(a) Filing Procedures and guidance. Information regarding critical electric infrastructure information (CEII) filing procedures and further guidance for submitters and requesters is available on the website of the United States Department of Energy's Office of Electricity at https://www.energy.gov/oe/office-electricity.
(b) Purpose and scope. This part sets forth the regulations of the Department of Energy (DOE) that implement section 215A(d) of the Federal Power Act (FPA), codified at 16 U.S.C. 824o-1(d). The regulations in this part set forth the DOE procedures for the designation, sharing, and protection of CEII. This section applies to anyone who provides CEII to DOE or who receives CEII from DOE, including DOE employees, DOE contractors, and agents of DOE or of other Federal agencies, as well as individuals or organizations providing CEII or submitting a request for CEII designation to DOE or who have requested or have been permitted access to CEII by DOE.
(c) Definitions—(1) Bulk-Power System means the facilities and control systems necessary for operating an interconnected electric energy transmission network (and any portion thereof), and electric energy from generation facilities needed to maintain transmission system reliability. The term does not include facilities used in the local distribution of electric energy.
(2) Confidential Business Information means commercial or financial information that is both customarily and actually treated as private by its owner and that is provided to the government as part of a claimed CEII submission.
(3) Critical Electric Infrastructure means a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.
(4) Critical Electric Infrastructure Information (CEII) is defined at FPA section 215(a)(3), with designation criteria codified at 18 CFR 388.113(c). CEII means information related to critical electric infrastructure, or proposed critical electrical infrastructure, generated by or provided to FERC or another Federal agency, other than classified national security information, that is designated as CEII by FERC or the Secretary pursuant to section 215A(d) of the FPA. Such term includes information that qualifies as critical energy infrastructure information under FERC's regulations.
(5) CEII Coordinator means the Assistant Secretary or Principal Deputy Assistant Secretary of the DOE Office of Electricity, who shall coordinate and oversee the implementation of DOE's program for CEII-designation authority under section 215A of the FPA, assist all DOE Offices with respect to requests for CEII designation in determining whether particular information fits within the definition of CEII, and manage DOE's protection, storage, and sharing of CEII materials and oversight of the development of CEII international sharing protocols. The CEII Coordinator may delegate the daily implementation of the CEII Coordinator function as described in this rule, in whole or in part, to an appropriate DOE Office of Electricity official, to an Assistant Secretary in DOE, and to the Administrator of the Bonneville Power Administration, the Energy Information Administration, the Southeastern Power Administration, the Southwestern Power Administration, or the Western Area Power Administration (“Coordinator's designee”).
(6) Department means the United States Department of Energy.
(7) Department of Energy (DOE) means all organizational entities that are part of the Executive Department created by Title II of the DOE Organization Act (Pub. L. 95-91, 91 Stat. 565, 42 U.S.C. 7101 et seq.). For purposes of this Part, the definition of DOE specifically excludes the Federal Energy Regulatory Commission, which has promulgated its own CEII procedures at 18 CFR 388.113.
(8) DOE Office means any administrative or operating unit of DOE with authority at or above the level of Assistant Secretary, Principal Deputy Assistant Secretary, or Administrator.
(9) Secretary means the Secretary of Energy.
(d) Authority to designate information as CEII. The Secretary has the authority to designate information as CEII, in accordance with FPA section 215A. The Secretary may delegate the authority to designate information as CEII to any DOE Office.
(e) Coordination among DOE Office designators. The DOE CEII Coordinator shall be the primary point of contact for the submission of all requests for designation of information as CEII by DOE, as well as for requests made to DOE by organizations or individuals for information that may be protected, in whole or in part, as CEII.
