Federal Energy Regulatory Commission, DOE.
The Federal Energy Regulatory Commission (Commission) is issuing this final rule establishing a procedure for gaining access to critical energy infrastructure information (CEII) that would otherwise not be available under the Freedom of Information Act (FOIA). These restrictions and the final rule were necessitated by the terrorist acts committed on September 11, 2001, and the ongoing terrorism threat. The final rule adopts a definition of critical infrastructure that explicitly covers proposed facilities, and does not distinguish among projects or portions of projects. The rule also details which location information is excluded from the definition of CEII and which is included. The rule addresses some issues that are specific to state agencies, and clarifies that energy market consultants should be able to get access to the CEII they need. Finally, the rule modifies the proposed CEII process and delegates responsibility to the CEII Coordinator to process requests for CEII and to determine what information qualifies as CEII.
The final rule will affect the way in which companies submit some information, and will add a new process in addition to the FOIA for requesters to use to request information that is not already publicly available. These new steps will help keep sensitive infrastructure information out of the public domain, decreasing the likelihood that such information could be used to plan or execute terrorist attacks.
The rule will become effective April 2, 2003.Start Further Info
FOR FURTHER INFORMATION CONTACT:
Carol C. Johnson, Wilbur T. Miller, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426. (202) 502-6457.End Further Info End Preamble Start Supplemental Information
1. In this final rule, the Federal Energy Regulatory Commission (Commission) amends its regulations to address the appropriate treatment of critical energy infrastructure information (CEII) in the aftermath of the September 11, 2001, terrorist attacks on the United States of America. Under the Policy Statement issued in Docket No. PL02-1-000 on October 11, 2001 (Policy Statement), the Commission removed from easy public access certain documents that previously had been public. In order to accomplish this step quickly, staff identified categories of document types that were likely to contain CEII, and those documents were removed from unrestricted public access. Persons seeking removed documents were directed to request the records using the Freedom of Information Act.
2. On January 16, 2002, the Commission issued a Notice of Inquiry (NOI) in RM02-4-000 to determine what changes, if any, should be made to its regulations to restrict unfettered general public access to critical energy infrastructure information, but still permit those with a need for the information to obtain it in an efficient manner. On September 5, 2002, the Commission issued a Notice of Proposed Rulemaking and Revised Statement of Policy (NOPR) in Docket Nos. RM02-4-000 and PL02-1-000. The NOPR proposed procedures for submitting and requesting CEII, and proposed the creation of a new position of CEII Coordinator. The final rule adopts most of the procedures proposed in the NOPR and creates the new position.
3. The process adopted in the final rule offers a more efficient alternative to handling requests for previously public documents than does the FOIA, which the Policy Statement established as the short-term method for requesting previously public documents. The FOIA was useful in the short term where a great deal of information had been removed from public access, some of which the Commission ultimately ascertained did not actually contain CEII. As discussed in the NOPR, however, the FOIA process is not well suited for handling CEII requests. The FOIA mandates disclosure of agency records unless the record falls within one of several specifically enumerated exemptions. Therefore, in order for CEII to be protected from disclosure, it must qualify for a FOIA exemption. For this reason, it is unlikely that requesters will obtain CEII through the FOIA process, although they could use the FOIA to obtain non-CEII portions of documents. In addition, under the FOIA, an agency may not distinguish among requesters based on their particular need for the information. Information given to one FOIA requester must be given to all requesters. The agency also may not restrict the recipient's use or dissemination of the information. All these factors make FOIA an unsatisfactory tool for the agency to use if it wishes to afford requesters with a specific need for information access to exempt and potentially dangerous information. Therefore, the Commission is adding § 375.313 to its regulations to authorize a Critical Energy Infrastructure Information Coordinator to process non-FOIA requests for CEII and make determinations regarding such requests.Start Printed Page 9858
4. The NOPR revised the Policy Statement to restrict public access to documents containing detailed specifications of proposed facilities as well as existing facilities, while at the same time determining that basic location information should not be treated as CEII. The final rule formalizes these policies in the regulations.
5. The Commission is issuing this rule under the authority of the Federal Power Act  and the Natural Gas Act  as the rule establishes a procedure for gaining access to documents collected or created pursuant to those acts that would not otherwise be available under the Freedom of Information Act, 5 U.S.C. 552. Accordingly, this order is subject to rehearing under section 313(b) of the Federal Power Act, 16 U.S.C. 824 l (b), and section 19(b) of the Natural Gas Act, 15 U.S.C. 717r(b), and jurisdiction to review the order lies in the United States Courts of Appeals as provided in those sections.
A. The Policy Statement
6. The September 11, 2001, terrorist attacks prompted the Commission to issue a policy statement on October 11, 2001, in PL02-1-000, addressing the treatment of previously public documents. The Commission announced there that it would no longer make available to the public through its Internet site, the Records and Information Management System (RIMS), which has been replaced by the Federal Energy Regulatory Records Information System (FERRIS), or the Public Reference Room, documents such as oversized maps that detail the specifications of energy facilities already licensed or certificated under Part I of the Federal Power Act  and section 7(c) of the Natural Gas Act, respectively. Rather, anyone requesting such documents was directed to follow the procedures set forth in section 388.108 of the Commission's regulations (Requests for Commission records not available through the Public Reference Room (FOIA Requests)). The Policy Statement also instructed staff to report back to the Commission within 90 days on the impact of this newly announced policy on the agency's business.
B. Implementation of the Policy Statement
7. To implement the policy, the Commission's staff first disabled RIMS access to all oversized documents, which frequently contain detailed infrastructure information, and also removed them from the Public Reference Room. Staff next identified and disabled or denied access to other categories of documents dealing with licensed or exempt hydropower projects, certificated natural gas pipelines, and electric transmission lines that appeared likely to include critical energy infrastructure information. This effort, which was undertaken as cautiously and methodically as possible, affected tens of thousands of documents.
8. From the issuance of the Policy Statement until mid-January 2003, the Commission received 212 FOIA requests for documents that were not available to the public because of the Policy Statement. The Commission has responded to or otherwise resolved all of these requests. To date, only two CEII requesters have filed timely administrative appeals of the decisions to withhold documents, both of which involved requests for FERC Form No. 715. Nothing is pending in court.
C. The Notice of Inquiry
9. Three months after the Commission issued the Policy Statement, it issued the Notice of Inquiry (NOI). The NOI set forth the Commission's general views on how it intended to treat previously public documents, and asked specific questions on the scope and implications of maintaining the confidentiality of certain previously public documents. The NOI advised infrastructure owners that they could seek confidential treatment of filings or parts of filings that, in their opinion, contain CEII, following the existing procedures in § 388.112 of the Commission's regulations, and by referencing Docket No. PL02-1-000 on the first page of the filing. Approximately 50 entities responded to the NOI, with a handful of commenters filing some portion of their filing nonpublic.
D. The Notice of Proposed Rulemaking and Revised Policy Statement
10. On September 5, 2002, the Commission issued the Notice of Proposed Rulemaking and Revised Statement of Policy (NOPR) in Docket Nos. RM02-4-000 and PL02-1-000. The NOPR proposed to establish a CEII Coordinator with delegated authority to process requests for CEII, and proposed regulations governing submission of CEII and requests for CEII. It also revised the Policy Statement to extend CEII protection to information regarding proposed facilities and eliminate CEII protection for information that only reveals the location of the facility. The Commission received more than forty comments in response to the NOPR. A list of commenters is attached as Appendix A.
A. The Need for Action
11. As was the case with the NOI, most commenters agree that security considerations make it advisable for the Commission to continue to protect CEII. A few commenters, however, maintain that such protection is either unnecessary to protect the public or outweighed by the benefits of making the information available. Some contend that CEII will be of little use to terrorists, an assertion with which some commenters specifically disagree. Some commenters believe that the NOPR did not adequately take into account the value of making information such as CEII available to the public, and specifically the media. Start Printed Page 9859One commenter contends, for example, that the media has used such information to expose safety hazards in pipelines.
12. The Commission remains convinced that the responsible course is for it to protect CEII. The arguments that such protection is unnecessary are speculative and unconvincing. For instance, one commenter points to an estimate that seventy percent of infrastructure attacks come from insiders as evidence that CEII is unlikely to aid an attack, while another states that “the possibility that terrorists will study government records and take advantage of perceived weaknesses is speculative.” The Commission is not prepared to stake the public's safety on this reasoning. According to the National Infrastructure Protection Center, the energy sector is considered one of the most attractive terrorist targets. According to media reports, the FBI identified “multiple casings of sites” where users routed through switches in Saudi Arabia, Indonesia, and Pakistan examined “emergency phone systems, electrical generation and transmission, water storage and distribution, nuclear power plants and gas facilities.” Where vulnerable areas exist, the Commission believes its responsibility is to reduce risks rather than to wait for proof that an attack is imminent or even likely.
13. The Commission also is unconvinced that the general public's need for information warrants the risk of disclosure of CEII. The “need to know” has never been absolute: the FOIA itself recognizes this principle by having nine exemptions, and the NOPR proposed to do nothing more than rely upon FOIA exemptions in withholding CEII. The Commission received no convincing arguments in response to the NOPR that there are practical benefits from public availability of CEII that would outweigh possible dangers from attacks on energy infrastructure. Furthermore, this rulemaking is intended to provide an avenue for disclosure in instances where there might be some benefit. The Commission has attempted to strike the best balance possible between the benefits of information and the protection of people and property.
B. Legal Authority to Protect CEII
14. In the NOI that initiated this rulemaking, the Commission invited comments on statutes that might affect the Commission's ability to protect CEII. The FOIA was identified as the statute that could mandate disclosure of some sensitive information. After receiving comments from many commenters, the Commission set out its view, in the NOPR, that one or more of several FOIA exemptions would most likely apply to CEII, namely: (1) Exemption 2, which exempts “records related solely to the internal personnel rules and practices of an agency”;  (2) Exemption 4, which protects from disclosure “trade secrets and commercial or financial information obtained from a person and privileged or confidential”;  and (3) Exemption 7, which protects from disclosure certain law enforcement information, including information the disclosure of which might jeopardize a person's life or safety.
15. Most commenters agree with the Commission's belief that one or more of these three exemptions would apply to CEII, and the Commission adopts the analysis in the NOPR to support its decision here. Some, however, either express concerns about the Commission's analysis of one or more exemptions or outright disagree with that analysis. A few commenters assert that the Commission was somehow overriding the FOIA  by creating an “extra-legal category of protected information,”  or by making CEII non-requestable under the FOIA.
16. The comments asserting that the Commission is somehow attempting to abrogate or circumvent the FOIA reflect a fundamental misunderstanding of this rulemaking. The Commission expressly acknowledged in the NOPR its continuing obligation to comply with the FOIA. This rule does not exempt any information from disclosure under that statute unless it falls within an existing exemption, abrogate in any way the right of any person to submit a request under the FOIA, or make any document or category of documents non-requestable or otherwise not subject to the FOIA. It is not the function of this rule to make any document unavailable that would otherwise be available absent this rulemaking. Instead, the purpose of this rulemaking is to establish a mechanism for making available certain categories of documents that would otherwise be unavailable.
17. The discussion of the FOIA exemptions in the NOPR reflects the Commission's view that a re-evaluation of information access policies, including analysis of the FOIA provisions, is dictated by the changed understanding of safety issues resulting from the 9/11 tragedy. That re-evaluation would be needed regardless of any regulation governing access to CEII. It becomes relevant here as a part of the reasoning behind this rulemaking, but it should not be mistaken for a determination as to whether any specific piece of information is accessible under the FOIA. A FOIA requester has a right to receive an individualized determination based on the document(s) requested. The Commission has not made, and cannot properly make, generic determinations as to whether FOIA exemptions apply. Accordingly, specific arguments with respect to Exemptions 2, 4, and 7 addressed in the NOPR, and raised again here, are best Start Printed Page 9860resolved in the context of particular FOIA requests, where submitters have the opportunity to enumerate potential competitive harm associated with release, and where the Commission can evaluate the harm of releasing that particular information. For purposes of this rulemaking, however, the Commission continues to believe that the types of information it has identified as CEII are exempt from disclosure under the FOIA.
