Critical Energy Infrastructure Information

AGENCY:

Federal Energy Regulatory Commission.

ACTION:

Notice of proposed rulemaking and revised statement of policy.

SUMMARY:

The Federal Energy Regulatory Commission is proposing to revise its regulations to restrict public availability of critical energy infrastructure information. The Commission issued a policy statement in Docket No. PL02-1-000 on October 11, 2001, removing from easy public access previously public documents that detail the specifications of energy facilities licensed or certificated by the Commission. The Commission is revising this policy to include documents that detail specifications of proposed energy facilities as well. The original policy statement directed requesters seeking this information to follow the Freedom of Information Act (FOIA) procedures found at 18 CFR 388.108. Specifically, the Commission proposes to change its regulations to restrict unfettered general public access to critical energy infrastructure information, but still permit those with a need for the information to obtain it in an efficient manner. The proposed new access procedures complement existing rights under the FOIA. Requesters retain the right to file a FOIA request for any information not available through the Public Reference Room, the Internet, or publicly-accessible databases. The Commission also proposes establishment of a Critical Energy Infrastructure Information Coordinator to process and make decisions on non-FOIA requests for critical energy infrastructure information.

An important objective of the proposed rule is the reconciliation of the Commission's regulatory responsibilities under its enabling statutes and Federal environmental laws and the need to protect the safety and well being of American citizens from attacks on our nation's energy infrastructure.

Under the proposal, new sections will be added to Parts 375 and 388 of Title 18 of the Code of Federal Regulations, and 18 CFR 388.112 will be revised to implement the new procedures.

DATES:

Comments are due October 15, 2002.

ADDRESSES:

File written comments with the Office of the Secretary, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426. Comments should reference Docket Nos. RM02-4-000 and PL02-1-000. Comments may be filed electronically or by paper (an original and 14 copies, with an accompanying computer diskette in the prescribed format requested).

FOR FURTHER INFORMATION CONTACT:

Carol C. Johnson, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426, (202) 502-8521.

SUPPLEMENTARY INFORMATION:

Statement of Policy on Treatment of Previously Public Documents; Notice of Proposed Rulemaking and Revised Statement of Policy on Previously Public Documents

I. Introduction

1. In this notice of proposed rulemaking (NOPR), the Federal Energy Regulatory Commission (Commission) proposes specific changes to the Commission's regulations to address the appropriate treatment of critical energy infrastructure information (CEII) in the aftermath of the September 11, 2001 terrorist attacks on the United States of America. Under the Policy Statement issued in Docket No. PL02-1-000 on October 11, 2001 (Policy Statement), the Commission removed from easy public access certain documents that previously had been public. See IV FERC Stats. & Regs. ¶ 35,542. On January 16, 2002, the Commission issued a Notice of Inquiry (NOI) in RM02-4-000 to determine what changes, if any, should be made to its regulations to restrict unfettered general public access to critical energy infrastructure information, but still permit those with a need for the information to obtain it in an efficient manner. See IV FERC Stats. & Regs. ¶ 35,542. The rule proposed here would reconcile the Commission's regulatory responsibilities under its enabling statutes and Federal environmental laws with the need to protect the safety and well-being of American citizens from attacks on our nation's energy infrastructure.

2. The proposed rule would also offer a long-term and more efficient alternative to handling requests for previously public documents than does the Freedom of Information Act (FOIA), 5 U.S.C. 552, which the Policy Statement established as the short-term method for requesting previously public documents. In the Commission's view, the FOIA process is not well suited in the long run for handling most requests for CEII. Information that fits within the proposed definition of CEII is exempt from mandatory disclosure under the FOIA. When determining whether to release information under the FOIA, the agency may not consider a requester's particular need for the information. Moreover, once the agency releases the information to one requester under the FOIA, it generally must release it to all requesters. In addition, the agency may not restrict the recipient's use or dissemination of that information. Therefore, if the Commission wishes to make otherwise exempt information available to a particular requester based on that requester's need for the information, or wishes to limit the recipient's use and dissemination of exempt information, it must do so outside of the confines of the FOIA. To that end, the Commission proposes to add § 375.313 to its regulations to authorize a Critical Energy Infrastructure Information Coordinator to process non-FOIA requests for CEII and make determinations regarding such requests. Of course, requesters always retain the option of seeking information under the FOIA. Assuming that much of the information removed from public access will be exempt from mandatory disclosure under the FOIA, using the FOIA as the exclusive mechanism for determining release would mean that people with a need for the information likely would be denied access to exempt information.

3. Finally, the Policy Statement specified that the Commission was removing from easy public access documents containing detailed specifications of energy facilities licensed or certificated by the Commission. The Commission has concluded that the more sensible approach is not to differentiate between proposed facilities and those that have been licensed or certificated; accordingly, the proposed rule would expand the definition of CEII to encompass proposed projects as well as certificated, licensed, or constructed projects. The Commission believes that this approach should also be followed while it considers the comments filed on the NOPR, and hereby revises the PL02-1 Policy Statement to restrict public access to documents containing detailed specifications of proposed facilities as well. The Commission also has decided that location information should not be treated as CEII, and will begin making such information publicly available as soon as practicable.

II. Background

A. The Policy Statement

4. As noted, the September 11, 2001 terrorist attacks prompted the Commission to issue a policy statement on October 11, 2001, in PL02-1-000, addressing the treatment of previously public documents. See 97 FERC ¶ 61,030. The Commission announced there that it would no longer make available to the public through its Internet site, the Records and Information Management System (RIMS, which has been replaced by the Federal Energy Regulatory Records Information System (FERRIS)), or the Public Reference Room, documents such as oversized maps that detail the specifications of energy facilities already licensed or certificated under Part I of the Federal Power Act, 16 U.S.C. 719a, et seq., and Section 7(c) of the Natural Gas Act, 15 U.S.C. 717f(c), respectively. Rather, anyone requesting such documents was directed to follow the procedures set forth in 18 CFR 388.108 (Requests for Commission records not available through the Public Reference Room (FOIA Requests)). The Policy Statement also instructed staff to report back to the Commission within 90 days on the impact of this newly announced policy on the agency's business.

