FERC proposes FAST Act CEII rules

The Federal Energy Regulatory Commission has proposed amending its regulations designed to protect critical information about utility infrastructure.  If adopted, the new regulations would govern the treatment of Critical Energy/Electric Infrastructure Information (CEII) whose disclosure and misuse could put the electric grid at risk.

In the wake of the September 11, 2011 terrorist attacks, the Commission took steps to identify and protect sensitive information it considered "Critical Energy Infrastructure Information," or CEII.  In general, FERC defined CEII as specific engineering, vulnerability, or detailed design information about proposed or existing critical infrastructure (physical or virtual) that:

1. Relates details about the production, generation, transmission, or distribution of energy;
2. Could be useful to a person planning an attack on critical infrastructure;
3. Is exempt from mandatory disclosure under the Freedom of Information Act; and
4. Gives strategic information beyond the location of the critical infrastructure.

Some previously public material was designated as CEII, and going forward newly filed or issued documents had to be screened for CEII.  FERC also created a process to allow individuals with a valid or legitimate need to access CEII, while protecting it from other disclosure.

But last year, Congress weighed in on the protection of certain sensitive information about infrastructure.  The Fixing America's Surface Transportation (FAST) Act, signed into law on December 4, 2015, included provisions designed to improve the security and resilience of energy infrastructure in the face of emergencies.  In particular, the FAST Act added section 215A to the Federal Power Act, directing the Commission to issue regulations covering the security and sharing of "Critical Electric Infrastructure Information."

Federal Power Act section 215A(a)(3) defines the new term Critical Electric Infrastructure Information as:

information related to critical electric infrastructure, or proposed critical electrical infrastructure, generated by or provided to the Commission or other Federal agency, other than classified national security information... Such term includes information that qualifies as critical energy infrastructure information under the Commission’s regulations.

As interpreted by the Commission, this encompasses "not only information regarding the Bulk-Power System but also information regarding other energy infrastructure (i.e., gas pipelines, LNG, oil, and hydroelectric infrastructure) to the extent such information qualifies as Critical Energy Infrastructure Information under the Commission’s current regulations. "

On June 16, 2016, the Commission issued a Notice of Proposed Rulemaking, proposing to amend its regulations to implement the provisions of the FAST Act pertaining to the designation, protection and sharing of critical electric infrastructure information, and also proposing to amend its existing regulations pertaining to CEII. The proposed changes include criteria and procedures for designating information as CEII, a specific prohibition on unauthorized disclosure of that information, and sanctions for knowing and willful wrongful disclosure of CEII by federal personnel.

Comments on the Notice of Proposed Rulemaking are due 45 days after its publication in the Federal Register.