18. As a separate matter, some commenters raise issues concerning the Commission's experience with Exemption 7 and question whether it applies outside the context of criminal investigations. In particular, OMB Watch wonders how the Commission could have removed from public access tens of thousands of documents on the basis that they were compiled for law enforcement purposes and asks whether the Commission ever relied upon Exemption 7 prior to the 9/11 attack. With respect to OMB Watch's first argument, the Commission did not remove thousands of documents from public access in October 2001 based on Exemption 7. The Commission removed them because they fit within certain categories of documents that were identified as likely to contain information that could be harmful in the hands of terrorists. The Commission did not do a document-by-document review of these documents to determine whether they contained information exempt from disclosure under the FOIA. In response to OMB Watch's second point, the Commission has relied from time to time on Exemption 7 prior to 9/11. More to the point, it has long been recognized that Exemption 7 applies to civil as well as criminal law enforcement. OMB Watch is likewise mistaken that the Commission will claim that all information it collects constitutes law enforcement information. The Commission has no such intention because it recognizes that Exemption 7 does not protect all law enforcement information, but only certain limited types, such as information the disclosure of which might interfere with enforcement proceedings or endanger the safety of an individual.
19. Some commenters raise administrative issues. They assert, for example, that this rulemaking will improperly remove functions from qualified “access professionals,” and that the Commission has not adequately explained what qualifications the CEII Coordinator must possess. These concerns are misplaced. As stated above, FOIA requests will continue to be processed according to the Commission's established FOIA procedures and the Commission's FOIA staff. The Commission's goal in appointing the CEII Coordinator will be the same as its goal in assigning staff to handle FOIA requests, or for that matter all of its staff: to ensure that employees are qualified and properly trained to handle their appointed responsibilities. Moreover, as explained below in the discussion on the use of a CEII Coordinator, the Coordinator will be free and indeed encouraged to consult with the staff who provides advice and recommendations on FOIA responses.
20. Some commenters ask whether the Commission will automatically transfer a FOIA request to the CEII Coordinator if it turns out that the requested information is CEII. The answer is, generally no. If a requester files a FOIA request and does not follow the procedures for seeking access to CEII, the request will be handled as a FOIA request and, if the requested information is exempt from disclosure, it will be withheld. The requester will, however, be notified that the information, although exempt from disclosure under the FOIA, may be accessible under the CEII procedures. If the requester seeks access under both the FOIA and CEII procedures, Commission staff will coordinate the response.
21. The Commission received comments questioning whether a utility must claim CEII status for information in order for it to qualify for protection under Exemption 4. The information either is or is not CEII. Thus, a claim that information is CEII is not necessary for the information to qualify as such. For the same reason, a claim that information is CEII will not necessarily qualify it as CEII. Accordingly, a submitter's ability to claim protection under Exemption 4 in particular is not, and cannot be, conditioned on a claim of CEII status. Information may qualify for Exemption 4 protection and not be CEII, just as information may qualify for CEII protection and not fit within Exemption 4, as long as it fits within another FOIA exemption.
22. As stated above, the Commission recognizes that it is bound by the FOIA. Where the FOIA affords certain rights to submitters of information, the Commission remains obligated to recognize those rights, just as it remains obligated to recognize the rights of FOIA requesters. Nevertheless, if a utility fails to claim CEII status for information that would qualify as CEII, the risk that the information will be disclosed is increased because Commission staff may not become fully aware of the dangers of disclosing it. Commission staff will endeavor to identify CEII in processing requests, including information for which submitters have not claimed CEII status, but proper determinations about what information should be released under the FOIA will be easier to make where submitters identify information they believe to constitute CEII.
23. Finally, some requesters express concern whether the Commission will provide adequate information about decisions not to disclose CEII, including information that would allow requesters to challenge claims of competitive harm. Determinations of competitive harm would occur as part of the FOIA process and would be subject to existing FOIA procedures. The Commission informs a FOIA requester of the reason(s) for withholding information and the requester may appeal that determination to the Commission's General Counsel and ultimately to a United States District Court. This rulemaking makes no changes to that procedure. Where information that is exempt from disclosure under the FOIA is found to be CEII, as noted, the Commission will so notify the requester.
C. Definition of CEII
24. The NOPR proposed to define CEII in § 388.113(c)(1) of the Commission's regulations  as:
Information about proposed or existing critical infrastructure that: (i) Relates to the production, generation, transportation, transmission, or distribution of energy; (ii) Could be useful to a person in planning an attack on critical infrastructure; (iii) Is exempt from mandatory disclosure under the Start Printed Page 9861Freedom of Information Act, 5 U.S.C. 552; and (iv) Does not simply give the location of the critical infrastructure.
This definition departed from the prior policy in that it covered proposed facilities as well as existing facilities, and in that it excluded from the definition of CEII information regarding the location of the infrastructure. The majority of comments regarding the proposed CEII definition involve the meaning of “critical infrastructure,” the exclusion of location information, and the inclusion of information about proposed facilities.
1. Definition of Critical Infrastructure
25. A crucial element in defining CEII is determining what qualifies as “critical infrastructure.” The NOPR proposed to define critical infrastructure as:
Systems and assets, whether physical or virtual, that are so vital to the United States that the incapacity or destruction of such systems or assets would have a debilitating impact on the security, national economic security, national public health or safety, or any combination of those matters.
The NOPR proposed definition of critical infrastructure was taken directly from the USA PATRIOT Act (Act). In proposing that definition, the Commission believed that all components of the energy infrastructure would qualify as critical infrastructure based on a finding in the Act that “[p]rivate business, government, and the national security apparatus increasingly depend on an interdependent network of critical physical and information infrastructures, including telecommunications, energy, financial services, water and transportation sectors.”
26. Some commenters agree with the proposed CEII definition, with EEI noting that “[e]lectricity is an essential public service that sustains public health and welfare, including * * * the provision of power for heating and air conditioning, water supply, street and building, hospital services, food storage and processing, computers, and other electrical equipment,” and as such, is vital to the nation's health, security, and economy. Other commenters, however, are concerned that the language could be read to extend CEII coverage only to very large or “vital” projects. For example, the Interstate Natural Gas Association of America (INGAA) requests that the Commission revise the definition of “critical infrastructure” to include “all facilities used in the production, generation, transportation, transmission, or distribution of energy.”  Conversely, the HRC recommends that the Commission consider “only certain documents of high-risk, high priority cases to be available for CEII protections.”  Some commenters recommend that the Commission leave it up to the infrastructure owner to determine whether its project qualifies as critical infrastructure, while other commenters voice concern that the definition of CEII is too broad. In this regard, Reporters Committee states that “[b]y defining CEII in a way that can have all major energy infrastructure fall under the CEII rubric, FERC maximizes the control it maintains over information.” 
27. No matter how broadly or narrowly the Commission defines critical infrastructure, in order to qualify for protection as CEII, the information must be useful to terrorists in planning an attack, be exempt from disclosure under the FOIA, and not merely give the location of the infrastructure. This effectively limits the scope of CEII protection. Moreover, the Commission does not want to define CEII in an ambiguous way that will invite disputes over which facilities are covered. The definition of critical infrastructure should encompass all facilities and components of facilities, not just facilities above a certain threshold. Even though a project may be small, destruction of the project could have serious consequences, particularly where it is part of a larger overall system. It is also important to the Commission that computer systems that control or are part of the energy infrastructure are covered. Therefore, the final rule defines critical infrastructure in new § 388.113(c)(2) of the Commission's regulations  as “existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters.”
2. Information on Location of Facilities
28. The majority of commenters object to the Commission's decision not to classify location information as CEII. In this regard, some question the Commission's assumption that location information is still publicly available in the wake of September 11. Others posit that the Commission should be a trailblazer, protecting location information even where it is publicly available elsewhere. Certain commenters argue that while the Commission should not protect information that is publicly available from other sources, such as USGS or commercial maps, other location information may warrant protection. Still others contend that information above a certain level of detail should be protected, for example, “location of Start Printed Page 9862key communication facilities, control centers, and switching facilities,”  and information that “identifies major transmission interconnections and other system components.” 
29. The Commission has considered the commenters' arguments and suggestions especially with respect to protecting information that may otherwise be available to the public. For this purpose, a check of the Internet revealed that some of the information that had been removed after September 11 is once again available. For instance, the International Nuclear Safety Center currently has interactive maps available on its web site, and the United States Geological Survey lists a variety of maps for sale, including 7.5 minutes maps. Although some information, such as the DOT pipeline maps have not been restored to public access, the Commission believes that there are publicly available sources that would enable a terrorist to locate most energy infrastructure. Without further guidance from the Congress or the Administration, the Commission is reluctant to withhold from public access location information that is otherwise available.
30. The Commission concludes nevertheless that there is some “location” information that does warrant protection as CEII. The Commission intends to release location information generally needed to participate in the National Environmental Policy Act (NEPA) process, while protecting information containing technical details not usually needed by most NEPA participants. Accordingly, the Commission considers the following types of gas and hydropower location information as outside the definition of CEII: (1) USGS 7.5-minutes topographic maps showing the location of pipelines, dams, or other aboveground facilities; (2) alignment sheets showing the location of pipeline and aboveground facilities, right of way dimensions, and extra work areas; (3) drawings showing site or project boundaries, footprints, building locations and reservoir extent; and (4) general location maps. In order to alleviate commenters' concerns about making this information so easily available, the Commission instructs filers to segregate this non-CEII location information into a separate volume or appendix, label it clearly “Non-Internet Public,” and submit it with instructions that it not be placed on the Internet. To the extent permissible and practical, the Commission will adhere to those instructions, but the information will still be publicly available through the Public Reference Room.
31. Conversely, the Commission considers the following gas information to qualify as CEII because it provides more than just location: (1) Diagrams of valve and piping details at compressor stations, meter stations, LNG facilities, and pipeline interconnections; (2) flow diagrams and other drawings or diagrams showing similar details such as volumes and operating pressures like those found in Exhibit G; (3) environmental resource reports for LNG facilities, and (4) drawings matching labels with specific buildings at the site, e.g., central gas control centers or gas control buildings.
32. Similarly, examples of hydropower location-related information that the Commission considers to be CEII include: (1) General design drawings of the principal project works (e.g., plan, elevation, profile, and section of dam and powerplant), such as those found in Exhibit F; (2) maps of projects (including location of project works with respect to water bodies, permanent monuments, or other structures that can be noted on the map and recognized in the field), such as those found in Exhibit G; (3) drawings showing technical details of a project, such as plans and specifications, supporting design reports, Part 12 independent consultant reports, facility details, electrical transmission systems, and communication and control center information; (4) locations of critical or vulnerable components of the project; (5) innundation information; and (6) global positioning system (GPS) coordinates of any project features (precise surveyed or GPS coordinates at or above two decimal points of accuracy of equipment and structures).
33. A filing such as a license or certificate application could contain a variety of information falling into one or more of the following categories: public, non-Internet public information, nonpublic CEII, and other nonpublic privileged. In that case, the preferred method of filing would be to segregate each type of information into separate volumes or appendices, each clearly marked with the appropriate heading, and with a cover letter explaining the treatment each volume/appendix should receive as follows:
- The public volume/appendix should be marked “Public,” although public is the default treatment for unmarked documents
- The non-internet public volume/appendix containing non-CEII location information should be marked “Non-Internet Public”
- The CEII volume/appendix should be marked “Contains Critical Energy Infrastructure Information—Do Not Release,” in accordance with § 388.112(b), and
- Any other nonpublic privileged volumes/appendices should be marked “Contains Privileged Information—Do Not Release.”
Filers should note that any filing containing non-Internet public, CEII or other privileged information currently may not be submitted using the electronic filing process.
