DHS and FERC Finalize Procedures for Critical Infrastructure Information Programs

The Department of Homeland Security (DHS) and the Federal Energy Regulatory Commission (FERC) each recently issued regulatory guidance addressing critical infrastructure protection. On September 1, DHS issued a Final Rule on Procedures for Handling Critical Infrastructure Information. On September 21, FERC issued a Final Rule and a Notice of Proposed Rulemaking (NOPR) on Critical Energy Infrastructure Information (CEII). In addition, on September 22, FERC issued an order approving the Spare Transformer Sharing Program. The following provides a brief synopsis of these recent issuances.

Protected Critical Infrastructure Information Program

Pursuant to the Critical Infrastructure Information Act of 2002 (CII Act), DHS issued a Final Rule on Procedures for Handling Critical Infrastructure Information. The Rule finalizes the procedures for the Protected Critical Infrastructure Information (PCII) Program governing the receipt, validation, handling, storage, marking, and use of critical infrastructure information (CII) voluntarily submitted to DHS. The Final Rule became effective on September 1, 2006.

The PCII Program seeks to encourage the private sector, which owns and operates over 85% of critical infrastructure, to voluntarily submit security-related information about this infrastructure by providing stringent limitations on the dissemination and use of submitted information. DHS will use the information to analyze infrastructure vulnerability for planning, preparedness, warnings, and other purposes related to preventing terrorist attacks in the United States and reducing the vulnerability of the United States to terrorism. The Final Rule enhances the protections accorded to submitters by clarifying many key provisions of the Interim Rule, thereby encouraging private sector participation in the program. The key provisions of the Final Rule address the following subjects:

Definition of Critical Infrastructure Information. CII is information not customarily in the public domain that is related to the security of critical infrastructure or protected systems, including information concerning actual or potential attacks, the ability of critical infrastructure to resist attacks, and any planned or past operational problem or solution regarding critical infrastructure.

• Submissions to the PCII Program. In addition to directly submitting information to the PCII Program Manager, CII may be submitted through properly trained and identified DHS field representatives and certain personnel designated PCII Program Officers in other federal agencies. The decision of whether to validate the submission remains with the PCII Program Office within DHS. Submissions not validated will be destroyed or returned to the submitter.
• Requirements for Protected Status. To qualify as PCII and be eligible for the accompanying safeguards and protections, submitters must voluntarily submit CII in good faith to a covered federal agency with an express statement that meets PCII requirements marking the submission. The submitted information is granted a presumption of protection when properly submitted and remains protected until it is deemed ineligible for PCII protection.
• Definition of Voluntary. Whether information is considered voluntarily submitted is determined at the time the CII is submitted. A submission is not voluntary if legally compelled by DHS, if previously submitted to DHS during a regulatory, licensing, or permitting proceeding, or if filed pursuant to Securities Exchange Commission requirements. Information submitted to DHS for the purpose of obtaining a DHS grant to secure critical infrastructure and applications for SAFETY Act Designation or Certification are considered voluntary.
• PCII Protections. Validated PCII submissions are protected from Freedom of Information Act disclosure, state and local disclosure laws, and use in civil litigation. PCII can be used or shared by DHS and other federal, state, and local agencies only for the purposes listed in the CII Act and not for other regulatory purposes. Validated submissions are not protected from use in federal and state criminal proceedings or from access by both Houses of Congress and the Comptroller General.
• Private Sector Implications. Although private sector participation in the PCII Program is voluntary, the final rule on the Procedures for Handling CII makes participation more appealing by simplifying the submission process, providing additional protections and safeguards for PCII, and clarifying the permitted uses of PCII by government entities with access to the information.

FERC Rules and Orders

FERC’s Final Rule on CEII clarifies and limits the definition of CEII and makes other procedural changes to aid in the processing of CEII requests. In the NOPR, the Commission seeks comments on revisions to its regulations regarding CEII requests, limiting the portions of forms and reports labeled CEII, and abolishing the non-Internet public (NIP) designation. The Final Rule and NOPR on CEII were published in the Federal Register on October 3, 2006. The Final Rule will become effective on November 3, 2006. Comments on the NOPR are due November 3, 2006.

FERC also issued an order approving the Spare Transformer Sharing Program application for blanket authorization to engage in future transfers of transformers. The order permits participating utilities to sell spare transformers to each other in order to restore service in the event of an attack on a utility substation.