116th CONGRESS 2d Session |
To amend the Federal Power Act to authorize the Federal Energy Regulatory Commission and the Secretary of Energy to offer assistance in securing the assets of the owners and operators of energy infrastructure against threats and increasing the security of the electric grid, and for other purposes.
May 12, 2020
Ms. Murkowski (for herself and Mr. Risch) introduced the following bill; which was read twice and referred to the Committee on Energy and Natural Resources
To amend the Federal Power Act to authorize the Federal Energy Regulatory Commission and the Secretary of Energy to offer assistance in securing the assets of the owners and operators of energy infrastructure against threats and increasing the security of the electric grid, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,
This Act may be cited as the “Energy Infrastructure Protection Act of 2020”.
It is the sense of Congress that—
(1) electrical energy is essential to civil society;
(2) the infrastructure that delivers electrical energy to the people of the United States has been vulnerable to attacks of varying scope for more than 100 years;
(3) with the ready availability of information about electric infrastructure, and the ease of international travel for individuals who seek to harm the United States, threats to electric infrastructure have multiplied in recent years;
(4) the geographic barriers of the Pacific Ocean and the Atlantic Ocean no longer provide sufficient protection for the people of the United States against threats to electric infrastructure, especially for threats coming from cyberspace;
(5) electric infrastructure around the world has been attacked during times of war and times of peace, on the ground and in cyberspace, by—
(A) individuals;
(B) criminal organizations; and
(C) foreign countries;
(6) like electric infrastructure, the fuel suppliers and other vendors who supply the electricity industry are vulnerable to attacks designed to disrupt electricity service;
(7) before and during World War II, the Federal Power Commission assisted owners and operators of energy infrastructure in defending the assets of those owners and operators;
(8) the Department of Energy and the Federal Energy Regulatory Commission carry on the legacy of security assistance established by the Federal Power Commission;
(9) the Department of Energy, assisted by the expertise at the National Laboratories, and utilizing the statutory role of the Department as the lead Federal agency for cybersecurity in the energy sector, has acted to assist owners and operators of electric infrastructure when those owners and operators defend their assets;
(10) the Federal Energy Regulatory Commission, utilizing the jurisdiction of the Commission over matters of cost recovery and electric reliability, has acted to assist owners and operators of electric infrastructure when those owners and operators defend their assets;
(11) owners and operators of electric infrastructure, entities involved with electric infrastructure, the Federal Energy Regulatory Commission, the Department of Energy, other Federal departments and agencies, States, and units of local government have information that—
(A) can be used by those who seek to harm the United States to disrupt electricity service; and
(B) should be protected from excessive disclosure; and
(12) owners and operators of electric infrastructure—
(A) have been acting to reduce the vulnerability of their assets; and
(B) should have better opportunities to further reduce the vulnerability of their assets.
SEC. 3. Protecting energy infrastructure.
(a) In general.—Part II of the Federal Power Act (16 U.S.C. 824 et seq.) is amended—
(1) by adding at the end the following:
(2) by redesignating section 215A (16 U.S.C. 824o–1) as section 230, and moving that section so as to appear at the beginning of subpart B (as added by paragraph (1)); and
(3) by inserting after section 201 (16 U.S.C. 824) the following:
(b) Definitions.—Section 230 of the Federal Power Act (as redesignated by subsection (a)(2)) is amended—
(1) in the section heading, by striking “Critical Electric Infrastructure Security” and inserting “Definitions”;
(A) in the matter preceding paragraph (1), by striking the subsection designation and heading and all that follows through “this section:” and inserting the following:
“In this subpart:”;
(B) in paragraph (1), by striking “such terms” and all that follows through “respectively.” and inserting “the terms in section 215(a).”;
(C) by redesignating paragraphs (2), (3), (4), (5), (6), (7), and (8) as paragraphs (3), (4), (5), (6), (8), (9), and (12), respectively;
(D) by inserting after paragraph (1) the following:
“(2) COMMISSION.—The term ‘Commission’ means the Federal Energy Regulatory Commission.”;
(E) in paragraph (3) (as so redesignated), by inserting “energy infrastructure or” after “means”;
(F) by striking paragraph (4) (as so redesignated) and inserting the following:
“(4) CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION.—
“(A) IN GENERAL.—The term ‘critical electric infrastructure information’ means information relating to critical electric infrastructure, or proposed critical electric infrastructure, that—
“(i) is generated by, or provided to, the Secretary, the Commission, or any other Federal department or agency;
“(ii) is not classified national security information; and
“(iii) is designated as critical electric infrastructure information by the Secretary or the Commission under section 231(c) or 235.