34. The electric transmission grid differs from dams and pipelines in that the Commission does not have regulatory responsibilities over the siting or licensing of these facilities. Therefore, the Commission is not charged with conducting the NEPA reviews on these facilities. For that reason, there is far less need for the public as a whole to have unfettered access to location information submitted to the Commission regarding the electric grid. Some companies state that portions of FERC Form No. 715, Annual Transmission Planning and Evaluation Report, should fall outside the definition of CEII because it is location information. The Commission disagrees. Certain information in Part 3 of FERC Form No. 715 is not intended primarily to identify the location of the facilities, but rather to show the interrelationship of facilities. Therefore, the Commission considers Part 3 transmission system maps and diagrams used by the utility for transmission planning to be CEII.
3. Information Regarding Proposed Facilities
35. In the NOPR, the Commission reversed its earlier position that information relating to proposed facilities should not be treated as CEII. As noted in the NOPR, “[t]he major concern initially about withholding information about proposed projects was that people might not be able to participate effectively in the National Environmental Policy Act (NEPA) process.”  After the Policy Statement was issued in October 2001, the Start Printed Page 9863Commission treated information that identified location of existing, certificated or licensed facilities as CEII. It recognized that it would be nearly impossible for people to participate effectively in the NEPA process without access to specific information regarding the location of the proposed facility, the area it affects, and the resources it impacts. For that reason, the Policy Statement contemplated the release of CEII regarding proposed facilities, and then the protection of the information as CEII once a certificate or license was issued. This resulted in a fairly cumbersome process and raised the concern that a patient terrorist could collect CEII-type information on proposed projects and then use that information to cause harm to the project and the people living and working in its vicinity once it was built.
36. In the NOPR, recognizing the inconsistency in this approach, the Commission revised the Policy Statement to restrict access to detailed technical information relating to proposed facilities, while at the same time revising the policy to cease protecting location information as CEII. The majority of commenters approve of the decision to include proposed facilities, with only the HRC explicitly disagreeing. As explained in the NOPR, the Commission believes that as long as basic location information is not treated as CEII, protection of other sensitive information about proposed facilities will help protect the infrastructure without interfering with the NEPA process. For example, most NEPA commenters will want to know the location of a proposed pipeline and the footprint of aboveground facilities, but few will need diagrams of valve and piping details, or flow diagrams, or need to know which building will house security and which one will house the computer operations center. Those who do have such a need may file a request for that information using the CEII request procedures in new § 388.113(d) of the Commission's regulations.
37. Duke Energy suggests that the Commission clarify that the definition of CEII extends to “component parts of such systems or assets or * * * formal proposals to create such systems or assets including component parts thereof,”  voicing concern that the requirement that the infrastructure be vital to the nation's health, security, and economy “presupposes that the “infrastructure” in question is already in place,” effectively excluding information about proposed facilities. As discussed above, the Commission is changing the definition of critical infrastructure in new § 388.113(c)(2) of its regulations  to encompass “existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters.” This revised definition makes it clear that information regarding proposed facilities may be protected as CEII.
D. Requester's Status and Need for the Information
38. The NOPR proposed a procedure that would not restrict CEII to certain types of applicants, but would take an applicant's identity and need into account. A person seeking access to CEII under proposed § 388.113 would be required to submit information about his identity and need for the information. The NOPR emphasized the importance of intervenors, landowners and other persons being able to participate meaningfully in Commission proceedings. The Commission also expressed its belief that market participants who are not participants in proceedings would be able to access necessary information, either under proposed § 388.113 or through other means, such as the Open Access Same-time Information System (OASIS). The NOPR also proposed to permit owners and operators to get information about their own facility without the need to file a request under the CEII process, and to require agents of an owner/operator to obtain information from the owner/operator. The NOPR pointed out that these requirements would have no application to FOIA requests.
39. Several commenters express concern over the ability of energy market consultants and other participants to obtain data that is important to efforts to expand the energy infrastructure and develop new energy resources. Among the concerns is the possibility that transmission owners might restrict access to CEII in an unfair manner so as to deprive some market participants of the ability to conduct needed research. Some commenters suggest that the Commission adopt a method of pre-qualification for market participants who are not participants in Commission proceedings or include consultants and other market participants in a list of categories of CEII users who would be permitted access.
40. The procedures proposed in the NOPR were intended to provide access to CEII to requesters with legitimate need for the information. Generally speaking, market participants seeking to develop new or expanded energy resources would present such a need. Certainly, continued development of energy infrastructure is one aspect of the nation's defense against attacks upon that infrastructure. The Commission prefers to proceed on a case-by-case basis rather than creating categories of “pre-approved” users, because such an approach is better tailored to ensuring that inappropriate users do not gain access to CEII. The Commission understands that extensive delays in obtaining data could hinder development of energy resources, and has no intention of allowing the CEII process to result in any undue delays in the processing of facilities applications. In addition, once the CEII Coordinator has approved access to CEII on the part of a particular requester on a few occasions, subsequent requests by the same requester for similar information should, in most cases, require less time to process.
41. One matter requires clarification. As National Grid USA points out, owner/operators often are corporations that can act only through agents. The reference to “agent or representative” in § 388.113(d)(2) of the Commission's Start Printed Page 9864regulations  is not intended to refer to employees or officials of an owner/operator. They would be covered by § 388.113(d)(1) of the Commission's regulations. That subsection has been clarified accordingly.
E. Verification and Access Issues
1. CEII Coordinator
42. Most commenters approve of the creation of a CEII Coordinator position  with some indicating that the agency was better suited to respond to requests than the industry. However, a few commenters believe that owners, operators, and applicants should have more of a role in granting access to CEII. For example, the National Hydropower Association requests that the Commission amend the regulations to permit owners, operators, and applicants to serve as CEII Coordinator in some circumstances, and EEI advocates that submitters of information be able to object to intervenor requests for CEII. The Commission believes that the National Hydropower Association's suggestion would impermissibly interfere with the Commission's administration of the program. EEI's suggestion, however, is consistent with the proposed CEII Coordinator process, which is adopted here. Accordingly, under § 18 CFR 388.112(d) of the Commission's regulations, submitters are given an opportunity to comment on requests for CEII that they submitted.
43. At least one commenter, Reporters Committee, disagrees with the establishment of a CEII Coordinator, voicing concern that the proposed process removes access decisions from the hands of experienced access professionals and permits the agency to avoid the FOIA time limits. As discussed above in paragraph 18, the CEII Coordinator will have access to the same professional staff who evaluate and draft recommended decisions on FOIA requests, so that expertise will be utilized. Also, the time frames set out in new § 388.113(d)(3)(iii) of the Commission's regulations  for the CEII Coordinator to process a request are the same as provided by the Commission's regulations for processing FOIA requests. To be sure, missing the CEII deadlines does not have the same legal implications as missing the FOIA deadlines. Nevertheless, the Commission is committed to processing requests for CEII as timely as possible as if it were under the same legal obligations as imposed under the FOIA. Also, of course, if a requester is concerned about the timing for a CEII response running beyond the FOIA statutory time limits, the requester always has the option of filing a FOIA request and seeking access under that statute.
44. Certain commenters request clarification of the authority of the Coordinator. Southern believes that the NOPR did not make it clear that the CEII Coordinator has the authority to make determinations of when information qualifies as CEII. The Commission agrees that the proposed version of § 375.313 of its regulations  did not specifically delegate this authority to the Coordinator. The final rule revises proposed 18 CFR 375.313 to add this delegation, and includes language in new § 388.113(d)(3)(ii) of the Commission's regulations  to explicitly add this step into the processing of CEII requests.
45. Other commenters request that the Commission provide more concrete standards or guidance for the Coordinator. For example, National Grid USA recommends that the Commission provide “standards that will govern the CEII Coordinator's decision whether to release CEII,” explaining that stated criteria may give requesters insight into which requests will be granted and reduce fruitless requests. The National Hydropower Association, the NERC, PJM, and Southern also request that the Commission provide criteria for the Coordinator to use in determining whether information qualifies as CEII, whether a requester has a need for the information, and whether to require a non-disclosure agreement (NDA) as a condition of release. The Commission believes that the standards the Coordinator should use to determine whether information qualifies as CEII are adequately detailed in the definition in new § 388.113(c)(1) of its regulations. That is, does the information relate to the production, generation, transportation, transmission, or distribution of energy; could it be useful to a person in planning an attack on critical infrastructure; is it exempt from disclosure under the FOIA; and does it do more than provide location information?
46. Commenters also ask that the Commission develop guidelines for the Coordinator to use in determining whether to release information to a particular requester. The Commission does not intend to provide within the regulation itself a list of the types of requesters who would be deemed to have a need for CEII. First of all, that determination is fact specific. However, in the preamble to the NOPR and this final rule, the Commission has indicated that intervenors, market participants, energy market consultants, state agencies, landowners, environmental groups, and market participants may be found to have a need for information in a particular situation. It will be in the requester's best interest to explain as fully as possible why he or she needs the information in question. One factor that the Coordinator should factor into a decision is whether the requester's need for the information outweighs the potential harm from release of the information. For instance, if the Commission developed a hierarchical listing of the most critical portions of the infrastructure, it would be highly unlikely to release that information to most requesters, although it might be released to the FBI or the Office of Homeland Security. The final rule has been changed to reflect this balancing in new § 388.113(d)(3)(ii) of the Commission's regulations.
2. Use of PINS and Passwords
47. Some commenters are concerned that adequate security measures be taken to protect access to CEII. For instance, certain commenters favor the use of a password system to provide Internet access to CEII. GE believes it may be beneficial to maintain records on each individual's access to CEII to facilitate investigation of potential inappropriate access. Other Start Printed Page 9865commenters have concerns about the security issues associated with providing Internet access to CEII. For the time being, the Commission does not plan to give requesters access to Commission databases containing CEII. If and when that time comes, it is expected that identifications and passwords will be used.
3. Verification/Checks on Requesters
48. In the NOPR, the Commission proposed to require each individual requester to obtain access to information instead of granting access on an organization-by-organization basis. Several commenters urge the Commission to rethink its decision not to grant requesters generic access to nonpublic information. Some note that such generic access would reduce burdens on the Commission and requesters. INGAA, among others, believes that access decisions should be made on a case-by-case basis, while GE recommends a hybrid approach that would allow entities with “continuous legitimate need for information” to gain generic access, while utilizing a case-by-case system for those with more occasional need for the information. For the time being, the Commission is most comfortable granting access on a case-by-case basis. As mentioned in the discussion on standards to be used by the Coordinator, whether someone has a need for information can vary from circumstance to circumstance. The Commission's goal is to limit CEII access to those with a need for the information. Even though a requester may not be a terrorist, the more people who have access to information, the greater likelihood that it may find its way into the wrong hands. As also noted above, someone who requests access frequently will probably be cleared more quickly than a first-time requester, so the burden of multiple requests should not be too great.
49. In the NOPR, the Commission concluded that since the majority of requesters were expected to be entities and individuals who were well known to the Commission, it was not necessary to use the services of outsiders to verify the identity and legitimacy of requesters. The Commission is reconsidering that position and is in the process of evaluating existing databases that it may use to screen requesters. For that reason, the Commission is revising proposed § 388.113(d)(3)(i) to add a requirement that the requester provide his or her date and place of birth and to request that each requester provide his or her social security number  in addition to the other information initially proposed in the NOPR. This will help verify that the name that the individual provides is their true name, thus facilitating an accurate screening.
F. State Agency Issues
50. As indicated in the NOI and the NOPR, there are some unique issues with respect to state agency access to CEII. A primary concern is the ability of state agencies, which likely will be subject to their own FOIA rules, to protect CEII received from the Commission. State Commissions  also raise the following additional issues:
Whether and on what basis FERC proposes that its CEII rule will preempt state open records laws and rules?
Whether State Commissions will automatically be permitted to obtain all CEII data from FERC or whether State Commission access may be limited on a “need to know” basis?
Whether FERC's rule will adequately preclude utilities from invoking the FERC rule to avoid providing CEII data to State Commissions?
Whether State Commissions will have requisite access to CEII data from utilities not within a State Commission's jurisdiction (e.g., for purposes of examining regional transmission or generation capability)?
