The Federal Energy Regulatory Commission should make a number of modifications to its proposed regulations to carry out Congress’s directives on critical electric infrastructure, as set forth in the Fixing America’s Surface Transportation Act of 2015, or FAST Act, the American Public Power Association told the commission on Aug. 19 (Docket No. RM16-15-000).
In response to growing cyber and physical security threats, as well as testimony from the commission that it needed new information protection authorities, Congress passed the FAST Act last year.
Section 61003 of the FAST Act amended the Federal Power Act to create a new section, Section 215A, that authorizes the commission and the Department of Energy to enact extensive new measures to protect sensitive but unclassified information related to critical electric infrastructure. Among other things, Section 215A requires FERC, in consultation with DOE, to promulgate regulations for designating, protecting and voluntary sharing of “critical electric infrastructure information,” or CEII – Electric.
In comments submitted to FERC, APPA said it appreciates the commission’s work to implement Section 61003 of the FAST Act, “as well as the commission’s long-standing commitment to protecting sensitive energy sector information.” However, the public power group said, “we believe the proposal can be improved to more fully embrace” Congress’s intent.
In its Aug. 19 comments to FERC, APPA pointed out that the commission has proposed to meld the new CEII – Electric designation into the FERC’s existing regulations for critical energy infrastructure information or CEII – Energy. In doing this, FERC is “adopting a ‘one size fits all’ approach that does not implement the specific authority and responsibilities given the commission under FPA Section 215A,” APPA said. “This hybrid framework is not the significant step forward in sensitive electricity subsector information protection that Congress intended.”
FERC should adopt new CEII – Electric regulations
Instead, APPA said, the commission “should adopt new CEII – Electric regulations separate from its existing CEII – Energy regulations that feature heightened disclosure protections, and acknowledge FPA Section 215A’s exemption of CEII – Electric from disclosure under all federal, state, local, and tribal public disclosure laws.”
In addition, as directed by Congress, the commission “should develop criteria and procedures to address DOE’s role in designating CEII – Electric, clarify the commission’s and DOE’s relationship in the removal of CEII – Electric designations, and set forth sanctions for commissioners and others that make unauthorized CEII – Electric disclosures,” APPA said.
FERC also should clarify its interpretation of “critical electric infrastructure” through further discussion and examples, APPA said, adding that this “would provide stakeholders increased confidence that the information they mark as CEII – Electric will ultimately be treated as such.”
One of the core purposes of the new section that the FAST Act added to the Federal Power Act “is to facilitate information sharing of highly sensitive information about critical electric infrastructure, threats, vulnerabilities and protective measures, among those who need to know, while fully protecting such information from wider disclosure,” APPA said in its comments. “Access to this information should not fall in the same bucket as information needed for transmission planning or rate cases.”
The commission could set up a tiered system of CEII – Electric that uses varying levels of access restrictions, APPA suggested.
Clarify exemption under state laws as well as FOIA
APPA told FERC that the commission’s proposal fails to address Section 215A(d)(1)(B), which provides that CEII – Electric information “shall not be made available by any federal, state, political subdivision or tribal authority pursuant to any federal, state, political subdivision or tribal law requiring public disclosure of information or records.”
“The plain meaning of this language clearly indicates that the provision covers all state, local, and tribal equivalents to FOIA [the Freedom of Information Act],” APPA said.
“These exemptions from public disclosure law are critically important to APPA members, as they operate under both federal and state legal regimes,” APPA said, yet FERC’s proposal makes no mention of the exemption provided in Section 215A for general disclosure laws.
FERC also should clarify that “political subdivision” as used in Section 215A(d)(1)(B) includes any state or local governmental entity, “or any agency, authority, or instrumentality of any one or more of the foregoing, or any corporation which is wholly owned, directly or indirectly, by any one or more of” such entities, including municipal utilities and other public power agencies such as municipal joint action agencies, APPA said.
FERC urged to address DOE role
FERC should address DOE’s role in implementing FPA Section 215A, APPA said, pointing out that the statute assigns authority to both FERC and DOE to designate information as CEII-Electric and “establishes DOE as the lead sector-specific agency for cybersecurity for the energy sector.”
FERC “should better coordinate with DOE” on a number of issues associated with implementing FPA Section 215A, APPA said, adding that the commission should consider holding a joint technical conference with DOE on this topic, before promulgating proposed regulations for the designating and sharing of CEII – Electric.
Sanctions for FERC commissioners should be included
The commission also should outline sanctions for unauthorized disclosures of CEII – Electric information by its own commissioners, APPA said. The FERC proposal stops short of this, proposing instead “to refer reports of misconduct to the DOE inspector general.”
“The absence of sanctions for commissioners is an error,” the public power group said. “Not only can the commission sanction commissioners for the knowing and willful unauthorized disclosure of CEII – Electric, it must by statute adopt any necessary regulations to ‘ensure there are appropriate sanctions in place.’”
APPA pointed out that the commission has authority to impose civil penalties against “any person” who violates any provision of any commission rule under the FPA.
In addition, APPA noted the availability of criminal penalties under the FPA “for knowing and willful violations, by ‘any person,’ of commission rules or regulations” under the Act.
Noting that APPA has reviewed the draft comments on the FERC proposal that were submitted by the Edison Electric Institute, the National Rural Electric Cooperative Association and the Transmission Access Policy Study Group, the public power association asked FERC “to incorporate the specific recommendations of these entities” in any rule to carry out the provisions on critical electricity infrastructure in Section 215A of the Federal Power Act, as amended by the FAST Act.
By Jeannine Anderson