(1) The CEII Coordinator or Coordinator's designee shall:
(i) Receive and review all incoming requests for CEII as defined in paragraph (c) of this section and in accordance with paragraph (g) of this section;
(ii) Make initial determinations as to whether particular information fits within the definition of CEII found in paragraph (c) of this section;
(iii) Assist any DOE Offices with delegated CEII designation authority to make determinations as to whether a particular requester's need for and ability and willingness to protect CEII warrants limited disclosure of the information to the requester;
(iv) Establish reasonable conditions for considering requests for release of CEII-designated material in accordance with paragraphs (g)(5) and (6) of this section;
(v) Make the Department's final determination regarding a request by any non-federal entity (organization or individual) for CEII-designated materials, in consultation with the appropriate DOE Office(s);
(vi) Notify a CEII submitter of a request for such information by a non-federal entity;
(vii) Convene a conference call between an affected DOE Office and a CEII submitter to discuss concerns related to a non-federal entity requesting release of CEII within no more than five (5) business days after the CEII submitter is notified of the request, providing the CEII submitter with a copy of the request prior to the conference call; and
(viii) Perform oversight of the DOE CEII program and establish guidance for the treatment, handling, and storage of all CEII materials in the Department in accordance with paragraph (g)(6) of this section, including those related to CEII international sharing protocols.
(2) DOE Offices with delegated authority to designate CEII in accordance with paragraph (d) of this section, as well as any CEII Coordinator designee(s), will meet regularly, at the discretion of the CEII Coordinator, but not less than once per year, to ensure coordinated implementation of DOE's CEII designation authority.
(3) DOE, at the discretion of the CEII Coordinator, shall meet with representatives from the Federal Energy Regulatory Commission semi-annually (or more often, as necessary) to ensure that both agencies are applying CEII designation criteria consistently and to share best practices.
(4) DOE, at the discretion of the CEII Coordinator, shall meet at least once per year with representatives from the Department of Commerce including the National Telecommunications and Information Administration, the Department of Homeland Security, the Nuclear Regulatory Commission, and other Federal agencies, as needed, to ensure shared understanding and consistent communication among Federal agencies that collect, maintain, and potentially release information that DOE may consider designating as CEII as defined in paragraph (c) of this section.
(f) CEII FOIA Exemption. All information designated by DOE as CEII is exempt from disclosure under the Freedom of Information Act, 5 U.S.C. 552(b)(3) and shall not be made available by any Federal, state, political subdivision, or tribal authority pursuant to any Federal, State, political subdivision, or tribal law requiring public disclosure of information or records pursuant to section 215A(d)(1)(A) and (B) of the Federal Power Act.
(g) Criteria and procedures for designating CEII—(1) Criteria. The CEII Coordinator or Coordinator's designee shall apply the definition of CEII as provided in paragraph (c) of this section, consistent with FPA section 215A(a)(3), and with designation criteria codified at 18 CFR 388.113(c), to information sought by DOE and to information submitted to DOE with a request for designation.
(2) Requesting CEII designation of information submitted to DOE. Any person or entity requesting that information submitted to DOE be designated as CEII must submit such request to the DOE CEII Coordinator or Coordinator's designee according to the following procedures:
(i) The submitter must clearly label the cover page and pages or portions of the information for which CEII treatment is requested in bold, capital lettering, indicating that it contains CEII, as appropriate, and marked “CEII—CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE.”
(ii) The submitter must clearly label the cover page and pages or portions of information that it considers Confidential Business Information in bold, capital lettering, indicating that it contains Confidential Business Information, as appropriate, and marked “CONFIDENTIAL BUSINESS INFORMATION—DO NOT RELEASE.” If combined with a CEII label, the information should be marked “CEII—CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION and CONFIDENTIAL BUSINESS INFORMATION—DO NOT RELEASE.”
(iii) The submitter must also clearly indicate the DOE Office(s) from which the CEII designation is being requested in bold, capital lettering on the cover page.
(iv) The submitter must also segregate those portions of the information that contain CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) wherever feasible.
(v) The submitter must also label and segregate information that it classifies as Confidential Business Information under the definition at paragraph (c)(2) of this section with the mark “CONFIDENTIAL BUSINESS INFORMATION—DO NOT RELEASE.” Under separate cover, the submitter may, but is not required to, submit a written justification of why the labeled information meets the definition at paragraph (c)(2) of this section.