B. Implementation of the Policy Statement

5. The Commission's experience subsequent to the issuance of the Policy Statement has naturally informed its decision here to issue a notice of proposed rulemaking. To implement the policy, the Commission's staff first disabled RIMS access to all oversized documents, which frequently contain detailed infrastructure information, and also removed them from the Public Reference Room. Staff next identified and disabled or denied access to other types of documents dealing with licensed or exempt hydropower projects, certificated natural gas pipelines, and electric transmission lines that appeared likely to include critical energy infrastructure information. This effort, which was undertaken as cautiously and methodically as possible, affected tens of thousands of documents.

6. As of August 15, 2002, the Commission had received 188 FOIA requests for documents that previously had been public. Upon closer examination, the Commission's staff ascertained that seven of those requests involved documents that contained nothing critical, and released them accordingly. Staff contacted requesters in 29 other cases, and was able to negotiate to enable the requesters to obtain the documents directly from the companies which had created the documents or from the Commission subject to a non-disclosure statement. These requesters, who were frequently parties in relevant FERC proceedings or affected landowners, thus withdrew their requests. Seven others also withdrew their requests for no known reason, although a fair assumption is that they were able to obtain the requested documents from the document creators. The Commission has denied in whole or in part 138 requests, invoking in particular FOIA Exemption 7F, 5 U.S.C. 552(b)(7)(F), as well as Exemption 2, 5 U.S.C. 552(b)(2), and Exemption 4, 5 U.S.C. 552(b)(4). To date, no one has filed an administrative appeal of the decisions to withhold documents, although the time for many of the recently processed ones is still running. Finally, the Commission is currently processing the remaining seven requests.

C. The Notice of Inquiry

7. Taking all these matters into consideration, the Commission issued a Notice of Inquiry (NOI) on January 16, 2002. See IV FERC Stats. & Regs. ¶ 35,542. The NOI set forth the Commission's general views on how it intends to treat previously public documents, and asked specific questions on the scope and implications of maintaining the confidentiality of certain documents that previously had been made public but were removed from easy public access on October 11, 2001. Approximately 50 entities responded to the NOI. A few respondents made at least a portion of their filings non-public.

8. In addition, the Commission used the opportunity of the NOI to provide guidance on making filings with the Commission to the companies whose facilities could be the targets of terrorist attacks. Between January 2002 and the effective date of a final decision in Docket No. RM02-4-000, these companies were advised that they could seek confidential treatment of filings or parts of filings that, in their opinion, contain CEII. For this purpose, companies were directed to follow the procedures in 18 CFR 388.112, and also clearly note “PL02-1” on the first page of the document.

III. Discussion

A. The Need for Action

9. A threshold issue emerged from the responses as to whether the Commission should continue to protect CEII. Although some responses opposed the steps the Commission took in PL02-1 to protect information, the majority of the respondents supported the Commission's goal of increasing protection to the infrastructure, and, to varying degrees, the steps the Commission has taken to date. After careful consideration of the responses and its regulatory responsibilities, the Commission believes that it has an obligation to safeguard information vital to protect the nation's energy infrastructure. Accordingly, the Commission has decided to proceed with this NOPR, which clarifies the types of information that may be protected, proposes procedures for submitting and requesting confidential treatment of CEII, and suggests a method for handling challenges to CEII status.

B. Legal Authority To Protect CEII

1. Freedom of Information Act

10. It was apparent from the responses received that the NOI did not sufficiently explain that the Commission intended to deny public access only to information that was exempt from disclosure under the FOIA. The Commission has no intention of adopting an approach that would ignore the agency's obligations under the FOIA, which requires that all non-exempt information to be made available to the public. Indeed, the discussion in the NOI was premised on the assumption that CEII would include only information exempt from disclosure under FOIA, and, with this in mind, invited comment on which exemptions might be applicable to protect information that would be useful to those planning attacks on the energy infrastructure. Accordingly, as now discussed, most respondents expressed their views on the FOIA exemptions. Although a few respondents cited other exemptions, the following discussion focuses on the exemptions most likely to apply to CEII, namely Exemptions 2, 4 and 7.

a. Exemption 2

Exemption 2 exempts from disclosure “records related solely to the internal personnel rules and practices of an agency.” According to guidance from the Department of Justice (DOJ), “[a]ny agency assessment of, or statement regarding, the vulnerability of such a critical asset should be protected pursuant to Exemption 2.” DOJ has counseled agencies that “a wide range of information can be withheld under Exemption 2's ‘circumvention’ aspect.” DOJ also has instructed agencies to take full advantage of the breadth of Exemption 2's protection for critical infrastructure information.

11. Several respondents contended that CEII qualifies for protection under Exemption 2. Other respondents questioned whether Exemption 2 covers the types of information removed from public access under PL02-1. The Commission believes that a portion of the CEII removed from public access may be exempt from disclosure under Exemption 2 of FOIA. Illustratively, the Commission is expanding its efforts help facility owners and operators assess security risks and protect facilities from attack. Information developed or created by the Commission as part of these efforts is quite likely to fall within the ambit of Exemption 2. Documents describing inspections of regulated facilities likewise may fall within Exemption 2.

b. Exemption 4

12. Exemption 4 protects from public disclosure “trade secrets and commercial or financial information obtained from a person and privileged or confidential.” Most of the respondents who favored non-public treatment for CEII believed that such information was exempt from disclosure under Exemption 4. Again, there were a few respondents who questioned whether CEII was entitled to protection under Exemption 4. The Commission has determined that much of the information that may be withheld as CEII may fall within the scope of Exemption 4, because release of the information could cause competitive harm to submitters, impair the Commission's ability to obtain similar information in the future, or impair the effectiveness of the Commission's programs.