Whether State Commissions or their staff will be required to enter into an NDA, and if so, on what terms? 
51. As an initial matter, the Commission emphasizes that its goal is to cooperate as fully as possible with the State Commissions, which share the Commission's objective to ensure that CEII does not get into the wrong hands. That said, the Commission grants the National Association of Regulatory Commissioners' (NARUC's) requested clarification on the Federal preemption issue. NARUC states that the Commission has no basis to preempt authority over the totality of access to information regarding gas and electric utility regulation, and that much of the information at issue is not “Federal information,” that is, generated by or for the Federal government, but instead is generated by non-Federal entities that have provided similar or identical information to state regulators. The Commission agrees.
52. The NOPR discussion on preemption related to state agency requests to FERC for CEII that the Commission had generated or collected. As NARUC correctly points out, “the NOPR itself declares that FERC's rule does not propose to alter the traditional ability of State Commissions to obtain such data directly” from the companies. Therefore, as requested by NARUC, the Commission confirms that it does not intend that public utilities may rely on this rule to refuse to provide information directly to State Commissions.
53. In addition, State Commissions will be presumed to have a need to know information within their state involving issues within their responsibilities. They also may submit requests for information regarding entities outside of their jurisdictions with an explanation of the need. Such requests should be capable of being resolved in a timely manner. On the other hand, as discussed below, release of CEII to State Commissions and other State Agencies will normally be subject to signing an NDA. It does not make sense for the Commission to release the Start Printed Page 9866information to the State Agencies with no agreement to protect the information, at least to the extent permitted by law. The Commission has no intention of asking a state agency to ignore state law, but merely to give the Commission notice and an opportunity to take action to prevent release of the information.
G. Timing Issues
54. The NOPR proposed to provide in § 388.112(d) of the Commission's regulations  notice and an opportunity for a CEII submitter to comment when a request was received for its information, and to provide in § 388.112(e)  notification to the submitter prior to release. Under the proposal, a submitter would have at least five days in which to submit its comments, and at least five-days notice prior to release of information submitted as CEII. Several commenters claim that these time limits are too short, and advocate having at least 10 days to comment, and up to 30 days notice prior to release. At the same time, other commenters are concerned that the time frames are too long in some circumstances, for instance, where a time for filing a protest or intervention may expire in the interim. At least one, Duke Energy, raises the possibility that the Commission could extend other deadlines where someone is delayed in getting access to information.
55. The Commission has considered these arguments and examined the filings that have very short time limits, for instance responses to rate filings under Sections 205 of the Federal Power Act, or Section 4 of the Natural Gas Act, and does not believe anyone will be prejudiced by the time frames proposed in the NOPR. It is unlikely there will be CEII in most of these filings, and if there is, there should still be sufficient information available for parties to make the required filings in a timely manner. This same issue could arise whenever a company claims confidential treatment for a portion of its filing. To date, that has not proved to be an obstacle to meaningful, timely participation by other parties, and there is no reason to expect that the CEII regulation will cause a problem where none has existed previously.
56. The Commission also has examined the arguments that the proposed time limits do not give submitters adequate time to respond. First of all, the rule provides minimum times. Where circumstances permit, the Coordinator may give submitters a longer amount of time. However, the shorter minimum is needed to permit a quick turnaround where necessary and to facilitate response within the FOIA time limits. Prior to 9/11, the five-day minimums existed in § 388.112 of the Commission's regulations for other requests for nonpublic treatment. For years parties have been able to respond within the time permitted. The Commission sees no reason to extend these time limits for cases involving CEII.
H. Use of Non-Disclosure Agreements (NDAs)
57. The NOPR proposed to require most CEII requesters to sign an NDA as a condition of gaining access to CEII. The major exception was laid out in proposed 18 CFR 388.113(d)(2), which provided that owner/operators would be exempt from the requirement to sign an NDA prior to gaining access to CEII regarding their own projects. The reason for this is that they have at least as great an incentive to protect this information as the Commission has, and probably have access to even more damaging information in the event a rogue employee wanted to cause harm to the facility. The Commission adopts here the proposed exception for owner/operators, and also retains the requirement that agents/representatives (other than employees or officers) of owner/operators obtain CEII directly from the owner/operator, who will be in a better position to judge the agent/representative's need for the information and to impose restrictions on its use.
58. In addition, as explained in the NOPR, NDAs for Federal agency CEII requesters will differ from others in part because the Commission will remind the requester of his or her responsibilities under the Federal Records Act, and will require that the requesting agency refer any subsequent FOIA requests for information provided by the Commission back to the Commission for a determination as to whether the information is subject to release under the FOIA. Similarly, NDAs for State Agency requesters will specify that the information is Federal information that is “on loan” to the State Agency and that the Commission has the right to request return of the information. The Commission will also require that the State Agency notify the Commission whenever a request for the information is received.
59. Several commenters ask the Commission to elaborate on possible penalties for violation of an NDA. There are two that readily come to mind. First, a violation of an NDA could result in the Commission's refusing to give similar information to the violator in the future under the CEII process. Indeed, the Commission would be violating the public's trust if a requester were permitted to violate his or her obligations under an NDA with impunity. Second, the Commission could rightly bar someone from representing people before the Commission for a stated period of time under § 385.2102(a)(2) of the Commission's regulations.
I. Submission of CEII to the Commission
60. In the NOPR, the Commission proposed to make submission of CEII a subcategory of submission of documents subject to claims of privilege under § 388.112 of its regulations, with the same number of copies and the same requirement for a written statement supporting the request for privileged treatment. As adopted here, CEII submissions under that section have to indicate that the information is CEII, paralleling the existing requirement for information submitted with a request for privileged treatment. The Commission proposed to have the submitter determine how best to segregate CEII and non-CEII, such as by creating a separate nonpublic appendix or simply redacting CEII from the public filing. The Commission further cautioned that it would take disciplinary action against submitters Start Printed Page 9867who abuse the CEII process by claiming CEII status for extensive portions of non-CEII. Under both the NOPR and the final rule, a claim of privilege has the same effect regardless of whether the privileged information is CEII or other nonpublic information. Under § 388.112 of the Commission's regulations, the portions for which privileged treatment is sought will be placed in the nonpublic file, and will not be released before the submitter has an opportunity to comment on its release, and receives notice of the impending release.
61. Some commenters dislike the practice of creating public and nonpublic documents, expressing concern over potential confusion between versions. These commenters urge the Commission to redesign its forms so that CEII and other nonpublic information are included as a separate attachment. Commonwealth Associates, Inc. (CAI) objects to allowing submitters to designate CEII, out of fear that system owners/operators will abuse the process by making CEII available to their agents, while forcing others to wait for a decision by the CEII Coordinator by making sweeping claims of CEII status. CAI suggests that the Commission determine CEII status in the first instance. Other commenters suggest that the Commission specify penalties for violations of the CEII procedures.
62. The Commission believes, as it did in formulating the NOPR, that the process for submitting CEII will work best if it tracks as closely as possible the existing procedures for submitting other privileged information, procedures that have proven satisfactory over time. It consequently is reluctant to depart from those procedures for fear of creating confusion and encountering unforeseen problems. The suggestion that the CEII Coordinator, rather than the owner of the information, designate CEII in the first instance, rather than reduce any prejudice from delays, will more likely increase the delays. Commission staff would be required to examine every page of a submission to make the determination, as opposed to examining only those portions that are claimed to constitute CEII.
63. The concern that some submitters will make unjustified claims of CEII status is not one that the Commission takes lightly, as it indicated in the NOPR. The Commission will take action against submitters who abuse the system. It does not intend, however, to specify the form that action may take, as it will depend on the circumstances. Admittedly, the Commission's ability to impose penalties is not extensive, but it can disqualify a person from practice before the Commission in the event of “unethical or improper professional conduct.”
64. With respect to the process of separating CEII from non-CEII, the Commission agrees with the commenters preferring a separate appendix for documents containing protected information rather than two entire copies, one public and one nonpublic. Accordingly, the Commission will modify § 388.112(b) of its regulations  to state a strong preference for an appendix containing protected information. The Commission will, however, leave the option of separate public and nonpublic versions for situations where the use of an appendix would render the document difficult to read. This revision will apply to non-CEII protected information as well. As stated above, the Commission believes that the procedures for CEII and non-CEII protected information should be as similar as possible to avoid confusion.
65. The suggestion that the Commission redesign its forms to place CEII in attachments or appendices is outside the scope of this rulemaking. As discussed below, however, the Commission does intend to re-examine its forms and reports to determine whether changes are needed to provide better protection for CEII. This issue can be addressed at that time. For now, the Commission will add a requirement to § 388.112 of its regulations  that all submissions for which CEII status is claimed be stamped “Contains CEII—Do Not Release” on every page containing CEII rather than just on the front page. A similar provision will be added for other types of protected information as well. In addition, the Commission is revising § 388.112(b)(2) of its regulations  to direct those who file on electronic media  to provide a list of the names of each file containing CEII or other privileged material, and to mark the outside of the media (CD, diskette, tape) itself to indicate CEII or other privileged material. Hopefully these additional steps will prevent inadvertent disclosure of material.
J. Challenges to CEII Status
66. As with the submission of CEII, the NOPR proposed to handle challenges to CEII status through the existing procedures of § 388.112 of the Commission's regulations. Under proposed § 388.112(d), the CEII Coordinator would afford the submitter notice in the event of a request for CEII, and give the submitter at least five days in which to oppose the request. Under proposed § 388.112(e), if the CEII Coordinator denies the claim of privilege, the submitter would receive notice of the denial at least five days prior to release of the information.
67. Several commenters have concerns about the time frames proposed in § 388.112 of the Commission's regulations. They assert that a five-day notice period is insufficient, both for the time in which a submitter must respond to a request for CEII and for the notice of a proposed release. For the former, commenters favor a 10-day notice period. For the latter, commenters prefer anywhere from a 10 to 30-day notice period. The Commission also received suggestions that the time run from receipt of notice and that the notice be “actual” rather than constructive, such as in a Federal Register notice. Some commenters also suggest that the Commission provide for an automatic stay of a decision to release CEII in the event of a request for rehearing, arguing that the time limit for making such a request is 30 days and that the information will otherwise be released before that time runs.
68. The Commission continues to believe that the currently existing procedures are adequate. The Start Printed Page 9868Commission has not encountered a problem with submitters of privileged information subject to a FOIA request not being able to respond timely. These time frames come into play in situations involving confidential business information that is highly sensitive to submitters. If the current time frames are adequate in such situations, they should be adequate where CEII is requested. It should be noted that the Commission does send notice directly to the submitter, usually by facsimile as well as by mail and frequently alerts the submitter by telephone too, and does not rely on constructive notice.
69. Moreover, as discussed in the NOPR, decisions by the CEII Coordinator, which will be made pursuant to authority delegated here in new § 375.313 of the Commission's regulations, will be subject to requests to the Commission for rehearing. As is true for all orders issued under delegated authority, the time limit for a request for rehearing is thirty days. In addition, the Commission's rules specifically provide that a request for rehearing does not stay the order being challenged unless the Commission orders otherwise. The Commission has found these procedures to be workable in various contexts over the years and believes they will continue to function well in connection with requests for CEII.
K. Other Issues
70. In response to the NOPR, several commenters suggested that the Commission review the information that it collects to determine if such collections are necessary. They reason that if the Commission does not have the information, it cannot be subject to disclosure under the FOIA. Southern is concerned about this, particularly where the information may be available through the Open Access Same-time Information System (OASIS). The Commission agrees with these commenters' logic. As noted in the NOPR, the Commission will be examining its information collections to see where collections can be scaled back or eliminated without compromising fulfillment of its statutory responsibilities. This will most likely be done in conjunction with the periodic Office of Management and Budget clearance process.