(vi) The submitter must submit a public version of the information where information designated CEII and information for which CEII designation is requested is redacted or otherwise protected through extraction from the non-CEII to the DOE CEII Coordinator and the Coordinator's designee in an appropriate DOE Office, where feasible. If the entirety of submitted information is CEII, the submitter must indicate that, but no separate public version is required.
(3) Requesting CEII designation for information generated by DOE. Any DOE employees, DOE contractors, or agents of DOE requesting that information generated by the Department be designated as CEII must submit such request to the DOE CEII Coordinator or the Coordinator's designee in an appropriate DOE Office according to the following procedures:
(i) The submitter must clearly label the cover page and pages or portions of the information for which CEII treatment is requested in bold, capital lettering, indicating that it contains CEII, as appropriate, and marked “CEII—CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE.”
(ii) The submitter must also segregate those portions of the information that contain CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) wherever feasible.
(iii) The submitter must submit a public version of the information where information designated CEII and information for which CEII designation is requested is redacted or otherwise protected through extraction from non-CEII.
(iv) CEII designation for information generated by DOE, to include all organizational entities that are a part of the Executive Department created by Title II of the DOE Organization Act, may be executed at any time, regardless of when such information was generated, where feasible.
(4) Treatment of Submitted Information. (i) Upon receiving a request for CEII designation of information submitted to DOE, the DOE CEII Coordinator or Coordinator's designee shall review the submission made in accordance with paragraph (g)(2) of this section.
(ii) Information for which CEII treatment is requested will be maintained by the CEII Coordinator or Coordinator's designee in DOE's files as non-public unless and until DOE completes its determination that the information is not entitled to CEII treatment. This approach does not mean that DOE has made a determination regarding CEII designation, and should under no circumstances be construed as such. DOE will endeavor to make a determination as soon as practicable. The Department retains the right to make determinations about any request for CEII designation at any time, including the removal of a previously granted CEII designation. At such time that a determination is made that information does not meet the CEII criteria, DOE will follow the procedures for return of information not designated as CEII outlined in paragraph (g)(6)(iii) of this section.
(iii) When a requester seeks information for which CEII status has been requested but not designated, or when DOE itself is considering release of such information, DOE will render a decision on designation before responding to the requester or releasing such information. Subsequently, the release of information will be treated in accordance with the procedures established for CEII-designated material, or the return of information not designated as CEII.
(5) Evaluation of CEII designation criteria to inform CEII designation determination. (i) The DOE CEII Coordinator, or a Coordinator's designee, will execute the Department's evaluation as to whether the submitted information or portions of the information meets the definition of CEII, as described at paragraph (c)(2) of this section, with the appropriate DOE Office with delegated CEII designation authority. The DOE Office will designate submitted information as soon as practicable and will inform submitters of the designation date if requested at the time of submission.
(ii) [Reserved]
(6) CEII Determination. (i) DOE CEII Coordinator makes CEII designation determination. The Secretary or delegated DOE Office will make a determination regarding CEII designation after considering the information against the criteria for CEII designation. The DOE CEII Coordinator or Coordinator's designee shall promptly communicate the decision of the Secretary or delegated DOE Office to the submitter.
(ii) Review of determination. DOE reserves the right to review at any time information designated by DOE as CEII to determine whether the information is properly designated. The designation of information as CEII, or the removal of such designation, must be reviewed when:
(A) A FOIA request is submitted for the information under § 1004.10; or
(B) A request is made for reconsideration of the designation or removal of the designation under paragraph (i)(1) of this section.
(iii) Return of Information not designated as CEII. Because the submitter voluntarily provided the information to DOE, at the request of the submitter, DOE will return or destroy information for which CEII designation was requested but not granted, and will attempt to remove all copies of such information from DOE files, both physical and electronic. DOE shall return or destroy non-CEII consistent with the Federal Records Act, and DOE handling of agency records in accordance with DOE Order O.243.1A, Records Management Program, and related requirements and responsibilities for implementing and maintaining an efficient and economic records management program in accordance with law and regulatory requirements. DOE shall not remove electronic files in the ordinary course of business. If a submitter is required to provide information and DOE denies CEII designation, the submitter may file a request for review under the procedures.