13. Respondents raised two issues regarding the application of Exemption 4 to CEII. First, several respondents questioned whether the fact that this sort of information had been publicly available in the past undermines an argument that it is now confidential. As discussed in greater detail below, it does not. Americans live in a different world today than they did a year ago. Americans have had to face the harsh realities of terrorism on their soil. This has forced the nation to reassess its vulnerability to terrorist threats. Government agencies as well as private companies have had to reconsider the extent to which they make information freely available to others.

14. Specifically, under National Parks & Conservation Assoc. v. Morton, 49 F.2d 765 (D.C. Cir. 1974) and Critical Mass Energy Project v. NRC, 975 F.2d 871 (D.C. Cir. 1992), the initial inquiry in Exemption 4 cases is whether the information was submitted to the government voluntarily or whether it was compelled to be submitted. For voluntary submissions, the information is entitled to protection if it “would customarily not be released to the public by the person from whom it was obtained.” This test understandably focuses on the submitter's current treatment of the information, not past treatment. Therefore, if, in the post-September 11 world, the company would not release the information to the public, the Commission should not release the information.

15. For compelled submissions, there is a three-pronged test—the competitive harm prong, the impairment prong, and the program effectiveness prong. If any of the three tests is met, the information is exempt from mandatory disclosure under FOIA even though it may have been previously public. Under the competitive harm prong, there must be evidence of actual competition, and a likelihood of substantial competitive injury. See CNA Fin. Corp. v. Donovan, 830 F.2d 1132 (D.C. Cir. 1987). This inquiry tends to be fact specific, so it is not possible to identify with certainty which categories of information would meet the test. However, as utilities transition from monopolies to competitive markets, it may be easier for them to demonstrate actual competition. The inquiry would be whether the submitter is facing competition at the time the Commission received the request for the information, not whether there was competition when the information was first submitted to the Commission. If the competitive situation has changed, the likelihood of competitive harm would be analyzed using the current situation, not past conditions. Where competition is found to exist, the next issue is whether release of the information is likely to result in substantial competitive injury to the submitter. Again, the likelihood of competitive injury would be examined at the time the Commission received the request for the information. Whether the information could have harmed the submitter two years earlier is irrelevant; what is relevant is whether release of the information at the time of the request would cause competitive harm to the submitter.

16. The test most frequently applied under the competitive harm prong is whether use of the information by competitors is likely to harm the submitter. See, e.g., CNA, 830 F.2d at 1152 & n.158; Public Citizen Health Research Group v. FDA, 704 F.2d 1280, 1291 (D.C. Cir. 1983). This may be fairly challenging to demonstrate in the case of CEII because the primary concern is that the information could be used to plan an attack on the infrastructure, not that it could be used to steal customers or undercut prices. On the other hand, a submitter may be able to show competitive harm where use of the information by someone other than a competitor could cause financial harm to the submitter. Cf. McDonnell Douglas Corp. v. NASA, 180 F.3d 303, 306-07 (D.C. Cir. 1999) (competitive harm where release of prices could be used by customers to negotiate lower prices). As relevant here, a terrorist attack on the energy infrastructure could cause financial harm to the owners and operators of the facilities because of lost opportunity costs as well as repair costs.

17. For compelled submissions, the impairment prong is satisfied where disclosure may affect the reliability or quality of the information received. The more subjective the filing requirement, the more likely that disclosure of the information could impair the Commission's ability to get thorough and accurate information in the future. See Niagara Mohawk, 169 F.3d at 18 (holding that impairment is unlikely to be found where “data sought appears to take the form of hard, cold numbers on energy use and production, the fudging of which may strain all but the deliberately mendacious.”). As noted by Edison Electric Institute (EEI), regulated entities may have discretion regarding how to construct their filings. If companies are worried that information they submit will be subject to public disclosure, they may choose not to submit the same level of detail that they might otherwise submit. In such circumstances, and assuming the submissions would otherwise comply with the Commission's regulations, the information may be exempt from disclosure under the impairment prong of Exemption 4.

18. Critical Mass recognized that in addition to the competitive harm and impairment prongs, there may be other instances where non-disclosure is warranted in order to protect other governmental interests, such as program effectiveness. Recently, in Public Citizen Health Research Group v. NIH, the district court relied on Critical Mass in determining that “impairment of the effectiveness of a government program is a proper factor for consideration in conducting an analysis under” Exemption 4. The court held that the National Institute of Health's royalty information was protected under Exemption 4 because release of the information would make companies reluctant to enter into agreements with NIH, thus impairing the effectiveness of NIH's licensing program. The court reached a similar conclusion in Judicial Watch, Inc. v. Export-Import Bank, where release of certain financial information from foreign export credit agencies was held to be exempt from disclosure because release would make the credit agencies look for financing outside of the United States, undermining the agency's statutory purpose of fostering domestic economic growth by supporting export transactions.

19. Applying these recent decisions here, release of CEII could threaten the effectiveness of the Commission's programs, which are meant to satisfy its mandate to regulate and oversee energy industries in the economic and environmental interest of the American public. Inappropriate release of CEII could make the infrastructure more vulnerable to attack, threatening those industries and resulting in potentially devastating economic and environmental consequences. As noted above, release of CEII also could make regulated entities less forthcoming in the information they provide to the Commission, especially where they have discretion as to what they submit. Restricted flow of information between the Commission and the companies could impair the Commission's programs that rely on such information. This is of particular concern in today's world, where the Commission is seeking additional information from licensees in order to help them better protect the infrastructure. Finally, release of CEII could harm the relationship between Commission staff and the regulated companies, impairing trust, and causing the parties to deal with each other in a more adversarial manner than necessary. For all of these reasons, much of the CEII could be exempt from disclosure under the third prong of Exemption 4 as it relates to compelled submissions.