“(B) INCLUSIONS.—The term ‘critical electric infrastructure information’ includes any information that qualified as critical energy infrastructure information under the regulations of the Commission in effect on the day before the date of enactment of the Energy Infrastructure Protection Act of 2020.”;
(G) in paragraph (5) (as so redesignated), by striking “subsection (c)” and inserting “section 231(b)”;
(H) by inserting after paragraph (6) (as so redesignated) the following:
“(7) ENERGY INFRASTRUCTURE.—The term ‘energy infrastructure’ includes—
“(A) systems or assets comprising the bulk-power system;
“(B) systems or assets owned by electric utilities;
“(i) allow for the transportation of fuel, electricity, water, steam, heat, cold, or any commodity that is used in the provision of electricity service; and
“(ii) facilitate the delivery of—
“(I) electrical energy to consumers;
“(II) wholesale transactions in electrical energy; or
“(III) the import or export of electrical energy; and
“(D) all systems or assets subject to the jurisdiction of the Commission, including—
“(i) pipelines for the transportation of oil;
“(ii) natural gas pipelines; and
“(iii) water resources.”;
(I) by inserting after paragraph (9) (as so redesignated) the following:
“(10) NATURAL GAS; NATURAL-GAS COMPANY.—The terms ‘natural gas’ and ‘natural-gas company’ have the meanings given the terms in section 2 of the Natural Gas Act (15 U.S.C. 717a).
“(11) OIL; OIL PIPELINE.—The terms ‘oil’ and ‘oil pipeline’ have the meanings given the terms in section 1804 of the Energy Policy Act of 1992 (42 U.S.C. 7172 note; Public Law 102–486).”; and
(J) by inserting after paragraph (12) (as so redesignated) the following:
“(13) SOURCE OF THE INFORMATION.—The term ‘source of the information’ means—
“(A) the electric utility, Transmission Organization, natural-gas company, licensee, or oil pipeline that provides to the Secretary or the Commission, as applicable, critical electric infrastructure information, including—
“(i) critical electric infrastructure information that is provided directly to the Secretary or the Commission by the electric utility, Transmission Organization, natural-gas company, licensee, or oil pipeline; and
“(ii) critical electric infrastructure information that is provided to the Secretary or the Commission by an intermediary;
“(B) the Secretary, with respect to critical electric infrastructure information that is created by the Secretary;
“(C) the Commission, with respect to critical electric infrastructure information that is created by the Commission; and
“(D) with respect to any critical electric infrastructure information not described in subparagraphs (A) through (C), the individual or entity that provides to the Secretary or the Commission, as applicable, the critical electric infrastructure information.”; and
(3) by inserting before subsection (b) the following:
(c) Critical electric infrastructure security.—Section 231 of the Federal Power Act (as designated by subsection (b)(3)) is amended—
(1) by redesignating subsections (b) through (f) as subsections (a) through (e), respectively;
(2) in paragraph (6)(B) of subsection (a) (as so redesignated), by striking “subsection (c)” and inserting “subsection (b)”;
(3) in subsection (c) (as so redesignated)—
(i) in the matter preceding subparagraph (A), by striking “Not later” and all that follows through “shall” and inserting “Each of the Secretary and the Commission, after consultation with the other, shall”;
(ii) in subparagraph (A), by adding “and” at the end after the semicolon;
(iii) in subparagraph (B), by striking the semicolon at the end and inserting a period; and
(iv) by striking subparagraphs (C) and (D);
(B) by striking paragraph (3) and inserting the following:
“(A) IN GENERAL.—The Secretary and the Commission may each designate information as critical electric infrastructure information pursuant to the criteria and procedures established by the Secretary or the Commission, as applicable, under paragraph (2)(A).
“(B) SUBMISSION OF REQUEST FOR DESIGNATION.—
“(i) IN GENERAL.—Any individual or entity may request that—
“(I) the Secretary designate information in the possession of the Secretary as critical electric infrastructure information; and
“(II) the Commission designate information in the possession of the Commission as critical electric infrastructure information.
“(ii) TREATMENT OF INFORMATION SUBMITTED FOR DESIGNATION.—On receipt of a request under clause (i), the Secretary or the Commission, as applicable, shall treat the information that is the subject of the request as critical electric infrastructure information until the earlier of—
“(I) the date on which the Secretary or the Commission, as applicable, designates the information as critical electric infrastructure information; and
“(II) the date that is 21 days after the date on which the Secretary or the Commission, as applicable, provides written notice to the individual or entity that submitted the request that the request is denied.
“(C) CONFLICTS BETWEEN DESIGNATIONS BY THE SECRETARY AND THE COMMISSION.—
“(i) INITIAL MEETING.—In the event of a conflict between a designation made by the Secretary and a designation made by the Commission as to whether certain information is critical electric infrastructure information, and the conflict has a material impact on the work of the Secretary or the Commission, the Secretary and the Commission shall confer to resolve the conflict for the purpose of achieving consistency across the Federal Government in the designation of the information.
“(ii) UNRESOLVED CONFLICTS.—If the Secretary and the Commission are unable to resolve a conflict under clause (i)—
“(I) the Commission may continue to designate any information in the possession of the Commission according to the criteria and procedures established by the Commission under paragraph (2)(A); and
“(II) the Secretary may continue to designate any information in the possession of the Department of Energy according to the criteria and procedures established by the Secretary under paragraph (2)(A).”;
(i) by striking “In implementing” and all that follows through “shall” and inserting the following:
“(A) IN GENERAL.—In implementing this section, the Secretary and the Commission shall reasonably attempt to”; and
(ii) by adding at the end the following:
“(B) EFFECT OF FAILURE TO SEGREGATE INFORMATION.—A failure to segregate any particular information under subparagraph (A) shall not result in an inference or finding that the information should not be entitled to protection as critical electric infrastructure information.”;
(D) by striking paragraphs (9) and (10) and inserting the following:
“(9) DURATION OF DESIGNATION.—
“(A) IN GENERAL.—Except as provided in subparagraph (B), information may not be designated as critical electric infrastructure information for a period longer than the information is related to energy infrastructure in service.