71. Commenters also seek Commission action to amend requirements that companies make information available where the Commission is protecting the same information from disclosure. Conversely, at least one commenter, the Transmission Access Policy Study Group, requested that the Commission confirm that it is not eliminating requirements that companies make this information available. The Commission intends to eliminate the inconsistent treatment, and will be making future modifications to its regulations to effect these changes. Until those regulations are changed, the requirements remain in place unless a company successfully obtains a waiver from the requirement.
III. Information Collection Statement
72. The Office of Management and Budget's (OMB's) regulations require that OMB approve certain information collection requirements imposed by agency rule. In the NOPR, the Commission estimated the annual public reporting burden as follows:
|Data collection||Number of respondents||Number of responses||Hours per response||Total annual hours|
Total Annual Hours for Collection (reporting + record keeping, if appropriate) = 50 hours. Information Collection Costs: The NOPR estimated the cost to comply with these requirements. It projected the average annualized cost of all respondents to be: Annualized Capital Startup Costs: The Commission estimated that to respond to this information collection will be a one-time cost of $12.50 per respondent. (50 hours @ $50 hourly rate ÷ 200).
73. None of the commenters challenged the estimates provided in the NOPR. On October 1, 2002, OMB approved without change, the Commission's request for approval of the information collection required by the proposed rule, and assigned it OMB No. 1902-0197. The only information collection changes from the NOPR to the final rule are the added requirement in new § 388.113(d)(3)(i) of the Commission's regulations  that requesters provide their date and place of birth and the request that they provide their social security number. OMB regulations provide an exemption where a person is required to provide only facts that are necessary for identification. The requirement that a requester provide his or her date and place of birth and the request that a requester provide his or her social security number are intended to verify the identity of the requester. For that reason, this collection need not be resubmitted to OMB for approval.
IV. Environmental Analysis
74. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment. Included in the exclusions are rules that are clarifying, corrective, or procedural or that do not substantively change the effect of the regulations being amended. This rule is procedural in nature and therefore falls under this exception; consequently, no environmental consideration is necessary.
V. Regulatory Flexibility Act Certification
75. The Regulatory Flexibility Act of 1980 (RFA)  generally requires a description and analysis of final rules that will have significant economic impact on a substantial number of small entities. The Commission is not required to make such analyses if a rule would not have such an effect. The Commission certifies that this rule does not have such an impact on small entities.Start Printed Page 9869
VI. Document Availability
76. In addition to publishing the full text of this document in the Federal Register, the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the Internet through FERC's Home Page (http://www.ferc.gov) and in FERC's Public Reference Room during normal business hours (8:30 a.m. to 5 p.m. eastern time) at 888 First Street, NE., Room 2A, Washington, DC 20426.
77. From FERC's Home Page on the Internet, this information is available in the Federal Energy Regulatory Records Information System (FERRIS). The full text of this document is available on FERRIS in PDF and WordPerfect format for viewing, printing, and/or downloading. To access this document in FERRIS, type the docket number of this document excluding the last three digits in the docket number field.
78. User assistance is available for FERRIS and the FERC's website during normal business hours from FERC Online Support (by phone at 1-866-208-3673 (toll-free) or 202-502-6652, or by e-mail at FERCOnlineSupport@ferc.gov) or the Public Reference Room at (202) 502-8371 Press 0, TTY (202) 502-8659. E-Mail the Public Reference Room at firstname.lastname@example.org.
VII. Effective Date
79. These regulations are effective April 2, 2003.
80. The provisions of 5 U.S.C. 801 regarding Congressional review of final rules does not apply to this final rule, because the rule concerns agency procedure and practice and will not substantially affect the rights of non-agency parties.Start List of Subjects
List of Subjects in 18 CFR Parts 375 and 388
- Authority delegations (Government agencies)
- Seals and insignia
- Sunshine Act
- Confidential business information
- Freedom of information
By the Commission.Start Signature
Magalie R. Salas,
In consideration of the foregoing, the Commission amends parts 375 and 388, chapter I, title 18, Code of Federal Regulations, as follows.End Amendment Part Start Part
PART 375—THE COMMISSIONEnd Part Start Amendment Part
1. The authority citation for part 375 continues to read as follows:End Amendment Part Start Amendment Part
2. Add § 375.313 to subpart C to read as follows:End Amendment Part
The Commission authorizes the Coordinator or the Coordinator's designee to:
(a) Receive and review all requests for critical energy infrastructure information as defined in § 388.113(c)(1).
(b) Make determinations as to whether particular information fits within the definition of CEII found at § 388.113(c)(1).
(c) Make determinations as to whether a particular requester's need for and ability and willingness to protect critical energy infrastructure information warrants limited disclosure of the information to the requester.
(d) Establish reasonable conditions on the release of critical energy infrastructure information.
(e) Release critical energy infrastructure information to requesters who satisfy the requirements in paragraph (b) of this section and agree in writing to abide by any conditions set forth by the Coordinator pursuant to paragraph (c) of this section.
PART 388—INFORMATION AND REQUESTSEnd Part Start Amendment Part
3. The authority citation for part 388 continues to read as follows:End Amendment Part Start Amendment Part
4. Section 388.112 is revised to read as follows:End Amendment Part
(a) Scope. (1) Any person submitting a document to the Commission may request privileged treatment by claiming that some or all of the information contained in a particular document is exempt from the mandatory public disclosure requirements of the Freedom of Information Act, 5 U.S.C. 552, and should be withheld from public disclosure.
(2) Any person submitting documents containing critical energy infrastructure information (CEII) as defined in § 388.113 should follow the procedures specified in this section.
(b) Procedures. A person claiming that information is privileged under paragraph (a) of this section must file:
(1) For documents submitted in hard copy,
(i) A written statement requesting privileged treatment for some or all of the information in a document, and the justification for nondisclosure of the information;
(ii) One of the following:
(A) In all cases where the privileged information or CEII can, as a practical matter, be segregated into a separate document or appendix:
(1) Fourteen copies of the original document, indicating in bold print on the front page either “Privileged Information Contained in Attachment” or “Critical Energy Infrastructure Information Contained in Attachment,” and
(2) One separate document or appendix, indicating in bold print on the front page either “Contains Privileged Information—Do Not Release” or “Contains Critical Energy Infrastructure Information—Do Not Release,” with every page in the document or appendix marked either “Privileged Information—Do Not Release” or “Critical Energy Infrastructure Information—Do Not Release,” or
(B) In cases where the privileged information or CEII cannot reasonably or coherently be separated into a separate document or appendix:
(1) The original document, indicating in bold print on the front page either “Contains Privileged Information—Do Not Release,” or “Contains Critical Energy Infrastructure Information—Do Not Release” and, on every page containing privileged information or CEII, the marking “Privileged Information—Do Not Release,” or “Critical Energy Infrastructure Information—Do Not Release,” with the privileged information or CEII clearly identified, and
(2) Fourteen copies of the document without the information for which privileged treatment is sought, and with a statement indicating that information has been removed for privileged treatment, and
(iii) The name, title, address telephone number, e-mail address, and facsimile number of the person or persons to be contacted regarding the request for privileged treatment of documents submitted to the Commission.
(2) For documents submitted on electronic media,
(i) A written statement requesting privileged treatment for some or all of the information on the electronic media, Start Printed Page 9870and the justification for non-disclosure of the information;
(ii) One of the following:
(A) In all cases where the privileged information or CEII can, as a practical matter, be segregated into a separate document or appendix:
(1) One copy of the electronic media and fourteen paper copies of a filing all without the privileged information or CEII, and all marked either “Privileged Information Contained in Separate Attachment” or “Critical Energy Infrastructure Information Contained in Separate Attachment,” and
(2) One copy of the electronic media and one paper copy of a separate document or appendix, in both cases marked on media itself and on the front page either “Contains Privileged Information—Do Not Release” or “Contains Critical Energy Infrastructure Information—Do Not Release,” with every page in the document or appendix marked either “Privileged Information—Do Not Release” or “Critical Energy Infrastructure Information—Do Not Release,” and
(3) An index identifying each file on the media and whether it is public, contains Critical Energy Infrastructure Information, or contains other privileged information; or
(B) In cases where the privileged information or CEII cannot reasonably or coherently be separated into a separate document or appendix:
(1) One copy of a complete filing on the electronic media and a paper copy, both marked on the media itself and on the front page either “Contains Privileged Information—Do Not Release”or “Contains Critical Energy Infrastructure Information—Do Not Release,” with every page containing privileged information or CEII marked either “Privileged Information—Do Not Release” or “Critical Energy Infrastructure Information—Do Not Release” and with the privileged information or CEII clearly and specifically identified, and
(2) One copy of the electronic media without the information for which privileged treatment is sought and with a statement that information has been removed for privileged treatment, together with fourteen paper copies without the information for which privileged treatment is sought,
(3) An index identifying each file on the media and whether it is public, contains Critical Energy Infrastructure Information, or contains other privileged information, and
(iii) The name, title, address, telephone number, e-mail address, and facsimile number of the person or persons to be contacted regarding the request for privileged treatment of documents submitted to the Commission.
(c) Effect of privilege claim—(1) For documents filed with the Commission. (i) The Secretary of the Commission will place documents for which privileged treatment is sought in accordance with paragraph (b)(1)(ii) of this section in a nonpublic file, while the request for privileged treatment is pending. By placing documents in a nonpublic file, the Commission is not making a determination on any claim for privilege. The Commission retains the right to make determinations with regard to any claim of privilege, and the discretion to release information as necessary to carry out its jurisdictional responsibilities.
(ii) The Secretary of the Commission will place the request for privileged treatment described in paragraph (b) of this section and a copy of the original document with the privileged information removed in a public file while the request for privileged treatment is pending.
(2) For documents submitted to Commission staff. The notification procedures of paragraphs (d), (e), and (f) of this section will be followed by staff before making a document public.
(d) Notification of request and opportunity to comment. When a FOIA or CEII requester seeks a document for which privilege is claimed, or when the Commission itself is considering release of the information, the Commission official who will decide whether to make the document public will notify the person who submitted the document and give the person an opportunity (at least five days) in which to comment in writing on the request. A copy of this notice will be sent to the requester.
(e) Notification before release. Notice of a decision by the Commission, the Chairman of the Commission, the Director, Office of External Affairs, the General Counsel or General Counsel's designee, a presiding officer in a proceeding under part 385 of this chapter, or any other appropriate official to deny a claim of privilege, in whole or in part, will be given to any person claiming that information is privileged no less than five days before public disclosure. The notice will briefly explain why the person's objections to disclosure are not sustained by the Commission. A copy of this notice will be sent to the FOIA or CEII requester.
(f) Notification of suit in Federal courts. When a FOIA requester brings suit to compel disclosure of information for which a person has claimed privileged treatment, the Commission will notify the person who submitted the documents of the suit.
5. Add § 388.113 to read as follows:End Amendment Part
(a) Scope. This section governs access to critical energy infrastructure information (CEII). The rules governing submission of CEII are contained in 18 CFR 388.112(b). The Commission reserves the right to restrict access to previously filed documents as well as Commission-generated documents containing CEII.
(b) Purpose. The procedures in this section are available at the requester's option as an alternative to the FOIA procedures in § 388.108 where the information requested is exempted from disclosure under the FOIA and contains CEII.
(c) Definitions. For purposes of this section:
(1) Critical energy infrastructure information means information about proposed or existing critical infrastructure that:
(i) Relates to the production, generation, transportation, transmission, or distribution of energy;
(ii) Could be useful to a person in planning an attack on critical infrastructure;
(iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552; and
(iv) Does not simply give the location of the critical infrastructure.
(2) Critical infrastructure means existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters.
(d) Optional procedures for requesting critical energy infrastructure information.
(1) An owner/operator of a facility, including employees and officers of the owner/operator, may obtain CEII relating to its own facility directly from Commission staff without going through the procedures outlined in paragraph (d)(3) of this section.
(2) An agent or representative of an owner/operator must obtain information from the owner/operator.