20. A second issue raised by respondents regarding the applicability of Exemption 4 was whether the Trade Secrets Act would prohibit the Commission from sharing Exemption 4 material on an as-needed basis. The Trade Secrets Act states in relevant part that:

Whoever, being an officer or employee of the United States or of any department or agency thereof, publishes, divulges, discloses or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties or by reason of any examination or investigation made by, or return, report or record made to or filed with, such department or agency or officer or employee thereof, which concerns or relates to trade secrets, processes, operations, style of work, or apparatus, or to the identify, confidential statistical data, amount or source of any income, profits, losses or expenditures of any person, firm, partnership, corporation, or association; * * * to be seen or examined by any person except as provided by law; shall be fined not more than $1,000, or imprisoned not more than one year, or both; and shall be removed from office or employment.

18 U.S.C. 1905. See Chrysler Corp. v. Brown, 441 U.S. 281, 301(1979). The Trade Secrets Act applies to formal agency actions as well as actions by the agency's individual employees. Courts have found that the coverage of the Trade Secrets Act and Exemption 4 are co-extensive, meaning that the Trade Secrets Act generally prohibits release of information covered by Exemption 4. However, the Trade Secrets Act permits disclosure of trade secret information where “authorized by law.” Accordingly, under the Trade Secrets Act, protected information may be released where there is statutory or regulatory authority for the agency to release it. In cases where the authorization for release is found in an agency regulation, the inquiry is whether the regulation permitting the release is authorized by law.

21. The Commission has statutory authority to release trade secret information. While both the Federal Power and Natural Gas Acts place restrictions on an individual employee's release of information gathered in the course of examining records of a company, they permit the Commission itself to authorize such a release. The Federal Power Act provides:

The Commission shall at all times have access to and the right to inspect and examine all accounts, records, and memoranda of licensees and public utilities, and it shall be the duty of such licensees and public utilities to furnish to the Commission, within such reasonable time as the Commission may order, any information with respect thereto which the Commission may by order require, including copies of maps, contracts, reports of engineers, and other data, records, and papers, and to grant to all agents of the Commission free access to its property and its accounts, records and memorandum when requested so to do. No member, officer, or employee of the Commission shall divulge any fact or information which may come to his knowledge during the course of examination of books or other accounts, as hereinbefore provided, except insofar as he may be directed by the Commission or by a court.

16 U.S.C. 825(b); see 15 U.S.C. 717g(b) (Natural Gas Act) and Commission regulation at 18 CFR 3c.2(a).

22. In addition, sections 4 and 312 of the Federal Power Act authorize the Commission “[t]o make public from time to time the information secured hereunder and to provide for the publication of its reports and investigations in such form and manner as may be best adapted for public information and use.” 16 U.S.C. 797(d), 825k. Section 14 of the Natural Gas Act provides similar authorization. It states:

The Commission may permit any person to file with it a statement in writing, under oath or otherwise, as it shall determine, as to any or all facts and circumstances concerning a matter which may be the subject of investigation. The Commission, in its discretion, may publish in the manner authorized in section 312 of the Federal Power Act * * * information concerning any such matter.

Because these provisions give the Commission broad discretion to release information, such release would be authorized by law under the Federal Power and Natural Gas Acts and, therefore, permitted under the Trade Secrets Act, creating an exception to the normal situation where the Trade Secrets Act prohibits release of information covered by Exemption 4. This, in turn, would permit the Commission to exempt the information from public FOIA disclosure under Exemption 4, and still disclose the information to selected individuals with appropriate restrictions on use and dissemination of that information without violating the Trade Secrets Act.

c. Exemption 7

23. Exemption 7 exempts from disclosure certain information compiled for law enforcement purposes. For purposes of CEII, the most relevant Exemption 7 provision is 7(F), which allows information to be withheld in order to protect a person's life or physical safety. In order to invoke Exemption 7, the agency must be able to demonstrate that the document at issue involves enforcement of a statute or regulation that the agency is authorized to enforce. The Commission has very broad authority to enforce the provisions of the Federal Power Act and the Natural Gas Act. For instance, under the Federal Power Act, the Commission (1) monitors and investigates compliance with licenses, exemptions and preliminary permits it issues, 16 U.S.C. 823b; (2) determines just and reasonable rates, 16 U.S.C. 824e; and (3) ensures compliance with the Act and regulations issued thereunder, 16 U.S.C. 825m, 825o-1. Similarly, with respect to natural gas, the Commission has broad authority (1) to determine whether rates and charges are just and reasonable, 15 U.S.C. 717c; and (2) to enforce violations of the statute or regulations issued thereunder, 15 U.S.C. 717s. Thus, given its broad enforcement authority, much of the information the Commission collects qualifies as information collected for a law enforcement purpose. For such law enforcement information to enjoy protection under Exemption 7(F), the release of the information must reasonably be expected to endanger a person's life or safety.

24. Since the tragic events of September 11, 2001, there have been repeated warnings that the energy infrastructure could be the target of terrorist attacks. In this regard, Southern California Edison Company cited an ABCNEWS.com report in February 2002, reporting that “the FBI has within the past 24 hours issued an advisory to public utilities across the country warning that a computer from an alleged associate of Osama bin Laden contained engineering information about dams and reservoirs,” and a New York Times article stating that “computers that control the electric power system around the nation have been probed from the Middle East.” These are only a sample of warnings issued relating to the energy infrastructure. These types of reports show that there is a strong likelihood that such facilities are being considered as potential targets for attack.