“(B) REDESIGNATION.—Any information may be redesignated by the Secretary or the Commission as critical electric infrastructure information before, on, or after the date on which an earlier designation has expired.
“(C) VULNERABILITIES AND THREATS.—Information about a vulnerability or threat to energy infrastructure, or the planning and construction of a system or asset that is intended to address a vulnerability or threat to energy infrastructure, may be designated as critical electric infrastructure information—
“(i) for the period during which the vulnerability or threat exists; and
“(ii) for any additional period determined to be appropriate by the Secretary or the Commission, as applicable.
“(10) REMOVAL OF DESIGNATION.—The Secretary or the Commission, as applicable, shall remove the designation of critical electric infrastructure information, in whole or in part, from a document or electronic communication if the Secretary or the Commission, as applicable, determines that the unauthorized disclosure of the information so designated could no longer be used to impair the security or reliability of energy infrastructure, the bulk-power system, or distribution facilities.”; and
(E) by adding at the end the following:
“(12) NO IMMEDIATE OBLIGATION TO DESIGNATE.—Any request for designation submitted to the Secretary or the Commission need not be considered by the Secretary or the Commission, as applicable, until the information that is the subject of the request for designation becomes the subject of any request to disclose, including a request under—
“(A) section 552 of title 5, United States Code; or
“(B) any applicable law (including any Federal, State, political subdivision, or Tribal law) requiring public disclosure of information or records.
“(13) EFFECT OF PRIOR DETERMINATIONS.—A prior determination by the Secretary or the Commission that certain information is not critical electric infrastructure information shall not affect the authority of the Secretary or the Commission to later designate that information as critical electric infrastructure information.”; and
(4) in subsection (e) (as so redesignated)—
(A) in paragraph (1), by striking “subsection (b)(1)” and inserting “subsection (a)(1)”;
(B) in paragraph (2), by striking “subsection (b)(1)” and inserting “subsection (a)(1)”;
(C) in paragraph (3), by striking “subsection (d)” and inserting “subsection (c) or any of sections 232 through 235, as applicable”; and
(i) by striking “subsection (b)(1)” and inserting “subsection (a)(1)”; and
(ii) by striking “paragraph (1) or (2 )” and inserting “paragraph (1) or (2)”.
(d) Assistance, access, and enforcement.—Subpart B of part II of the Federal Power Act (as added by subsection (a)(1)) is amended by adding at the end the following:
“SEC. 232. Authority of the Commission to offer assistance to owners and operators of energy infrastructure.
“(a) Definition of eligible entity.—In this section, the term ‘eligible entity’ means—
“(1) an authority of a State, political subdivision, or Indian Tribe;
“(2) a Transmission Organization;
“(3) an electric utility;
“(4) a natural-gas company;
“(5) an oil pipeline; and
“(6) any other owner or operator of energy infrastructure.
“(b) Voluntary assistance on request.—On request of an eligible entity, the Commission may provide assistance to the eligible entity—
“(1) by reviewing the configuration of the assets of the eligible entity against threats;
“(2) by reviewing the capability of the eligible entity to operate its assets after attacks on those assets;
“(3) by providing information about methods and tools that owners and operators of energy infrastructure may use to defend assets against threats;
“(4) by providing information regarding other resources that may be available to assist the eligible entity; and
“(5) by reviewing data and other assets in the possession of the eligible entity—
“(A) for evidence that the data or other asset—
“(i) has been tampered with; or
“(ii) has otherwise been the subject of threat activity; and
“(B) while ensuring an adequate chain of custody to enable criminal investigation and prosecution.
“(1) PROTECTION OF INFORMATION.—Any information collected or created by the Commission in carrying out activities under subsection (b), including any report prepared under subsection (g)(1)(A)—
“(A) to the extent that the information is not already designated as critical electric infrastructure information, shall be handled by the Commission as if it had been designated by the Commission as critical electric infrastructure information under this subpart;
“(B) shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code; and
“(C) shall not be made available by any Federal, State, political subdivision, or Tribal authority under any applicable law requiring public disclosure of information or records.
“(A) CONSENT REQUIRED.—Subject to subparagraph (C), if the source of any information described in paragraph (1) provides consent, the Commission may share that information with—
“(i) the Electric Reliability Organization;
“(ii) a regional entity;
“(iii) an information sharing and analysis center; or
“(iv) an authority of a State, political subdivision, or Indian Tribe that is involved in protecting energy infrastructure from threats.