(3) If any other requester has a particular need for information designated as CEII, the requester may request the information using the following procedures:
(i) File a written request with the Commission's CEII Coordinator. The request shall contain the following: Requester's name, date and place of Start Printed Page 9871birth, title, address, and telephone number; the name, address, and telephone number of the person or entity on whose behalf the information is requested; a detailed statement explaining the particular need for and intended use of the information; and a statement as to the requester's willingness to adhere to limitations on the use and disclosure of the information requested. Requesters are also requested to include their social security number for identification purposes.
(ii) Once the request is received, the CEII Coordinator will determine if the information is CEII, and, if it is, whether to release the CEII to the requester. The CEII Coordinator will balance the requester's need for the information against the sensitivity of the information. If the requester is determined to be eligible to receive the information requested, the CEII Coordinator will determine what conditions, if any, to place on release of the information. Where appropriate, the CEII Coordinator will forward a non-disclosure agreement (NDA) to the requester for execution. Once the requester signs any required NDA, the CEII Coordinator will make the critical energy infrastructure information available to the requester. The CEII Coordinator's decisions regarding release of CEII are subject to rehearing as provided in § 385.713 of this chapter.
(iii) The CEII Coordinator will attempt to respond to the requester under this section according to the timing required for responses under the Freedom of Information Act in § 388.108(c), and will provide notice to the submitter in accordance with § 388.112(d) and (e).
List of Commenters
Adirondack Mountain Club
American Electric Power System
American Gas Association
American Library Association
Bonneville Power Administration (BPA)
Commonwealth Associates, Inc.
City Public Service of San Antonio
Duke Energy Corporation (Duke)
Edison Electric Institute (EEI), including the EEI Alliance of Energy Suppliers, and EEI Transmission Group
Electric Power Supply Association (EPSA)
Exelon Generation Corporation on behalf of its public utility subsidiaries PECO Energy Company and Commonwealth Edison Company
Federation of American Scientists
Hydropower Reform Coalition (HRC)
The Industrials: Process Gas Consumers Group, American Forest & Paper Ass'n, American Iron & Steel Institute, Georgia Industrial Group, Florida Industrial Gas Users, Industrial Gas Users of Florida, and United States Gypsum Company
Interstate Natural Gas Association of America (INGAA)
Massachusetts Energy Facilities Siting Board
MidAmerican Energy Company (MidAmerican)
National Association of Regulatory Utility Commissioners (NARUC)
National Grid USA
National Hydropower Association
New York State Public Service Commission
North American Electric Reliability Council (NERC)
Northwest Natural Gas Company (Northwest Natural)
Oklahoma Corporation Commission
Oklahoma Gas and Electric Company
Pace Global Energy Services
Pacific Gas & Electric Company (PG&E)
PJM Interconnection, L.L.C. (PJM)
GE Power Systems Energy Consulting (GE)
Puget Sound Energy, Inc.
Reliant Resources, Inc. (Reliant)
Reporters Committee for Freedom of the Press and The Society of Environmental Journalists (Reporters Committee)
Southern California Edison Company (SCE)
Society of Professional Journalists
Southern Company Services, Inc., acting for itself and as agent for Alabama Power Company, Georgia Power Company, Gulf Power Company, Mississippi Power Company, Savannah Electric and Power Company, and Southern Power Company (Southern)
Public Utilities Commission of Ohio, the Michigan Public Service Commission and the staff of the Oklahoma Corporation Commission (States)
Transmission Access Policy Study Group
Washington Legal Foundation and Public Interest Clinic, George Mason University School of Law (Washington Legal Foundation)
Williston Basin Interstate Pipeline Company (Williston Basin)
Whitfield Russell Associates
Applicability of Freedom of Information Act Exemptions to Critical Energy Infrastructure Information
The Commission's actions in the NOPR and the final rule are based on its position that CEII includes only information that is exempt from disclosure under FOIA. The exemptions most likely to apply to CEII are Exemptions 2, 4, and 7. A discussion of the potential applicability of each follows.
a. Exemption 2
Exemption 2 exempts from disclosure “records related solely to the internal personnel rules and practices of an agency.”  According to guidance from the Department of Justice (DOJ), “[a]ny agency assessment of, or statement regarding, the vulnerability of such a critical asset should be protected pursuant to Exemption 2.”  DOJ has counseled agencies that “a wide range of information can be withheld under Exemption 2's 'circumvention' aspect.”  DOJ also has instructed agencies to take full advantage of the breadth of Exemption 2's protection for critical infrastructure information.
The Commission has concluded that a portion of the CEII is exempt from disclosure under Exemption 2 of FOIA. Illustratively, the Commission is expanding its efforts to help facility owners and operators assess security risks and protect facilities from attack. Information developed or created by the Commission as part of these efforts is likely to fall within the ambit of Exemption 2. Documents describing inspections of regulated facilities likewise will fall within Exemption 2 if they assess or describe vulnerabilities of the project.
b. Exemption 4
Exemption 4 protects from public disclosure “trade secrets and commercial or financial information obtained from a person and privileged or confidential.”  The Commission has determined that much of the CEII falls within the scope of Exemption 4, on the basis that release of the information could cause competitive harm to submitters, impair the Commission's ability to obtain similar information in the future, or impair the effectiveness of the Commission's programs.
There are two primary issues regarding the application of Exemption 4 to CEII. First, whether the fact that this sort of information had been publicly available in the past undermines an argument that it is now confidential, and second, whether the Trade Secrets Act  prohibits the Commission from sharing this information on a “need-to-know” basis.
The Commission concludes that the fact that this information has been previously public does not defeat Exemption 4. Americans live in a different world today than they did prior to September 11, 2001. Americans have had to face the harsh realities of terrorism on their soil. This has forced the nation to reassess its vulnerability to terrorist threats. Government agencies as well as private companies have had to reconsider the extent to which they make information freely available to others.
Specifically, under National Parks & Conservation Assoc. v. Morton, 49 F.2d 765 (DC Cir. 1974) (National Parks) and Critical Mass Energy Project v. NRC, 975 F.2d 871 (DC Cir. 1992) (Critical Mass), the initial inquiry in Exemption 4 cases is whether the information was submitted to the government voluntarily or whether it was compelled to be submitted. For voluntary submissions, the information is entitled to protection if it “would customarily not be released to the public by the person from whom it was Start Printed Page 9872obtained.”  This test focuses on the submitter's current treatment of the information, not past treatment. Therefore, if, in the post-September 11 world, the company would not release the information to the public, the Commission should not release the information.
For compelled submissions, there is a three-pronged test—the competitive harm prong, the impairment prong, and the program effectiveness prong. If any of the three tests is met, the information is exempt from mandatory disclosure under FOIA even though it may have been previously public. Under the competitive harm prong, there must be evidence of actual competition, and a likelihood of substantial competitive injury. This inquiry tends to be fact specific, so it is not possible to identify with certainty which categories of CEII would meet the test. However, as utilities transition from monopolies to competitive markets, it may be easier for them to demonstrate actual competition. The inquiry is whether the submitter is facing competition at the time the Commission received the request for the information, not whether there was competition when the information was first submitted to the Commission. If the competitive situation has changed, the likelihood of competitive harm would be analyzed using the current situation, not past conditions. Where competition is found to exist, the next issue is whether release of the information is likely to result in substantial competitive injury to the submitter. Again, the likelihood of competitive injury would be examined at the time the Commission received the request for the information. Whether the information could have harmed the submitter two years earlier is irrelevant; what is relevant is whether release of the information at the time of the request would cause competitive harm to the submitter.
The test most frequently applied under the competitive harm prong is whether use of the information by competitors is likely to harm the submitter. This may be fairly challenging to demonstrate in the case of CEII because the primary concern is that the information could be used to plan an attack on the infrastructure, not that it could be used to steal customers or undercut prices. On the other hand, a submitter may be able to show competitive harm where use of the information by someone other than a competitor could cause financial harm to the submitter. As relevant here, a terrorist attack on the energy infrastructure could cause financial harm to the owners and operators of the facilities because of lost opportunity costs as well as repair costs.
For compelled submissions, the impairment prong is satisfied where disclosure may affect the reliability or quality of the information received. The more subjective the filing requirement, the more likely that disclosure of the information could impair the Commission's ability to get thorough and accurate information in the future. As noted by EEI in its comments on the NOI, regulated entities may have discretion regarding how to construct their filings. If companies are worried that information they submit will be subject to public disclosure, they may choose not to submit the same level of detail that they might otherwise submit. In such circumstances, and assuming the submissions would otherwise comply with the Commission's regulations, the information may be exempt from disclosure under the impairment prong of Exemption 4.
Critical Mass recognized that in addition to the competitive harm and impairment prongs, there may be other instances where non-disclosure is warranted in order to protect other governmental interests, such as program effectiveness. Recently, in Public Citizen Health Research Group v. NIH, the district court relied on Critical Mass in determining that “impairment of the effectiveness of a government program is a proper factor for consideration in conducting an analysis under” Exemption 4. The court held that the National Institutes of Health's royalty information was protected under Exemption 4 because release of the information would make companies reluctant to enter into agreements with NIH, thus impairing the effectiveness of NIH's licensing program. The court reached a similar conclusion in Judicial Watch, Inc. v. Export-Import Bank, where release of certain financial information from foreign export credit agencies was held to be exempt from disclosure because release would make the credit agencies look for financing outside of the United States, undermining the agency's statutory purpose of fostering domestic economic growth by supporting export transactions.
Applying these recent decisions here, indiscriminate release of CEII could impair the effectiveness of the Commission's programs, which are meant to satisfy its mandate to regulate and oversee energy industries in the economic and environmental interest of the American public. Inappropriate release of CEII could make the infrastructure more vulnerable to attack, threatening those industries and resulting in potentially devastating economic and environmental consequences. Release of CEII also could make regulated entities less forthcoming in the information they provide to the Commission, especially where they have discretion as to what they submit. Restricted flow of information between the Commission and the companies could impair the Commission's programs that rely on such information. This is of particular concern in today's world, where the Commission is seeking additional information from licensees to assure that the infrastructure is sited and built safely and remains protected. Finally, release of CEII could harm the relationship between Commission staff and the regulated companies, impairing trust, and causing the parties to deal with each other in a more adversarial manner than necessary. For all of these reasons, much, if not all of the CEII would be exempt from disclosure under the third prong of Exemption 4 as it relates to compelled submissions.
A second issue is whether the Trade Secrets Act prohibits the Commission from sharing Exemption 4 material on an as-needed basis. The Trade Secrets Act states in relevant part that:
Whoever, being an officer or employee of the United States or of any department or agency thereof, publishes, divulges, discloses or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties or by reason of any examination or investigation made by, or return, report or record made to or filed with, such department or agency or officer or employee thereof, which concerns or relates to trade secrets, processes, operations, style of work, or apparatus, or to the identify, confidential statistical data, amount or source of any income, profits, losses or expenditures of any person, firm, partnership, corporation, or association; * * * to be seen or examined by any person except as provided by law; shall be fined not more than $1,000, or imprisoned not more than one year, or both; Start Printed Page 9873and shall be removed from office or employment.
See Chrysler Corp. v. Brown, 441 U.S. 281, 301(1979) (Chrysler). The Trade Secrets Act applies to formal agency actions as well as actions by the agency's individual employees. Courts have found that the coverage of the Trade Secrets Act and Exemption 4 are co-extensive, meaning that the Trade Secrets Act generally prohibits release of information covered by Exemption 4. However, the Trade Secrets Act permits disclosure of trade secret information where “authorized by law.”  Accordingly, under the Trade Secrets Act, protected information may be released where there is statutory or regulatory authority for the agency to release it. In cases where the authorization for release is found in an agency regulation, the inquiry is whether the regulation permitting the release is authorized by law.
The Commission has statutory authority to release trade secret information. While both the Federal Power and Natural Gas Acts place restrictions on an individual employee's release of information gathered in the course of examining records of a company, they permit the Commission itself to authorize such a release. The Federal Power Act provides:
The Commission shall at all times have access to and the right to inspect and examine all accounts, records, and memoranda of licensees and public utilities, and it shall be the duty of such licensees and public utilities to furnish to the Commission, within such reasonable time as the Commission may order, any information with respect thereto which the Commission may by order require, including copies of maps, contracts, reports of engineers, and other data, records, and papers, and to grant to all agents of the Commission free access to its property and its accounts, records and memorandum when requested so to do. No member, officer, or employee of the Commission shall divulge any fact or information which may come to his knowledge during the course of examination of books or other accounts, as hereinbefore provided, except insofar as he may be directed by the Commission or by a court.