25. Given that an attack on the energy infrastructure is a legitimate threat, the Commission believes that release of information that could facilitate or increase the likelihood of the success of such an attack could be expected to endanger life and safety of people. The failure of a dam could cause flooding that would endanger lives, as could the explosion of a natural gas pipeline. Interruptions to gas and electric power supplies likewise could endanger lives of those reliant on power, especially in times of extreme hot or cold weather. For these reasons, the Commission believes that information identified as CEII may qualify for protection under Exemption 7(F).

2. Substantive Statutes

26. The NOI asked whether there were statutes other than FOIA that require that certain information be made available to the public by the Commission. Most of the respondents' objections to protecting CEII were related to FOIA, or to the general public's right to the information. Few, if any, cited substantive statutes that purpportedly prohibit restrictions on release of CEII. While certain statutory provisions appear to require that information be made available to the public, no respondent could point to a substantive statutory provision that would constrain the Commission's exercising its discretion in determining exactly how to make the information available to the public. For instance, as noted by EEI, while Federal Power Act sec. 15 requires licensees to make certain data “reasonably available to the public for inspection” at their offices, 16 U.S.C. 808(b)(2), the Commission has the discretion to define exactly what information is covered and how it is to be made available. Similarly, while Federal Power Act sec. 213, 16 U.S.C. 824, states that the Commission “shall promulgate a rule requiring that information be submitted annually to the Commission by transmitting utilities which is adequate to inform potential transmission customers, State regulatory authorities, and the public of potentially available transmission capacity and known constraints,” that section imposes no requirement on the Commission to disseminate the information in any particular manner. Accordingly, the Commission believes that there is no statutory impediment to its protecting CEII.

C. Definition of CEII

1. Consideration of Facilities' Size

27. Many of the respondents who approved protecting CEII proffered definitions of the term. For instance, the Adirondack Mountain Club recommended a size threshold for protection of projects, suggesting that relevant information be released for hydropower projects under 5 MW. Similarly, Atlanta Gas Light Company proposed an approach that took into consideration the size and operating pressure of the facility as well as the impact that the loss of service would have in determining whether to protect information regarding a particular facility. A problem with any approach that distinguishes among facilities and protects only information regarding large or particularly critical facilities is that it highlights for would-be terrorists those facilities that would be the best targets. That is obviously not an option. Therefore, rather than defining CEII in terms of a facility's size or vulnerability, the Commission proposes in § 388.113(c)(1) to define CEII, in part, in FOIA terms, thereby clarifying that the Commission is withholding only information that is entitled to protection under the FOIA.

2. Existing Facilities Versus Proposed Facilities

28. The NOI requested responses on whether the Commission should continue to protect only information about licensed, exempted, certificated, and built facilities, or extend CEII protection to proposed facilities. The majority of respondents who favored protecting CEII argued that such protection should be extended to proposed facilities. Atlanta Gas Light Company stated, for example, that “without restrictions on access to information regarding proposed facilities, existing facilities would also be compromised from the interconnection point with the new facilities.” Others noted that once the information is in the public domain, it is not possible to retrieve it when the license or certificate is issued.

29.Based on review of the comments and its experience with implementation of PL02-1, proposed § 388.113(c)(1) includes information regarding proposed facilities in the definition of CEII. The major concern initially about withholding information about proposed projects was that people might not be able to participate effectively in the National Environmental Policy Act (NEPA) process. The Commission, of course, has no intention of letting that happen. Accordingly, the Commission proposes to alter its current practice and no longer protect location information. In addition, the Commission proposes to establish means for affected landowners and other parties to obtain necessary information for them to participate effectively in the Commission proceedings. As discussed below in III.C.3 and III.D., these proposals should help avoid any negative impact on Commission proceedings.

3. Information on Location of Facilities

30. The NOI asked to what extent the Commission should protect location information. Some respondents maintained that location information and other information that is available from other sources or from visual observation should not be considered to be CEII. Reliant Energy HL & P and others, however, voiced concern over releasing such information. The Commission has concluded that there is little to be gained by protecting information that can be gleaned from a visual inspection of the facility, or that is otherwise easily attainable from other sources, such as the United States Geological Survey or commercial mapping firms. Even where location information may not be readily available elsewhere, the public often wants to know specifically where these facilities are located, especially to the extent that they may pose a potential threat to health, safety, property, or the environment. In addition, it is difficult, if not impossible, to conduct a thorough NEPA review without providing specific information about the location of facilities. For the foregoing reasons, proposed § 388.113(c)(1)(iv) excludes from the definition of CEII information that simply gives the location of critical infrastructure.

4. Elements of CEII Definition

31. In light of these considerations, proposed § 388.113(c)(1) defines CEII as information about proposed or existing critical infrastructure that (i) relates to the production, generation, transportation, transmission, or distribution of energy, (ii) could be useful to persons in planning an attack on critical infrastructure, (iii) is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552, and (iv) does not simply give the location of the critical infrastructure. Proposed § 388.113(c)(2), in turn, defines “critical infrastructure” as “systems and assets, whether physical or virtual, that are so vital to the United States that the incapacity or destruction of such systems or assets would have a debilitating impact on the security, national economic security, national public health or safety, or any combination of those matters.” The Commission has chosen this meaning of the term “critical infrastructure” because it appropriately reflects the same definition contained in sec. 1016(d) (Critical Infrastructure Protection Act of 2001) of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (USA PATRIOT Act) Pub. L. No. 107-56. As especially relevant, this Act considers the energy infrastructure to be vital to the United States by explicitly finding that “[p]rivate business, government, and the national security apparatus increasingly depend on an interdependent network of critical physical and information infrastructures, including telecommunications, energy, financial services, water and transportation sectors.” Pub. L. 107-56, sec. 1016(b)(2) (emphasis added).