“(B) ADVANCE CONSENT.—Consent to the disclosure of information by the Commission under subparagraph (A) may—
“(i) be provided in advance of the disclosure of that information to, or the creation of that information by, the Commission; and
“(ii) be a condition precedent to obtaining assistance from the Commission under this section.
“(C) LIMITATION.—Any information that is shared with an authority described in subparagraph (A)(iv) shall be exempt from disclosure by the authority as if that information were in the possession of the Commission under this subsection.
“(3) RELEASE TO FEDERAL AUTHORITIES.—
“(A) CONSENT NOT REQUIRED.—The Commission may share any information described in paragraph (1) with a Federal authority regardless of whether the source of that information consents to the disclosure.
“(B) LIMITATION.—Any information that is shared with a Federal authority under subparagraph (A) shall be exempt from disclosure by the Federal authority as if that information were in the possession of the Commission under this subsection.
“(1) IN GENERAL.—An eligible entity may withdraw a request for assistance under subsection (b) at any time.
“(2) EFFECT.—On withdrawal of a request under paragraph (1), the Commission shall—
“(A) terminate all assistance; and
“(B) to the maximum extent practicable, and subject to any Federal law applicable to the Commission regarding retention of records, return to the eligible entity all information that the Commission received from the eligible entity.
“(1) INFORMATION PROVIDED FOR ASSISTANCE.—Any information that is provided by an eligible entity to the Commission for the purpose of obtaining assistance under subsection (b) may not be used as a basis for any order, rule, opinion, or decision of the Commission.
“(2) INFORMATION OBTAINED BY OTHER MEANS.—Subject to applicable law, if the information described in paragraph (1) is obtained by the Commission in a manner other than the manner described in that paragraph, the Commission may use that information in any manner that the Commission determines to be appropriate if—
“(A) the Commission segregates the information described in paragraph (1) from information that is obtained by the Commission in a manner not described in that paragraph; and
“(B) the information described in paragraph (1) has been and is reviewed only by individuals authorized by the Commission to provide assistance under subsection (b).
“(3) INFORMAL STAFF ADVICE.—An officer, employee, agent, or contractor of the Commission may advise an eligible entity that information provided to the Commission for the purpose of obtaining assistance under subsection (b) should also be provided to the Commission for purposes unrelated to assistance under subsection (b).
“(f) Effect.—Nothing in this section—
“(1) authorizes the Commission to require any eligible entity to adopt any advice, report, recommendation, best practice, finding, model, tool, method, plan, analysis, or assessment made by the Commission under this section; or
“(2) relieves an eligible entity from any obligation to comply with a lawful order or rule of the Commission.
“(g) Reports for eligible entities.—
“(1) IN GENERAL.—The Commission may prepare reports—
“(A) for an eligible entity that requests assistance under subsection (b); and
“(B) for eligible entities generally.
“(2) AUTHORITY.—The Commission shall have sole discretion to prepare a report under paragraph (1).
“(3) REQUIREMENT.—A report under paragraph (1) shall not identify an eligible entity without the consent of that eligible entity.
“(4) EFFECT.—A report under paragraph (1)—
“(A) shall not be binding on the Commission; and
“(B) shall not relieve an eligible entity from any obligation to comply with any applicable order or rule of the Commission.
“(h) Savings clause.—Nothing in this section affects in any manner the authority, existing on the day before the date of enactment of the Energy Infrastructure Protection Act of 2020, of—
“(1) the Electric Reliability Organization;
“(2) a regional entity;
“(3) an information sharing and analysis center; or
“(4) a component of any Federal department or agency other than the Commission, including the authority provided to—
“(A) the Cybersecurity and Infrastructure Security Agency;
“(B) the national cybersecurity and communications integration center established under section 2209(b) of the Homeland Security Act of 2002 (6 U.S.C. 659(b)); and
“(C) the Sector-Specific Agency specified in section 61003(c)(2) of the FAST Act (6 U.S.C. 121 note; Public Law 114–94).
“SEC. 233. Authority of the Secretary to offer assistance to owners and operators of energy infrastructure.
“(a) Definition of eligible entity.—In this section, the term ‘eligible entity’ means—
“(1) an authority of a State, political subdivision, or Indian Tribe;
“(2) a Transmission Organization;
“(3) an electric utility;
“(4) a natural-gas company;
“(5) an oil pipeline; and
“(6) any other owner or operator of energy infrastructure.
“(b) Voluntary assistance on request.—On the request of an eligible entity, the Secretary may provide assistance to the eligible entity—
“(1) by reviewing the configuration of the assets of the eligible entity against threats;
“(2) by reviewing the capability of the eligible entity to operate its assets after attacks on those assets;
“(3) by providing information about methods and tools that owners and operators of energy infrastructure may use to defend their assets against threats;
“(4) by providing information regarding other resources that may be available to assist the eligible entity;
“(5) by reviewing data and other assets in the possession of the eligible entity—
“(A) for evidence that the data or other asset—
“(i) has been tampered with; or
“(ii) has otherwise been the subject of threat activity; and
“(B) while ensuring an adequate chain of custody to enable criminal investigation and prosecution;
“(6) by monitoring sensor data and other information flows of the eligible entity; and
“(7) by testing equipment and other assets of the eligible entity.
“(c) Research and planning.—The Secretary shall carry out a program—
“(1) to gather information about the tools and methods that have been used to penetrate or defend any eligible entity or industrial control system, including information about those tools and methods that is available from—
“(A) the Department of Homeland Security;
“(B) the Department of Defense;
“(C) any other Federal department or agency; and
“(D) any eligible entity;
“(2) to research and plan to ensure that the Federal Government has access to energy infrastructure during a time of war or national crisis; and
“(3) to research and plan the response of the Secretary in the event that owners and operators of energy infrastructure are attacked.
“(1) PROTECTION OF INFORMATION.—Any information collected or created by the Secretary in carrying out activities under subsection (b), including any report prepared under subsection (h)(1)(A)—
“(A) to the extent that the information is not already designated as critical electric infrastructure information, shall be handled by the Secretary as if it had been designated by the Secretary as critical electric infrastructure information under this subpart;
“(B) shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code; and
“(C) shall not be made available by any Federal, State, political subdivision, or Tribal authority under any applicable law requiring public disclosure of information or records.
“(A) CONSENT REQUIRED.—Subject to subparagraph (C), if the source of any information described in paragraph (1) provides consent, the Secretary may share that information with—
“(i) the Electric Reliability Organization;
“(ii) a regional entity;
“(iii) an information sharing and analysis center; or
“(iv) an authority of a State, political subdivision, or Indian Tribe that is involved in protecting energy infrastructure from threats.
“(B) ADVANCE CONSENT.—Consent to the disclosure of information by the Secretary under subparagraph (A) may—
“(i) be provided in advance of the disclosure of that information to, or the creation of that information by, the Secretary; and
“(ii) be a condition precedent to obtaining assistance from the Secretary under this section.
“(C) LIMITATION.—Any information that is shared with an authority described in subparagraph (A)(iv) shall be exempt from disclosure by the authority as if that information were in the possession of the Secretary under this subsection.
“(3) RELEASE TO FEDERAL AUTHORITIES.—
“(A) CONSENT NOT REQUIRED.—The Secretary may share any information described in paragraph (1) with a Federal authority regardless of whether the source of that information consents to the disclosure.
“(B) LIMITATION.—Any information that is shared with a Federal authority under subparagraph (A) shall be exempt from disclosure by the Federal authority as if that information were in the possession of the Secretary under this subsection.
“(1) IN GENERAL.—An eligible entity may withdraw a request for assistance under subsection (b) at any time.
“(2) EFFECT.—On withdrawal of a request under paragraph (1), the Secretary shall—
“(A) terminate all assistance; and
“(B) to the maximum extent practicable, and subject to any Federal law applicable to the Secretary regarding retention of records, return to the eligible entity all information that the Secretary received from the eligible entity.
“(1) INFORMATION PROVIDED FOR ASSISTANCE.—Any information that is provided by an eligible entity to the Secretary for the purpose of obtaining assistance under subsection (b) may not be used as a basis for any order, rule, opinion, or decision of the Secretary.
“(2) INFORMATION OBTAINED BY OTHER MEANS.—Subject to applicable law, if the information described in paragraph (1) is obtained by the Secretary in a manner other than the manner described in that paragraph, the Secretary may use that information in any manner that the Secretary determines to be appropriate if—
“(A) the Secretary segregates the information described in paragraph (1) from information that is obtained by the Secretary in a manner not described in that paragraph; and
“(B) the information described in paragraph (1) has been and is reviewed only by individuals authorized by the Secretary to provide assistance under subsection (b).
“(3) INFORMAL STAFF ADVICE.—An officer, employee, agent, or contractor of the Secretary may advise an eligible entity that information provided to the Secretary for the purpose of obtaining assistance under subsection (b) should also be provided to the Secretary for purposes unrelated to assistance under subsection (b).
“(g) Effect.—Nothing in this section—
“(1) authorizes the Secretary to require any eligible entity to adopt any advice, report, recommendation, best practice, finding, model, tool, method, plan, analysis, or assessment made by the Secretary under this section; or
“(2) relieves an eligible entity from any obligation to comply with a lawful order or rule of the Secretary.
“(h) Reports for eligible entities.—
“(1) IN GENERAL.—The Secretary may prepare reports—
“(A) for an eligible entity that requests assistance under subsection (b); and
“(B) for eligible entities generally.
“(2) AUTHORITY.—The Secretary shall have sole discretion to prepare a report under paragraph (1).
“(3) REQUIREMENT.—A report under paragraph (1) shall not identify an eligible entity without the consent of that eligible entity.
“(4) EFFECT.—A report under paragraph (1)—
“(A) shall not be binding on the Secretary; and
“(B) shall not relieve an eligible entity from any obligation to comply with any applicable order or rule of the Secretary.