In addition, sections 4 and 312 of the Federal Power Act authorize the Commission “[t]o make public from time to time the information secured hereunder and to provide for the publication of its reports and investigations in such form and manner as may be best adapted for public information and use.”  Section 14 of the Natural Gas Act provides similar authorization. It states:
The Commission may permit any person to file with it a statement in writing, under oath or otherwise, as it shall determine, as to any or all facts and circumstances concerning a matter which may be the subject of investigation. The Commission, in its discretion, may publish in the manner authorized in section 312 of the Federal Power Act * * * information concerning any such matter.
Because these provisions give the Commission broad discretion to release information, such release would be authorized by law under the Federal Power and Natural Gas Acts and, therefore, permitted under the Trade Secrets Act, creating an exception to the normal situation where the Trade Secrets Act prohibits release of information covered by Exemption 4. This, in turn, would permit the Commission to withhold the information from public FOIA disclosure under Exemption 4, and still disclose the information to selected individuals with appropriate restrictions on use and dissemination of that information without violating the Trade Secrets Act.
c. Exemption 7
Exemption 7 exempts from disclosure certain information compiled for law enforcement purposes. For purposes of CEII, the most relevant Exemption 7 provision is 7(F), which allows information to be withheld in order to protect a person's life or physical safety. In order to invoke Exemption 7, the agency must be able to demonstrate that the document at issue involves enforcement of a statute or regulation that the agency is authorized to enforce. The Commission has very broad authority to enforce the provisions of the Federal Power Act and the Natural Gas Act. For instance, under the Federal Power Act, the Commission (1) Monitors and investigates compliance with licenses, exemptions and preliminary permits it issues;  (2) determines just and reasonable rates;  and (3) ensures compliance with the Act and regulations issued thereunder. Similarly, with respect to the Natural Gas Act, the Commission has broad authority to (1) Determine whether rates and charges are just and reasonable;  and (2) enforce violations of the statute or regulations issued thereunder. Thus, given its broad enforcement authority, much of the information the Commission collects qualifies as information collected for a law enforcement purpose. For such law enforcement information to enjoy protection under Exemption 7(F), however, the release of the information must reasonably be expected to endanger a person's life or safety.
As noted in paragraph 11 of the final rule, there have been official warnings that the energy infrastructure could be the target of terrorist attacks. Given that an attack on the energy infrastructure is a legitimate threat, the Commission concludes that release of information that could facilitate or increase the likelihood of the success of such an attack could be expected to endanger life and safety of people. The failure of a dam could cause flooding that would endanger lives, as could the explosion of a natural gas pipeline. Interruptions to gas and electric power supplies likewise could endanger lives of those reliant on power, especially in times of extreme hot or cold weather. For these reasons, information identified as CEII may qualify for protection under Exemption 7(F).
5. Id. at p. 57995, ¶ 32,564 at p. 34,539.Back to Citation
6. Of course, the Commission emphasizes that requesters always retain the option of seeking information under the FOIA.Back to Citation
10. See 66 FR 52917 (Oct. 18, 2001), 97 FERC ¶ 61,030. Shortly after the attacks, the Commission issued another policy statement in Docket No. PL01-6-000, in which it provided guidance to regulated companies regarding extraordinary expenditures necessary to safeguard national energy supplies. See 96 FERC ¶ 61,299 (2001). The Commission recognized there that electric, gas, and oil companies may need to adopt new procedures, update existing procedures, and install facilities to further safeguard their systems, and that these efforts might result in extraordinary expenditures. The Commission assured these companies that it would give its highest priority to processing any filing made for the recovery of such expenditures. See, e.g., Colonial Pipeline Co., 100 FERC ¶ 61,035 (2002) (approving Colonial's security surcharge mechanism).Back to Citation
14. OMB Watch has misunderstood what was meant by oversized documents, stating “[c]learly file size was used as a criterion for removal of information,” terming this a “blunt and clumsy approach.” OMB Watch at p. 3. As explained in the Policy Statement, the Commission removed “documents, such as oversized maps.” “Oversized” refers to the size of the page itself, not the length of the document. Oversized documents generally contain maps and detailed diagrams, both of which were deemed likely to contain CEII, keeping in mind that location information of existing facilities was being protected at that time.Back to Citation
18. Id. at p. 58001, ¶ 32,564 at p. 34,550.Back to Citation
19. Id. at p. 58000, ¶ 32,564 at pp. 34,547-48.Back to Citation
20. E.g., American Library Association at p. 2; Lydia Olchoff at p. 1; Reporters Committee for Freedom of the Press and the Society of Environmental Journalists (Reporters Committee) at p. 3.Back to Citation
21. E.g., GE Power Systems Energy Consulting (GE) at pp. 2-3.Back to Citation
22. E.g., American Library Association at p. 1; OMB Watch at p. 1, 4.Back to Citation
23. Reporters Committee at p. 3-4. The Commission does not, however, have jurisdiction over pipeline safety issues, which belongs to the Department of Transportation. See 49 U.S.C. Chapter 601.Back to Citation
24. American Library Association at p. 2.Back to Citation
25. Reporters Committee at p. 3.Back to Citation
26. See National Infrastructure Protection Center Advisory 02-007 (September 10, 2002) (identifying most attractive targets as transportation and energy sectors and “[f]acilities or gatherings that would be recognized worldwide as symbols of American power or security.”) The National Infrastructure Protection Center's mission is to serve as the United States government's focal point for threat assessment, warning, investigation and response for threats or attacks against critical infrastructures, including energy and water systems.Back to Citation
27. See The Washington Post, Cyber-Attacks by Al Qaeda Feared, June 27, 2002, p. A01.Back to Citation
29. Id. at pp. 57997-800, ¶ 32,564 at pp. 34,542-46.Back to Citation
33. E.g., American Electric Power System at p. 1; Duke Energy Corporation (Duke) at p. 7; Edison Electric Institute (EEI) at pp. 6-7; Southern California Edison Company (SCE) at p. 10; Southern Company Services, Inc. (Southern) at p. 2; Washington Legal Foundation and Public Interest Clinic, George Mason University School of Law (Washington Legal Foundation) at pp. 5-6.Back to Citation
34. For the public's convenience, the Commission's FOIA analysis is reiterated in Appendix B.Back to Citation
35. E.g., Hydropower Reform Coalition (HRC) at p. 3; Massachusetts Energy Facilities Siting Board at p. 3; National Association of Regulatory Utility Commissioners (NARUC) at pp. 3, 7-10, 12-15; OMB Watch at pp. 4-6; Reporters Committee at pp. 2, 4, 7; joint comments of the Public Utilities Commission of Ohio, the Michigan Public Service Commission and the Oklahoma Corporation Commission (States) at pp. 3, 7-10, 12-17; Whitfield Russell Associates at p. 8.Back to Citation
36. OMB Watch at pp. 4-5; Reporters Committee at pp. 2, 7.Back to Citation
37. American Library Association at p. 2.Back to Citation
38. OMB Watch at p. 4.Back to Citation
40. Id. at pp. 57996-800, ¶ 32,564 at pp. 34,541-46.Back to Citation
41. Id.Back to Citation
42. E.g., NARUC at p. 12; States at p. 13; OMB Watch at p. 5; Whitfield Russell Associates at p. 8 (harm resulting from terrorist attacks would not constitute competitive harm under Exemption 4); Reporters Committee at p. 7; OMB Watch at p. 6 (information that was previously public is not protected under the FOIA).Back to Citation
43. E.g., OMB Watch at p. 7; Reporters Committee at p. 6.Back to Citation
44. OMB Watch at p. 7.Back to Citation
45. A review of the Commission's Annual FOIA reports for FY 1998 through 2001 indicates that the Commission relied on Exemption 7 in Fiscal Years 2001 and 1998, specifically citing exemption 7(A) eight times, 7(B) two times, 7(C) three times, 7(D) two times, and 7(E) five times during those two fiscal years. The Commission also relied on Exemption 7(F) more recently in modifying its practice of making the entirety of FERC Form No. 715 available to the public. See Order on Treatment of Information Collected in Form No. 715, 100 FERC ¶ 61,141 (2002).Back to Citation
46. E.g., Detroit Free Press, Inc. v. DOJ, 73 F.3d 93, 96 (6th Cir. 1996); Williams v. IRS, 479 F.2d 317, 318 (3rd Cir. 1973).Back to Citation
47. See OMB Watch at p. 7.Back to Citation
49. OMB Watch at p. 7; Reporters Committee at pp. 4-5.Back to Citation
50. NARUC at p. 24; States at p. 24.Back to Citation
51. NARUC at p. 13; States at p. 14.Back to Citation
52. NARUC at pp. 23-24; States at pp. 24-25.Back to Citation
56. Id. at pp. 58000-01, ¶ 32,564 at p. 34,548.Back to Citation
58. EEI at p. 2.Back to Citation
59. INGAA at p. 3.Back to Citation
60. HRC at p. 5.Back to Citation
61. E.g., MidAmerican Energy at p. 3; National Grid USA at p. 5.Back to Citation
62. E.g., HRC at p. 4; Reporters Committee at p. 8; Society of Professional Journalists at p. 2.Back to Citation
63. Reporters Committee at p. 8.Back to Citation
65. E.g., American Gas Association at pp. 1-2; Bonneville Power Administration (BPA) at pp. 3-4; Duke at p. 14; INGAA at pp. 8-11; MidAmerican Energy Company (MidAmerican) at pp. 6-7; National Grid USA at pp. 3 and 5; National Hydropower Association at p. 5; Northwest Natural Gas Company (Northwest Natural) at pp. 4-8; Pacific Gas & Electric (PG&E) at p. 1; Williston Basin Interstate Pipeline Company (Williston Basin) at pp. 4-6.Back to Citation
66. E.g., BPA at p. 4; Duke at p. 13 (citing articles claiming that numerous groups, including the Bureau of Transportation Statistics, the Department of Energy (DOE), the International Nuclear Safety Center, the Department of Transportation (DOT), the National Imagery and Mapping Agency and the United States Geological Survey, removed geographic information from open public access after September 11); EEI at pp. 8-9 (stating that DOE has removed information regarding nuclear facilities containing weapons-grade plutonium or highly enriched uranium, DOT has removed interactive oil pipeline maps, and the Energy Information Agency has removed similar information); and INGAA at p. 10.Back to Citation
67. E.g., American Gas Association at p. 2; Northwest Natural at pp. 7-8; INGAA at pp. 10-11; PG&E at p. 1; Williston Basin at pp. 4-5. These commenters believe that if the Commission protects this information, others may follow suit, eventually “aging” the information in the public domain, making it less useful to potential terrorists. The Commission appreciates these commenters' views, but believes that while this information might gradually become outdated in the public domain, the probability is remote given the availability of GPS equipment and commercial satellite images.Back to Citation
68. E.g., PJM Interconnection (PJM) at p. 2, SCE at p. 5. For its part, INGAA, an advocate of protecting location information, concedes “[t]o the extent that maps and/or location information are generally and readily available to the public and contain only non-detailed information of the location of energy facilities [such as state- or county-level maps],” such information could be excluded from the definition of CEII. INGAA at p. 8.Back to Citation