D. Requester's Status and Need for the Information

32. An overwhelming majority of respondents claimed that Federal requesters, owners/operators and their agents, interveners, and state agencies should have access to CEII. Many also approved of access by affected landowners. In addition, most respondents suggested that the Commission condition access on a requester's willingness to sign a non-disclosure agreement. Conversely, many respondents objected to the media's receiving CEII because they would undoubtedly refuse to limit disclosure of the information. The same concern arose to a lesser extent with respect to third-party requesters.

33. The respondents who disagreed with restricting access to CEII generally argued that everyone should be given access to this information, and that access should not be restricted to those with a specific need or those who are willing to sign a nondisclosure agreement. OMB Watch argued that the public does not have to demonstrate a need to know in order to get information under the FOIA. Several parties contended that the best ways to protect the infrastructure are to facilitate infrastructure expansion and to make the markets function effectively. They claimed that free access to CEII-type information is key to both of these things, and that potential investors need to know where there is a need for new capacity. Potential buyers and sellers of power, they contended, also need to know what is available in the market.

34. The Commission may take a requester's status into consideration if the request is not made pursuant to the FOIA and its FOIA regulations, because, as OMB Watch pointed out, only FOIA precludes a requester's status from being taken into account. See OMB Watch at p. 2. This is no different from the Commission's consideration of a person's status in a docketed proceeding, where it does not, for example, entertain rehearing requests from someone who has not timely intervened in the case. See Panhandle Eastern Pipe Line Co., 78 FERC ¶ 61,180 (1997). The important point here is that anyone, regardless of status, may always request information under the Commission's FOIA regulations. A person's status would be considered only to ascertain eligibility to receive information through the optional procedures for accessing CEII as laid out in proposed § 388.113(d). Pivotal to that determination would be the person's need for the information.

35. Specifically, proposed § 388.113(d)(1) provides that an owner/operator of an energy facility may always have access to information concerning that facility, and may receive the information directly from staff without using the FOIA or CEII procedures. This exemption reflects the obvious need that an owner/operator has for information to operate his facility and to comply with the law and the terms and conditions of the authorizing instrument. This exemption also reflects the Commission's view that owners/operators have as much interest in protecting their assets, employees, and other property and people as the Commission does. Next, proposed § 388.113(d)(2) provides than an agent of an owner/operator needs to obtain the information from the owner/operator, who would either have the information because it created the document or would be able to obtain the information from the Commission pursuant to proposed § 388.113(d)(1).

36. For all other non-FOIA requests, proposed § 388.113(d)(3) sets forth a process where requesters would provide to a CEII Coordinator detailed information about themselves and their need for the information, which the CEII Coordinator would use in determining whether to release the information. Such need would be implicated, for example, if the requester is an intervener in a proceeding or a landowner affected by a proposed facility. Obviously, such individuals must have access to information to participate meaningfully in the proceeding.

37. To enable the CEII Coordinator to make these determinations on a timely basis, and to ensure that requesters' rights are adequately protected, the Commission proposes, in § 375.313, to delegate the authority to make need determinations to the staff member designated as the CEII Coordinator. Accordingly, a non-FOIA requester would not have to file a motion with the Commission as it would otherwise be required to do outside the FOIA process. As action on motions is discretionary, the requester would not have any assurance, given the Commission's extraordinary caseload, as to when it would receive an answer. In contrast, under proposed § 388.113(d)(3)(iii), the requester would receive a response in accord with the timing associated with FOIA requests, viz., 20-30 business days depending on whether an extension is warranted. See 18 CFR 388.108(c). Furthermore, as action taken by the CEII Coordinator would be subject to rehearing by the Commission itself, as is true for all delegated matters, a requester would always be able to plead its case accordingly.

38. Finally, the Commission believes that market participants will be able to get access to the information they need without the Commission making the information available to the general public. As discussed above, they can seek access under § 388.113. In addition, as several respondents noted, much of the same sort of information is still available, albeit perhaps in slightly different form. For instance, Southern Company Services, Inc. pointed out that “for all practical purposes, the information contained in some of these filings [that have been removed from public access under PL02-1-000] is now being provided on OASIS, on a more timely basis and in a more useful format, thereby obviating the need for certain forms.” Even respondents who did not agree with the Commission's current approach recognized that much of the same type of information is available elsewhere. The significance here for protecting CEII is that the FERC would not be making the information available to everyone on the Internet.

E. Verification and Access Issues

39. Most respondents who approved of limited access to CEII also approved of the use of Passwords, IDs, PINs, etc. Others suggested use of outside experts (e.g., the Federal Bureau of Investigation and the Office of Homeland Security) to verify identity of requesters. At this time, the Commission does not believe that the use of outside experts is necessary. The majority of market participants are well known to the Commission, and therefore relatively easy to verify.

40. The NOI also inquired whether the Commission should verify an organization and leave it up to the organization to verify its own users, or whether the Commission should verify each user separately. While it would be easier to administer the program if the Commission does not have to keep track of all individual users within a particular organization, for the time being the Commission proposes to control all access to the information. This should help ensure a consistent approach, and will enable the Commission to account for disclosures made.

41. The NOI also raised the issue of whether elimination of all Internet access to CEII would be sufficient to protect CEII. Elimination of all Internet access was not widely endorsed as the sole method of protecting CEII. Similarly, few respondents favored the idea of requiring various levels of verification depending on how a requester sought to access the information (via Internet, mail, in person, etc.). For those reasons, the Commission is not proposing such approaches.

42. Another issue is whether the Commission should give certain “frequent customers” generic approval to access CEII, or whether the Commission should require new authorization whenever an entity or person wants CEII on a new matter. Many respondents thought access should be based on a need to know, and that need to know should be established for each docket involving CEII. Others contended that frequent participants should be granted a generic clearance to obtain CEII. Although some of the administrative burden on requesters and staff would be reduced if some entities could be given generic access, for now, the Commission proposes to require requesters to submit separate requests for CEII relating to different proceedings. In this way, a requester's need for information relating to a particular proceeding may be evaluated, and the number of people getting access to CEII in any given matter may be limited, lessening the likelihood that the information will reach someone with bad intentions.