(7) Protection of CEII—(i) Marking of CEII. All information designated by DOE as CEII, whether submitted to or generated by DOE, shall be clearly labeled as such, and shall include the date on which the information was designated as CEII. For information that meets the definition of CEII but cannot be physically labeled, such as electronic information, the information shall be—
(A) Electronically marked with the words “CEII—CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE” in the electronic file name; or
(B) Transmitted under a Non-Disclosure Agreement or other agreements or arrangements, such as those identified in paragraph (j)(3) of this section, to an electronic system where such information is stored in a secure electronic environment that identifies the stored information as CEII.
(ii) Protection and Exemption from Disclosure. All information designated by DOE as CEII is exempt from FOIA and shall not be made available as provided in paragraph (f) of this section.
(iii) Secure Storage. DOE will store information for which CEII treatment is requested in a secure place in a manner that would prevent unauthorized access (e.g. locked room or file cabinet). Information submitted to DOE in electronic format shall be stored in a secure electronic environment that identifies the stored information as CEII.
(8) Protection of Confidential Business Information—Exemption Determination. DOE will evaluate information claimed as Confidential Business Information if, and at such time as, a valid FOIA request is submitted and the information is otherwise responsive to the request. DOE will conduct the evaluation pursuant to procedures set forth in this part. In its evaluation, DOE will consult any supplementary justification provided by the submitter as described at paragraph (f)(1)(iv) of this section.
(h) Duration of designation. Designation of information as CEII shall be a five-year period, unless removed or re-designated.
(1) Expiration of designation. (i) The Secretary or delegated DOE Office will determine the duration of designation at the time of designation.
(ii) A submitter may re-apply for CEII designation no earlier than one year prior to the date of expiration of the initial designation or re-designation in accordance with the application procedures in paragraph (g)(1) of this section.
(iii) The Secretary, the DOE CEII Coordinator, or a Coordinator's designee may initiate CEII designation at any time prior to the date of expiration of the initial designation or re-designation.
(2) Removal of designation. The designation of information as CEII may be removed at any time, by the Secretary or the DOE CEII Coordinator in consultation with the DOE Office to which the Secretary has delegated the authority, in whole or in part, upon determination that the unauthorized disclosure of such information could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities or any other form of energy infrastructure. If the CEII designation is to be removed, the submitter and the DOE Office that produced or maintains the CEII will receive electronic notice stating that the CEII designation will be removed at least nine (9) business days before disclosure. In such notice, the DOE CEII Coordinator or Coordinator's designee will provide the submitter and the DOE Office that produced or maintains the CEII an opportunity (at least nine (9) business days) in which to comment in writing prior to the removal of the designation. The final determination will briefly explain DOE's determination.
(3) Treatment of information no longer designated as CEII. If a FOIA request is received for information for which CEII designation has expired or has been removed, DOE will work with the submitter to review whether the information is subject to other FOIA exemptions. DOE will destroy non-CEII consistent with the Federal Records Act, and DOE handling of agency records in accordance with DOE Order O.243.1A, Records Management Program, and related requirements and responsibilities for implementing and maintaining an efficient and economic records management program in accordance with law and regulatory requirements.
(i) Review or requests for reconsideration of designation—(1) Request for Reconsideration. (i) Any person who has submitted information and requested such information to be designated as CEII may request reconsideration of a DOE decision not to designate that information as CEII, or to remove an existing CEII designation, on grounds that the information does not meet the required CEII criteria. Within ten (10) business days of notification by DOE of its CEII decision, the person must file a request for reconsideration. The request must be sent to the DOE CEII Coordinator and Coordinator's designee through a secure electronic submission or by mail according to the instructions at 10 CFR 205.12. The request must also be sent to the DOE Office that made the decision at issue and to DOE's Office of General Counsel in Washington, DC, according to the instructions at 10 CFR 205.12. A statement in support of the request for reconsideration must be submitted within twenty (20) business days of the date of the determination. The request and the supporting statement will be considered submitted upon receipt by the Office of the General Counsel.