69. E.g., GE at p. 6 (location of certain types of equipment, such as “phase-angle regulators or critical FACTS devices” should be protected); MidAmerican at p. 6; National Hydropower Association at p. 5 (protect information that provides “details of the sensitive parts of facilities”); North American Electric Reliability Council (NERC) at pp. 4-5 (protect “detailed network topology maps and the details of the interactions performed by Supervisory Control and Data Acquisition (SCADA) and Energy Management Systems (EMS)”; Northwest Natural at p. 5 (“assumes that medium to highly detailed facility location maps” will be protected); PG&E at p. 6.Back to Citation
70. BPA at p. 4.Back to Citation
71. National Grid USA at p. 3.Back to Citation
74. Until instructed otherwise, filers may not submit non-Internet public documents through the electronic filing process. Document submitted through that process are automatically placed in public FERRIS, and are visible on the Internet.Back to Citation
76. E.g., Commonwealth Associates, Inc. at p. 2; Whitfield Russell Associates at p. 8.Back to Citation
78. Id.Back to Citation
81. E.g., EEI at p. 9; Industrials (Process Gas Consumers Group, American Forest & Paper Ass'n, American Iron & Steel Institute, Georgia Industrial Group, Florida Industrial Gas Users, Industrial Gas Users of Florida, and United States Gypsum Company) at p. 4; INGAA at p. 4; National Hydropower Association at p. 5; Southern at p. 3; Washington Legal Foundation at p. 2; Williston Basin at p. 4.Back to Citation
82. HRC at p. 4.Back to Citation
85. Duke Energy at p. 12.Back to Citation
86. Id. at pp. 10-11.Back to Citation
89. Id. at p. 58001, ¶ 32,564 at p. 34,550.Back to Citation
90. Id. at p. 58001, ¶ 32,564 at pp. 34,549-50.Back to Citation
91. Id. at p. 58001, ¶ 32,564 at p. 34,550.Back to Citation
92. Id. at p. 58001, ¶ 32,564 at pp. 34,549-50.Back to Citation
93. Id. at p. 58001, ¶ 32,564 p. 34,549.Back to Citation
94. E.g., BPA Power Administration at p. 5; Pace Global Energy Services at p. 3; Reliant Resources, Inc. (Reliant) at pp. 2-4.Back to Citation
95. E.g., Reliant at pp. 4-5.Back to Citation
96. E.g., Pace Global Energy Services at p. 3; GE at p. 4; Reliant at pp. 4-5.Back to Citation
98. National Grid USA at p. 9.Back to Citation
101. E.g., EEI at pp. 10-11; Electric Power Supply Association (EPSA) at p. 4; Industrials at pp. 3-4; INGAA at pp. 5 and 7; MidAmerican at pp. 3-4; National Hydropower Association at pp. 3-4; NERC at p. 3; Washington Legal Foundation at p. 2; Whitfield Russell Associates at p. 9.Back to Citation
102. E.g., American Electric Power at p. 1; Industrials at pp. 3-4; Reliant at p. 5.Back to Citation
103. National Hydropower Association at pp. 3-4.Back to Citation
104. EEI at p. 14.Back to Citation
106. Reporters Committee at p. 4.Back to Citation
108. A FOIA requester may treat an agency's failure to respond within the statutory time limit as constructive exhaustion of administrative remedies, and proceed directly to court without first filing an administrative appeal. See 5 U.S.C. § 552(a)(6)(C)(i). Normally, a requester must file an administrative appeal prior in order to exhaust his or her administrative remedies prior to filing in court. See Stebbins v. Nationwide Mutual Ins. Co., 757 F.2d 364, 366 (D.C. Cir. 1985) (per curiam).Back to Citation
111. National Grid USA at pp. 6-7.Back to Citation
112. National Hydropower Association at p. 4; NERC at p. 5; PJM at p. 1; Southern at pp. 4-6.Back to Citation
114. E.g., PJM at p. 1; Southern at pp. 4-5.Back to Citation
117. E.g., Duke at p. 17; National Hydropower Association at p. 8; GE at p. 5; SCE at p. 8.Back to Citation
118. See GE at p. 5.Back to Citation
119. E.g., National Hydropower Association at p. 8; GE at p. 5.Back to Citation
121. E.g., Duke Energy at p. 17; EPSA at p. 4.Back to Citation
122. See INGAA at p. 7; PJM at p. 2.Back to Citation
123. See GE at p. 3.Back to Citation
125. One possibility is to use the Interagency Border Inspection Service (IBIS) database, which keeps track of information on suspect individuals, businesses, etc., and which may also be used to access the FBI's National Crime Information Center containing records on wanted persons, criminal histories, etc.Back to Citation
126. Under the section 7(a)(1) of the Privacy Act, 5 U.S.C. 552a, an agency may not deny a right or benefit provided by law because an individual did not provide his or her social security numbers. Therefore, a requester has the option of not disclosing his or her social security number.Back to Citation
129.Back to Citation
130. NARUC also raises two miscellaneous issues which go beyond the scope of this rule. First, NARUC encourages the Commission to clarify how the CEII rule relates to the Commission's Standard Market Design (SMD) NOPR, “Remedying Undue Discrimination Through Open Access Transmission Service and Standard Electricity Market Design,” IV FERC Stats. & Regs. ¶ 32,563 (2002). Without more, and given the comprehensive nature of the SMD NOPR, the Commission is uncertain as to what NARUC's specific concerns are. The Commission believes, however, that there is nothing in this final rule that conflicts with the goals of the SMD NOPR. Second, NARUC suggests that the Commission set a benchmark for what reasonable costs of complying with the CEII rule may be passed through in companies' rates. To start with, not every one who complies with this rule will necessarily be a jurisdictional company whose rates the Commission sets. To the extent jurisdictional companies do incur costs to comply with the rule, the Commission believes that the current rules and policies for recovery of administrative costs are adequate to address the recovery of such compliance costs.Back to Citation
131. NARUC at pp. 17-18.Back to Citation
133. NARUC at p. 18.Back to Citation
137. ID. at pp. 58002-03, ¶32,564 at p. 34,552.Back to Citation
138. E.g., Duke Energy at p. 5 (advocating a ten-day comment period); EEI at p. 12 (advocating at least 15 days notice prior to release); National Hydropower Association at pp. 7-8, 12 (advocating at least ten business days to comment and ten business days notice prior to release); NERC at p. 4 (advocating 30 days to respond to determination to release CEII to non-governmental requester); Southern at p. 10 (advocating 30 days notice prior to release).Back to Citation
139. See, e.g., Industrials at pp. 6-8; Massachusetts Energy Facilities Siting Board at p. 5; Transmission Access Policy Study Group at pp. 5-6.Back to Citation
140. Duke Energy at p. 17.Back to Citation
145. Id.Back to Citation
146. 44 U.S.C. § 3510(b).Back to Citation
148. E.g., EEI at p. 15; Duke at pp. 16-17; MidAmerican at p. 3.Back to Citation
152. Id.Back to Citation
153. Id.Back to Citation
154. Id.Back to Citation
155. See id.Back to Citation
157. E.g., NERC at p. 3; National Hydropower Association at pp. 11-12.Back to Citation
158. E.g., EEI at p. 15; MidAmerican at p. 3.Back to Citation
164. At the present time, nonpublic documents are filed on electronic media such as CDs, diskettes, and tapes. At some point in the future, the Commission will accept nonpublic and non-Internet public documents through its electronic filing process. Certain filers also use Commission-created submission software (e.g., FERC Form No. 2 software) that enables the filer to “flag” certain fields for nonpublic treatment. The Commission will be examining that software and revising it and the associated filing instructions to permit filers to flag CEII and non-Internet Public information as well.Back to Citation
166. Id. at p. 58003, ¶ 32,564 at p. 34,552.Back to Citation
167. Id. at pp. 58002-3, ¶ 32,564 at p. 34,552.Back to Citation
169. E.g., Duke at p. 5; National Hydropower Association at pp. 7-8, 12.Back to Citation
170. E.g., EEI at p. 12; National Hydropower Association at pp. 7-8; National Grid USA at p. 10; NERC at p. 4; Southern at p. 10.Back to Citation
171. National Hydropower Association at pp. 7-8, 12.Back to Citation
172. E.g., National Hydropower Association at pp. 7-8, 12; National Grid USA at p. 10.Back to Citation
178. Southern at p. 11.Back to Citation
179. 67 FR 57994 at p. 58000, n. 41, FERC Stats. & Regs. ¶ 32,564 at p. 34,547, n. 41.Back to Citation
180. E.g., INGAA at p. 12; Puget Sound Energy, Inc. at pp. 5-6.Back to Citation
181. Transmission Access Policy Study Group at p. 7.Back to Citation
185. Order No. 486, Regulations Implementing the National Environmental Policy Act, 52 FR 47897 (Dec. 17, 1987), FERC Stats. & Regs. Preambles 1986-1990 ¶ 30,783 (1987).Back to Citation
2. DOJ 2001 FOIA Post 19, posted October 15, 2001. DOJ is the Federal agency responsible for the administration of the FOIA.Back to Citation
3. Id.Back to Citation
4. Id.Back to Citation
5. The Commission has jurisdiction over the safety of hydroelectric projects under sections 4(e), 10(a), and 10(c) of the Federal Power Act, 16 U.S.C. 797(e), 803(a), (c).Back to Citation
8. Critical Mass, 975 F.2d at 878.Back to Citation
9. While most of the submissions to a regulatory agency like FERC may appear to be compelled, this may not necessarily be the case. DOJ has recognized that the “existence of agency authority to require submission of information does not automatically mean such a submission is ‘required’; the agency authority must actually be exercised in order for a particular submission to be deemed ‘required.’ ” DOJ Freedom of Information Act Guide & Privacy Act Overview, May 2002 ed., at 202. Courts have found submissions to be voluntary where the agency had issued a subpoena but not sought to enforce it, see McDonnell Douglas Corp. v. EEOC, 922 F. Supp. 235 (E.D. Mo. 1996), and where the agency did not have authority to enforce the information collection because the information request violated the Paperwork Reduction Act, 44 U.S.C. 3501, see Center for Auto Safety v. NHTSA, 244 F.3d 144 (D.C. Cir. 2001). At bottom, the question of whether the information has been submitted voluntarily or was compelled must be analyzed on a case-by-case basis.Back to Citation
10. See CNA Fin. Corp. v. Donovan, 830 F.2d 1132 (D.C. Cir. 1987) (CNA).Back to Citation
11. The Commission's analysis of a submitter's competitive situation under FOIA is not the same as, and indeed is less rigid than, the analysis it must perform to establish lack of market power for charging market based rates. For FOIA purposes, the competition requirement is satisfied if the submitter faces some level of actual competition. See Niagara Mohawk Power Corp. v. DOE, 169 F.3d 16, 19 (D.D.C. 1999) (Niagara).Back to Citation
12. See, e.g., CNA, 830 F.2d at 1152 & n.158; Public Citizen Health Research Group v. FDA, 704 F.2d 1280, 1291 (D.C. Cir. 1983).Back to Citation
13. See Nadler v. FDIC, 899 F. Supp. 158, 163 (S.D.N.Y. 1995) (Nadler), aff'd, 92 F.3d 93 (2d Cir. 1996).Back to Citation
14. Id.Back to Citation
15. See Niagara Mohawk, 169 F.3d at 18 (holding that impairment is unlikely to be found where “data sought appears to take the form of hard, cold numbers on energy use and production, the fudging of which may strain all but the deliberately mendacious.”).Back to Citation
16. EEI NOI comments at p. 42.Back to Citation
17. See Critical Mass, 975 F.2d 879 (“It should be evident from this review that the two interests identified in that National Parks test are not exclusive.”).Back to Citation
18. 209 F. Supp. 2d 37 at 52 (D.D.C. Mar. 12, 2002) (alternative holding).Back to Citation
19. Id. at 54.Back to Citation
20. 108 F. Supp. 2d 19, 30 (D.D.C. 2000).Back to Citation
22. See Nadler, 899 F. Supp. 158, 162.Back to Citation
24. See, e.g., Bartholdi Cable Co. v. FCC, 114 F.3d 274 (D.C. Cir. 1997); CNA, 830 F.2d at 1152.Back to Citation
25. CNA, 830 F.2d at 1151.Back to Citation
26. Chrysler, 441 U.S. at 301.Back to Citation
27. Id.Back to Citation
[FR Doc. 03-4834 Filed 2-28-03; 8:45 am]
BILLING CODE 6717-01-P