F. Use of Non-Disclosure Agreements

43. Related to a requester's need to know is the issue of whether requesters should have to sign non-disclosure agreements (NDAs) as a condition of accessing CEII. Most respondents commented that the majority of recipients should sign NDAs, although several believed that owner/operators (and sometimes their agents/representatives) should not have to sign NDAs to receive information about their own facilities. Given that owners/operators have incentives to protect CEII, the Commission does not propose to require them to sign NDAs. The Commission also does not intend to require representatives of owner/operators to sign NDAs; however, as provided in proposed § 388.113(d)(2), the representatives must obtain CEII directly from or through the owners/operators rather than from the Commission.

44. The Commission also does not propose to require other Federal agencies to sign NDAs before receiving CEII. The reason is that 44 U.S.C. 3510(b) binds employees of other agencies to protect information that is protected by the originating agency, so an NDA would not be required where the Commission shares CEII with another Federal agency. A more difficult issue pertains to state agency requesters. Respondents rightly are concerned about state agencies' ability to agree to NDAs given state FOIA laws that may compel disclosure of information. In other words, while a state requester may have the best intentions to protect CEII, state law may mandate release of the information obtained from the Commission. As a general matter, however, Federal law preempts state law. Thus, the Federal FOIA law may trump state FOIA law where the information at issue is Federal information. The Commission invites comments on whether it would be appropriate to permit use of a modified NDA for state agency representatives wherein they would agree to protect the information to the extent permitted by Federal law. Another option might be for the Commission to reserve control of CEII documents “on loan” to state agencies, potentially taking the documents outside of the state FOIA law.

45. Most respondents thought the Commission should negotiate the NDAs with requesters, while a few thought that a CEII submitter should negotiate an agreement with the requester. There may be too much potential for charges of discriminatory treatment if the Commission leaves it to the discretion of the owner/operator whether to provide information, and under what conditions to provide it. For that reason, and for the sake of consistency, the Commission proposes in § 388.113(d)(3)(ii) to handle negotiation of all NDAs. Accordingly, that proposed section directs the CEII Coordinator to evaluate a requester's need for the information and propose terms for the NDA, where appropriate. That said, there is nothing to prevent someone from attempting to obtain CEII directly from the submitter, but the submitter would be under no obligation to agree to provide the information directly to the requester unless there is an independent obligation to do so.

G. Submission of CEII to the Commission

46. The Commission's existing regulations at 18 CFR 388.112 provide a process for filers to submit documents with a request for privileged treatment. The Commission proposes to amend § 388.112 to clarify that claims for privileged treatment should indicate whenever a filing contains CEII. Because the Commission proposes to adopt the approach in § 388.112 for filing CEII, it does not specify how the filer should segregate or redact non-public information from the rest of the filing. As with non-CEII, the filer must in the first instance decide whether to have a separate non-public appendix, or to just redact non-public information from the filing. While filers must take their obligation to protect CEII seriously, the Commission cautions that it will not tolerate filers invoking CEII inappropriately by sweeping non-CEII (or other legitimate confidential information) under the CEII heading. Such abuse of the CEII process could dilute its effectiveness by numbing the staff and parties to the importance of protecting the information. If the Commission finds that filers are not being careful in their submittals, especially if there is any evidence of a pattern of inappropriate claims of privileged treatment, the Commission will take steps to discipline those filers.

H. Challenges to CEII Status

47. Most respondents maintained that 18 CFR 388.112 provides a satisfactory vehicle for challenges to claims for CEII status. The Commission agrees, and in § 388.112(a) clarifies that people filing documents containing CEII should follow the procedures in § 388.112. Respondents also indicated that the Commission should broaden § 388.112 to clarify that it covers exemptions other than just Exemption 4. For example, § 388.112(e) currently is limited to situations where a FOIA requester brings suit to gain access to confidential commercial information, the type normally exempt under Exemption 4. The Commission agrees that the rule should be broadened to cover all requests for privileged information, and proposes to revise the regulation at § 388.112(a) and (e) to make clear that it applies to any information exempt from mandatory release under FOIA. Finally, respondents also urged that all procedural steps in § 388.112 should be followed for challenges to CEII status. The Commission agrees in part. The procedures should apply where staff on its own initiative questions the applicability of CEII status, or where there is a non-FOIA request through the CEII Coordinator. For this reason, the Commission is revising § 388.112(d) and (e) to apply to both FOIA requests and other CEII requests. However, the provision in 388.112(f) regarding notification of suit in Federal courts is not being revised to apply to CEII requests. Because any suit regarding CEII in Federal court would be brought under the Federal Power Act, the Natural Gas Act, or another enabling statute, jurisdiction would be in the United States Courts of Appeals. Accordingly, under Rule 15(c) of the Federal Rules of Appellate Procedure, a petitioner seeking review of a Commission order must serve a copy of the petition on all parties in the Commission proceeding. Therefore, no modification to § 388.112(f) is necessary.

IV. Information Collection Statement

48. Office of Management and Budget (OMB) regulations require OMB to approve certain information collection requirements imposed by agency rule. The following collection of information contained in this proposed rule has been submitted to the Office of Management and Budget (OMB) for review under Section 3707(d) of the Paperwork Reduction Act of 1995. FERC identifies the information provided for under Part 388.113 as FERC-603.

49. Comments are solicited on the need for this information, whether the information will have practical utility, the accuracy of the provided burden estimates, ways to enhance the quality, utility, and clarity of the information to be collected, and any suggested methods for minimizing respondents' burden, including the use of automated information techniques. The following burden estimates include the cost of preparing and submitting a CEII data request in order to comply with the Commission's proposed regulations.