(ii) Any person who has received a decision denying a request for the release of CEII, in whole or in part, or a decision denying a request to change the designation of CEII, may request reconsideration of that decision. A statement in support of the request for reconsideration must be submitted to the DOE Office of the General Counsel within twenty (20) business days of the date of the determination.
(iii) The Secretary or the DOE Office that made the decision at issue will make a determination, in coordination with the DOE CEII Coordinator or Coordinator's designee, with respect to any request for reconsideration within twenty (20) business days after the receipt of the request and will notify the person submitting the request of the determination and the availability of judicial review.
(iv) Before seeking judicial review in Federal District Court under section 215A(d)(11) of the FPA, a person who received a determination from DOE concerning a CEII designation must first request reconsideration of that determination.
(v) A request for reconsideration triggers a stay of the underlying decision, except in instances where voluntary sharing of the disputed information is necessary for law enforcement purposes, to ensure reliable operation or maintenance of electric or energy infrastructure, to maintain infrastructure security, to address potential threats, or to address an urgent need to disseminate the information quickly due to an emergency or other unforeseen circumstance.
(j) Sharing of CEII—(1) Federal Entities. An employee of a Federal entity acting within the scope of his or her Federal employment may obtain CEII directly from DOE without following the procedures outlined in paragraph (k) of this section. DOE will evaluate requests by Federal entities for CEII on a programmatic, fact-specific basis. DOE may share CEII with affected agencies for those agencies to carry out their specific jurisdictional responsibilities, but it may impose additional restrictions on how the information may be used and maintained. To obtain access to CEII, an authorized agency employee must sign an acknowledgement and agreement that states the agency will protect the CEII in the same manner as the Department and will refer any requests for the information to the Department. Notice of each such request also must be given to the CEII Coordinator.
(2) Non-federal Entities. The Secretary or the CEII Coordinator shall make a final determination whether to share CEII materials requested by non-federal entities that are within the categories specified in section 215A(d)(2)(D) of the FPA. A request by such a non-federal entity shall not be entertained unless the requesting non-federal entity demonstrates that the release of information is in the national security interest and it has entered into a Non-Disclosure Agreement with DOE that ensures, at a minimum:
(i) Use of the information only for authorized purposes and by authorized recipients and under the conditions prescribed by the Secretary or CEII Coordinator;
(ii) Protection of the information in a secure manner to prevent unauthorized access;
(iii) Destruction or return of the information after the intended purposes of receiving the information have been fulfilled;
(iv) Prevention of viewing or access by individuals or organizations that have been prohibited or restricted by the United States or the Department from viewing or accessing CEII;
(v) Compliance with the provisions of the Non-Disclosure Agreement, subject to DOE audit;
(vi) No further sharing of the information without DOE's permission; and
(vii) CEII provided pursuant to the agreement is not subject to release under the Freedom of Information Act, 5 U.S.C. 552(b)(3), and shall not be made available by any Federal, state, political subdivision, or tribal authority pursuant to any Federal, State, political subdivision, or tribal law requiring public disclosure of information or records pursuant to sections 215A(d)(1)(A) and (B) of the Federal Power Act.
(viii) The Non-Disclosure Agreement must state that the agreement applies to all subsequent releases of CEII during the calendar year in which the DOE and the non-federal entity enter into the agreement. As a result, the non-federal entity will not be required to file a Non-Disclosure Agreement with subsequent requests during the calendar year.
(3) Security and Reliability Coordination. In accordance with section 215A(d)(2)(D) of the FPA, DOE may, taking into account standards of the Electric Reliability Organization, facilitate voluntary sharing of CEII with, between, and by Federal, State, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers or information sharing and analysis organizations; reliability coordinators; balancing authorities; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate. All entities receiving CEII must execute either a Non-Disclosure Agreement or an Acknowledgement and Agreement or participate in an Electric Reliability Organization or Regional Entity information sharing program that ensures the protection of CEII. A copy of each agreement or program will be maintained by the DOE Office with a copy to the CEII Coordinator or the Coordinator's designee. If DOE facilitates voluntary sharing of CEII under this subsection, DOE may impose additional restrictions on how the information may be used and maintained.
(4) International Sharing Protocols. The Secretary may delegate authority to DOE Offices to develop, after consultation with Canadian and Mexican authorities, protocols for the voluntary sharing of CEII with Canadian and Mexican authorities and owners, operators, and users of the bulk-power system outside the United States. The DOE CEII Coordinator or Coordinator's designee would provide assistance and advice to DOE Offices in the development of the international sharing protocols.
(5) Notice for Sharing of CEII not Generated by DOE. The DOE CEII Coordinator or Coordinator's designee will provide electronic notice to the CEII submitter no less than ten (10) business days before DOE releases CEII submitted to and not generated by DOE, except in instances where voluntary sharing is necessary for law enforcement purposes, to ensure reliable operation or maintenance of electric or energy infrastructure, to maintain infrastructure security, or to address potential threats; where there is an urgent need to quickly disseminate the information; or where prior notice is not practicable due to an emergency or other unforeseen circumstance. If prior notice is not given, DOE will provide notice as soon as practicable. The DOE CEII Coordinator or Coordinator's designee will convene a phone call within five (5) business days of electronic notice with the CEII submitter to discuss concerns about the proposed release of CEII-designated materials to the requester. DOE will make the final determination as to whether to share CEII not generated by DOE.
(k) Procedures for requesting CEII. DOE shall consider requests for CEII on a case-by-case basis. Any person requesting CEII must include the following material with the request:
(1) Contact Information. Provide your name, title and employer, work address, work phone number, and work email. If you are requesting the information on behalf of a person or entity other than yourself, you must also list that person's or entity's work contact information, including name, title, address, phone number, and email.
(2) Explanation of Need. Provide a detailed statement explaining the particular need for and intended use of the information. This statement must include:
(i) The extent to which a particular function is dependent upon access to the information;
(ii) Why the function cannot be achieved or performed without access to the information;
(iii) An explanation of whether other information is available to the requester that could facilitate the same objective;
(iv) How long the information will be needed;
(v) Whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and
(vi) An explanation of whether the information is needed expeditiously.
(3) Signed Non-Disclosure Acknowledgement/Agreement. Provide an executed Non-Disclosure Acknowledgement (if the requester is a Federal entity) or an executed Non-Disclosure Agreement (if the requester is not a Federal entity) requiring adherence to limitations on the use and disclosure of the information requested.
(4) DOE evaluation. Upon receiving a request for CEII, the CEII Coordinator shall contact the DOE Office or Federal agency that created or maintains the CEII. In consultation with the DOE Office, the CEII Coordinator shall carefully consider the statement of need provided by the requester and determine if the need for CEII and the protection afforded to the CEII should result in sharing CEII for the limited purpose identified in the request. If the CEII Coordinator or Coordinator's designee denies the request, the requestor may seek reconsideration, as provided in paragraph (i) of this section.
(l) Disclosure—(1) Disclosure by submitter of information. If the submitter of information deliberately discloses to the public information that has received a CEII designation, then the Department reserves the right to remove its CEII designation.
(2) Disciplinary Action for Unauthorized Disclosure. DOE employees or contractors who knowingly or willfully disclose CEII in an unauthorized manner will be subject to appropriate sanctions, including disciplinary action under DOE or DOE Office personnel rules or referral to the DOE Inspector General. Any action by a Federal or non-federal Entity who knowingly or willfully falsifies, conceals, or covers up by any trick, scheme, or device a material fact; makes any materially false, fictitious, or fraudulent statement or representation; or makes or uses any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry to obtain CEII may also constitute a violation of other applicable laws and is potentially punishable by fine and imprisonment.
(3) Whistleblower protection. In accordance with the Whistleblower Protection Enhancement Act of 2012 (Pub. L. 112-199, 126 Stat. 1465), the provisions of this rule are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute relating to:
(i) Classified information;
(ii) Communications to Congress;
(iii) The reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety; or
(iv) Any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling statutory provisions are not affected by this rule.