“(i) Savings clause.—Nothing in this section affects in any manner the authority, existing on the day before the date of enactment of the Energy Infrastructure Protection Act of 2020, of—
“(1) the Electric Reliability Organization;
“(2) a regional entity;
“(3) an information sharing and analysis center; or
“(4) a component of any Federal department or agency other than the Department of Energy, including the authority provided to—
“(A) the Cybersecurity and Infrastructure Security Agency; and
“(B) the national cybersecurity and communications integration center established under section 2209(b) of the Homeland Security Act of 2002 (6 U.S.C. 659(b)).
“SEC. 234. Access to critical electric infrastructure information.
“(1) IN GENERAL.—Except as provided in paragraph (2), and subject to subsections (c) and (e), the Secretary or the Commission, as applicable, shall not disclose or release critical electric infrastructure information to any individual or entity.
“(A) IN GENERAL.—Subject to subparagraph (B), the Secretary or the Commission, as applicable, may disclose critical electric infrastructure information—
“(i) to the source of the information;
“(ii) to a party or participant in a proceeding before the Secretary or the Commission, if—
“(I) the information is relevant to that proceeding; and
“(II) each individual seeking access to the information has entered into a nondisclosure agreement with the source of the information;
“(iii) to an individual who is an officer, employee, agent, or contractor of the Secretary or the Commission;
“(iv) to an officer, employee, agent, or contractor of—
“(I) the Electric Reliability Organization;
“(II) a regional entity; or
“(III) an information sharing and analysis center;
“(v) to an officer, employee, agent, or contractor of the Federal Government;
“(vi) to the President, the National Security Council, a member of Congress, a Federal judge or magistrate, or any officer of the United States appointed by the President with the advice and consent of the Senate;
“(vii) to an individual who is an officer, employee, agent, or contractor of Congress, the Executive Office of the President, or a court created under article I or III of the Constitution of the United States;
“(viii) to a landowner the property of which has a boundary that is crossed by, or located within the vicinity of, energy infrastructure, as determined by the Secretary or the Commission, as applicable, if—
“(I) the landowner provides to the Secretary or the Commission, as applicable, proof of the property interest of the landowner; and
“(II) the critical electric infrastructure information consists of detailed alignment sheets concerning actual or proposed energy infrastructure within the vicinity of the property boundary, as determined by the Secretary or the Commission, as applicable;
“(ix) to an officer, employee, agent, or contractor of an authority of a State, political subdivision, or Indian Tribe, if each individual seeking access to the information has entered into a nondisclosure agreement with the Secretary or Commission, as applicable;
“(x) to an individual holding a security clearance at the level of top secret or higher; or
“(xi) to any other individual, if—
“(I) the source of the information has given express consent to the disclosure of the information to the individual; and
“(II) a nondisclosure agreement between the source of the information and each individual seeking access to the information has been approved by—
“(aa) an administrative law judge of, or assigned to, the Department of Energy; or
“(bb) an administrative law judge of, or assigned to, the Commission.
“(B) DISCLOSURE FOR ACADEMIC, SCIENTIFIC, OR RESEARCH PURPOSES.—The Secretary or the Commission, as applicable, may disclose critical electric infrastructure information to an individual for academic, scientific, or research purposes, including academic, scientific, or research work that is conducted by the Department of Energy at any laboratory of the Department of Energy, if—
“(i) the individual holds a security clearance at the level of top secret or higher; or
“(ii) (I) the source of the information expressly consents to the disclosure of the information to the individual for the academic, scientific, or research work; and
“(II) a nondisclosure agreement between the source of the information and each individual seeking access to the information has been approved by—
“(aa) an administrative law judge of, or assigned to, the Department of Energy; or
“(bb) an administrative law judge of, or assigned to, the Commission.
“(C) AUTHORITY TO RETAIN INFORMATION.—
“(i) IN GENERAL.—The Secretary or the Commission, as applicable—
“(I) shall have no obligation to disclose critical electric infrastructure information to any individual or entity; and
“(II) may withhold disclosure of critical electric infrastructure information at any time, for any reason, at the sole discretion of the Secretary or the Commission, as applicable.
“(I) IN GENERAL.—If the Secretary or the Commission, as applicable, determines that the disclosure of critical electric infrastructure information to an individual or entity may jeopardize the common defense and security of the United States, the information shall not be disclosed to that individual or entity.
“(II) COORDINATION.—The Secretary shall share appropriate information and coordinate resources with the Commission to ensure compliance with the requirement described in subclause (I).
“(b) Nondisclosure agreements.—
“(1) IN GENERAL.—Each nondisclosure agreement entered into or approved under this section shall—
“(A) reflect the individual circumstances concerning the parties to the agreement;
“(B) permit the auditing of compliance with the agreement; and
“(C) be enforceable in law and equity by any district court of the United States.
“(2) MODIFICATION OF STANDARDIZED FORMS; DISPUTE RESOLUTION.—
“(i) USE OF STANDARDIZED FORMS PERMITTED.—Potential parties to a nondisclosure agreement may use a standardized form of agreement if that form is appropriate for the particular circumstances.
“(ii) MODIFICATION BY THE PARTIES.—Notwithstanding any policy or rule of the Secretary or the Commission relating to standardized forms of nondisclosure agreements, the express terms of a nondisclosure agreement shall be subject to appropriate revision by the parties to the agreement.
“(i) IN GENERAL.—Any dispute regarding a nondisclosure agreement, including any dispute regarding the terms of a proposed nondisclosure agreement or compliance with an existing nondisclosure agreement, shall be resolved by—
“(I) a district court of the United States;
“(II) an administrative law judge of, or assigned to, the Department of Energy; or
“(III) an administrative law judge of, or assigned to, the Commission.
“(I) IN GENERAL.—Any party to a proceeding to resolve a dispute described in clause (i) who is aggrieved by an order issued by an administrative law judge under that clause may obtain review of that order in a district court of the United States by filing, in accordance with subclause (II), a petition for review in—
“(aa) the United States District Court for the District of Columbia; or
“(bb) the district court of the United States for the judicial district in which any party to the nondisclosure agreement resides.
“(II) PETITION FOR REVIEW.—A petition for review of any order subject to review under subclause (I) shall—
“(aa) be filed not later than 30 days after the date on which the administrative law judge issues the order; and
“(bb) request that the order be modified or set aside in whole or in part.
“(3) OPTION FOR FEDERAL FORM OF NONDISCLOSURE AGREEMENT.—The Secretary or the Commission, as applicable, may require an individual seeking access to critical electric infrastructure information from the Secretary or the Commission to enter into a nondisclosure agreement with the Secretary or the Commission, as applicable, in addition to any nondisclosure agreement entered into by that individual with the source of the information.
“(c) Disclosure of indicators, methods, and tools.—Notwithstanding subsection (a)(1), the Secretary or the Commission, as applicable, may disclose indicators, methods, and tools that have been used in penetrating or defending energy infrastructure if—
“(1) the source of the information consents to the release of that information; and
“(2) the Secretary or the Commission, as applicable, removes all information that would enable an individual to identify the source of the information.
“(d) Protection of information.—Any critical electric infrastructure information that is disclosed by the Secretary or the Commission under subsection (a)(2), or that is required to be disclosed under a rule issued pursuant to subsection (e)(2)—
“(1) shall be protected from disclosure by the recipient;
“(2) shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code; and
“(3) shall not be made available by any Federal, State, political subdivision, or Tribal authority under any applicable law requiring public disclosure of information or records.
“(1) INFORMATION CONTROLLED BY OWNERS AND OPERATORS OF ENERGY INFRASTRUCTURE.—Nothing in this section limits the ability of an owner or operator of energy infrastructure to handle the information controlled by that owner or operator, including information that could be designated as critical electric infrastructure information, in whatever manner the owner or operator believes will best serve the interests of the owner or operator, including—
“(A) by exchanging that information with other owners or operators of energy infrastructure; and
“(B) by providing that information to officers, employees, agents, and contractors of the owner or operator.
“(2) DISCLOSURE TO CERTAIN INDIVIDUALS AND ENTITIES.—
“(A) IN GENERAL.—Except as provided in subparagraph (C), nothing in this section limits the ability of the Commission to issue or enforce a rule of general applicability requiring a public utility to disclose certain critical electric infrastructure information to an eligible recipient described in subparagraph (B) that requests the information.
“(B) ELIGIBLE RECIPIENT DESCRIBED.—An eligible recipient referred to in subparagraph (A) is—
“(i) an electric utility;
“(ii) a potential or existing interconnection customer of the public utility;
“(iii) a potential or existing transmission customer of the public utility;
“(iv) a State regulatory authority; or
“(v) a member of the public.
“(C) REQUIREMENTS.—Any rule described in subparagraph (A) issued or enforced by the Commission shall—
“(i) require that each request for critical electric infrastructure information be disclosed to the source of the information;
“(ii) require disclosure only if each individual seeking access to critical electric infrastructure information has entered into a nondisclosure agreement with the source of the information;
“(iii) provide that the source of the information shall have no liability for damages associated with misuse of the critical electric infrastructure information that results in an attack on energy infrastructure; and
“(iv) with respect to a request submitted by a member of the public, require disclosure only after each individual seeking access to critical electric infrastructure information has entered into a nondisclosure agreement with the source of the information that has been approved by—
“(I) an administrative law judge of, or assigned to, the Department of Energy; or
“(II) an administrative law judge of, or assigned to, the Commission.
“SEC. 235. Designating information held by other governmental authorities.
“(a) Definition of eligible entity.—In this section:
“(1) IN GENERAL.—The term ‘eligible entity’ means—
“(A) a Federal, State, political subdivision, or Tribal authority; and
“(B) a utility owned or operated by 1 or more of the authorities described in subparagraph (A), including a joint action agency or similar entity.
“(2) EXCLUSIONS.—The term ‘eligible entity’ does not include—
“(A) the Secretary; or
“(B) the Commission.
“(b) Request for designation.—An eligible entity may submit to the Secretary or the Commission a request to designate information that is in the possession and control of the eligible entity as critical electric infrastructure information by providing to the Secretary or the Commission, as applicable, a description of—
“(1) the nature of the information for which the designation is requested; and
“(2) the basis for the designation.
“(c) Timing; effect; future information.—
“(A) SUBMISSION.—A request under subsection (b) may be submitted to the Secretary or the Commission at any time, including after disclosure of the relevant information has been requested under any applicable law requiring public disclosure of information or records.
“(B) TREATMENT OF SUBMITTED INFORMATION.—On receipt of a request under subsection (b), the Secretary or the Commission, as applicable, shall treat the information that is the subject of the request as critical electric infrastructure information until the earlier of—
“(i) the date on which the Secretary or the Commission, as applicable, designates the information as critical electric infrastructure information; and
“(ii) the date that is 21 days after the date on which the Secretary or Commission, as applicable, provides written notice to the eligible entity that submitted the request that the request is denied.
“(A) EFFECT OF REQUEST FOR PUBLIC DISCLOSURE.—The submission of a request to the Secretary or the Commission under subsection (b) after a request for public disclosure of the relevant information has been made shall not prejudice any decision with respect to whether the information should be designated as critical electric infrastructure information.
“(B) EFFECT OF FAILURE TO TIMELY ACT ON SUBMISSION.—If the Secretary or the Commission, as applicable, fails to grant or deny a request submitted under subsection (b) by the date that is 1 year after the date on which the request is submitted, the information that is the subject of the request shall be designated as critical electric infrastructure information for a period of 10 years beginning on the date on which the request is submitted.
“(3) FUTURE INFORMATION.—A submission to the Secretary or the Commission under subsection (b) may concern—
“(A) existing information; or
“(B) information that is expected to be created after the date of the submission, including any information that is expected to be created on a periodic or ongoing basis.
“(d) Responsibility for a defense.—An eligible entity for which the Secretary or the Commission, as applicable, has granted a request to designate certain information as critical electric infrastructure information under this section, or for which information has been designated as critical electric infrastructure information for a period of 10 years under subsection (c)(2)(B)—
“(1) shall not request that the Secretary or the Commission provide a defense against any claim for disclosure of the designated information; and
“(2) shall be entirely responsible for a defense, including by paying for a defense, against any claim for disclosure of the designated information under—
“(A) section 552 of title 5, United States Code; or
“(B) any other applicable law (including any Federal, State, political subdivision, or Tribal law) requiring public disclosure of information or records.
“(e) Disclosure and release of information.—
“(1) IN GENERAL.—Except as provided in paragraph (2)—
“(A) any information that is in the possession and control of an eligible entity shall not be subject to section 234(d); and
“(B) an eligible entity may establish standards for the disclosure or release of information in the possession and control of the eligible entity.
“(2) PROTECTION OF CERTAIN INFORMATION.—Any critical electric infrastructure information that is disclosed to an eligible entity by the Secretary or the Commission under section 234(a)(2) or by a public utility under a rule issued pursuant to section 234(e)(2) shall be subject to section 234(d).
“(a) In general.—Whenever Congress declares that a state of war exists, or in the event of a national disaster due to enemy attack, the Secretary and the Commission are authorized, during the state of war or period of national disaster due to enemy attack, to confer with individuals and grant individuals access to critical electric infrastructure information pending further investigation of those individuals.
“(b) Limitation.—The Secretary and the Commission may confer with individuals and grant individuals access to critical electric infrastructure information under subsection (a) only to the extent that, and for so long as, the Secretary or the Commission finds that such action is required to prevent impairment of the activities of the Secretary or the Commission that are in furtherance of the common defense and security.
“SEC. 237. Enforcement and sanctions.
“(a) Enforcement.—Any individual who fails to return critical electric infrastructure information by the date that is 90 days after the date on which the individual is served with a demand by the Secretary or the Commission to return that critical electric infrastructure information shall be subject to enforcement under sections 314, 316, and 316A.
“(1) SANCTIONS BY THE COMMISSION.—The Commission shall ensure that appropriate sanctions are in place for—
“(A) any Commissioner or former Commissioner who knowingly and willfully discloses critical electric infrastructure information in a manner that is not authorized under this subpart, with sanctions to include, at a minimum—
“(i) the potential loss of access to critical electric infrastructure information; and
“(ii) the potential public issuance of letters of reprimand; and
“(B) any officer, employee, agent, or contractor of the Commission who knowingly and willfully discloses critical electric infrastructure information in a manner that is not authorized under this subpart.
“(2) SANCTIONS BY THE SECRETARY.—The Secretary shall ensure that appropriate sanctions are in place for any officer, employee, agent, or contractor of the Secretary who knowingly and willfully discloses critical electric infrastructure information in a manner that is not authorized under this subpart.”.
(1) Section 201 of the Federal Power Act (16 U.S.C. 824) is amended—
(i) by striking “215A,” each place it appears;
(ii) in the first sentence, by inserting “and subpart B” after “and 222”; and
(iii) in the second sentence, by striking “222,” and inserting “222 or subpart B”; and
(i) by striking “215A,”; and
(ii) by inserting “or subpart B” after “or 222”.
(2) Section 6003(c)(1)(A) of the FAST Act (6 U.S.C. 121 note; Public Law 114–94) is amended by striking “section 215A” and inserting “section 230”.