Public Reporting Burden: Estimated Annual Burden:

Total Annual Hours for Collection (reporting + recordkeeping, if appropriate): 50 hours.

Information Collection Costs: The Commission seeks comments on the cost to comply with these requirements. It has projected the average annualized cost of all respondents to be: Annualized Capital Startup Costs: The Commission estimates that to respond to this information collection will be a one-time cost of $12.50 per respondent. (50 hours @ $50 hourly rate ÷ 200).

Title: FERC-603, CEII Data Request.

Action: Proposed Data Collection.

OMB Control No.: To be determined.

The applicant shall not be penalized for failure to respond to this collection of information unless the collection of information displays a valid OMB control number or the Commission has provided justification as to why the control number should not be displayed.

Respondents: Businesses or other for profit; Individuals or households; Not for profit institutions, and/or State, Local or Tribal Governments.

Frequency of Responses: On occasion.

Necessity of the Information: The proposed rule would revise the Commission's regulations to provide an alternative process to the Freedom of Information Act for requesting CEII. The Commission is proposing a process where requesters will provide basic information about themselves and explain their need for the information, which the Commission will factor into a determination as to whether to release the information. The purpose of the process is to provide information to individuals who need it to participate in the Commission's proceedings, but who might not otherwise have access to the information under FOIA.

50. Interested persons may obtain information on the reporting requirements by contacting the following: Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426 [Attention: Michael Miller, Office of the Chief Information Officer, Phone (202) 502-8415, fax: (202) 208-2425, E-mail: michael.miller@ferc.gov.] For submitting comments concerning the collection of information(s) and the associated burden estimate(s), please send your comments to the contact listed above and to the Office of Management and Budget, Office of Information and Regulatory Affairs, Washington, DC 20503, [Attention: Desk Officer for the Federal Energy Regulatory Commission, phone: (202) 395-7856, fax: (202)395-7285].

V. Environmental Analysis

51. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment. The Commission has categorically excluded certain actions from this requirement as not having a significant effect on the human environment. Included in the exclusions are rules that are clarifying, corrective, or procedural or that do not substantively change the effect of the regulations being amended. This proposed rule, if finalized, is procedural in nature and therefore falls under this exception; consequently, no environmental consideration would be necessary.

VI. Regulatory Flexibility Act Certification

52. The Regulatory Flexibility Act of 1980 (RFA) generally requires a description and analysis of final rules that will have significant economic impact on a substantial number of small entities. The Commission is not required to make such analyses if a rule would not have such an effect. The Commission certifies that this proposed rule, if finalized, would not have such an impact on small entities.

VII. Comment Procedures

53. The Commission invites interested persons to submit written comments on the matters and issues proposed in this notice to be adopted, including any related matters or alternative proposals that commenters may wish to discuss. Comments are due October 15, 2002. Comments must refer to Docket Nos. PL02-1 and RM02-4, and may be filed either in electronic or paper format. Those filing electronically do not need to make a paper filing.

54. Documents filed electronically via the Internet may be prepared in a variety of formats, including WordPerfect, MS Word, Portable Document Format, Rich Text Format, or ASCII format, as listed on the Commission's Web site at http://ferc.gov,, under the e-Filing link. The e-Filing link provides instructions for how to Login and complete an electronic filing. First time users will have to establish a user name and password. The Commission will send an automatic acknowledgment to the sender's E-Mail address upon receipt of comments. User assistance for electronic filing is available at 202-502-8258 or by e-Mail to efiling@ferc.gov. Comments should not be submitted to the E-Mail address.

55. For paper filings, the original and 14 copies of such comments should be submitted to the Office of the Secretary, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426.

56. All comments will be placed in the Commission's public files and will be available for inspection in the Commission's Public Reference Room at 888 First Street, NE., Washington, DC 20426, during regular business hours. Additionally, all comments may be viewed, printed, or downloaded remotely via the Internet through FERC's Homepage using the FERRIS link.

VIII. Document Availability

57. In addition to publishing the full text of this document in the Federal Register, the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the Internet through FERC's Home Page ( http://www.ferc.gov ) and in FERC's Public Reference Room during normal business hours (8:30 a.m. to 5:00 p.m. Eastern time) at 888 First Street, NE., Room 2A, Washington, DC 20426.

58. From FERC's Home Page on the Internet, this information is available in the Federal Energy Regulatory Records Information System (FERRIS). The full text of this document is available on FERRIS in PDF and WordPerfect format for viewing, printing, and/or downloading. To access this document in FERRIS, type the docket number excluding the last three digits of this document in the docket number field.

59. User assistance is available for FERRIS and the FERC's website during normal business hours from our Help line at (202) 502-8222 or the Public Reference Room at (202) 502-8371 (Press 0), TTY (202) 502-8659. E-Mail the Public Reference Room at public.referenceroom@ferc.gov.

List of Subjects

18 CFR Part 375

• Authority delegations (Government agencies)
• Seals and insignia
• Sunshine Act

18 CFR Part 388

• Confidential business information
• Freedom of information

In consideration of the foregoing, the Commission proposes to amend parts 375 and 388, Chapter I, Title 18, Code of Federal Regulations as follows:

PART 375—THE COMMISSION

1. The authority citation for part 375 continues to read as follows:

Authority: 5 U.S.C. 551-557; 15 U.S.C. 717-717w, 3301-3432; 16 U.S.C. 791-825r, 2601-2645, 42 U.S.C. 7101-7352.

2. Add § 375.313 to subpart C to read as follows:

PART 388—INFORMATION AND REQUESTS

1. The authority citation for part 388 continues to read as follows:

Authority: 5 U.S.C. 301-305, 551, 552 (as amended), 553-557; 42 U.S.C. 7101-7352.

2. Section 388.112 is revised to read as follows: