SO-RM-00-01] RIN 1992-AA28 Procedural Rules for the Assessment of Civil Penalties for Classified Information Security Violations; Correction AGENCY: Office of Security, Department of Energy. ACTION: Final rule; correction. ----------------------------------------------------------------------- SUMMARY: The Department of Energy published a final rule on January 26, 2005, establishing 10 CFR Part 824 to implement section 234B of the Atomic Energy Act of 1954. This document corrects an inadvertent omission in one sentence of the final rule. DATES: This final rule is effective on February 25, 2005. FOR FURTHER INFORMATION CONTACT: Geralyn Praskievicz, (202) 586-4451 or, JoAnn Williams, (202) 586-6899. SUPPLEMENTARY INFORMATION: This document makes a correction to a final rule that was published in the Federal Register on January 26, 2005 (67 FR 3599). In rule document FR Doc. 05-1303, appearing on page 3599, in the issue of Wednesday, January 26, 2005, the following correction is made. PART 824--[CORRECTED] Sec. 824.2 [Corrected] 0 Beginning on page 3607, in the third column, Sec. 824.2(c) is corrected to read as follows: * * * * * (c) Individual employees. No civil penalty may be assessed against an individual employee of a contractor or any other entity which enters into an agreement with DOE. Issued in Washington, DC, on February 16, 2005. Glenn S. Podonsky, Director, Office of Security and Safety Performance Assurance. [FR Doc. 05-3423 Filed 2-22-05; 8:45 am] BILLING CODE 6450-01-P