§ 824o–1 — Critical Electric Infrastructure Security

(a) For purposes of this section: (1) The terms “bulk-power system”, “Electric Reliability Organization”, and “regional entity” have the meanings given such terms in paragraphs (1), (2), and (7) of section 824o(a) of this title, respectively. (2) The term “critical electric infrastructure” means a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters. (3) The term “critical electric infrastructure information” means information related to critical electric infrastructure, or proposed critical electrical infrastructure, generated by or provided to the Commission or other Federal agency, other than classified national security information, that is designated as critical electric infrastructure information by the Commission or the Secretary pursuant to subsection (d). Such term includes information that qualifies as critical energy infrastructure information under the Commission’s regulations. (4) The term “defense critical electric infrastructure” means any electric infrastructure located in any of the 48 contiguous States or the District of Columbia that serves a facility designated by the Secretary pursuant to subsection (c), but is not owned or operated by the owner or operator of such facility. (5) The term “electromagnetic pulse” means 1 or more pulses of electromagnetic energy emitted by a device capable of disabling or disrupting operation of, or destroying, electronic devices or communications networks, including hardware, software, and data, by means of such a pulse. (6) The term “geomagnetic storm” means a temporary disturbance of the Earth’s magnetic field resulting from solar activity. (7) The term “grid security emergency” means the occurrence or imminent danger of— (i) a malicious act using electronic communication or an electromagnetic pulse, or a geomagnetic storm event, that could disrupt the operation of those electronic devices or communications networks, including hardware, software, and data, that are essential to the reliability of critical electric infrastructure or of defense critical electric infrastructure; and (ii) disruption of the operation of such devices or networks, with significant adverse effects on the reliability of critical electric infrastructure or of defense critical electric infrastructure, as a result of such act or event; or (i) a direct physical attack on critical electric infrastructure or on defense critical electric infrastructure; and (ii) significant adverse effects on the reliability of critical electric infrastructure or of defense critical electric infrastructure as a result of such physical attack. (8) The term “Secretary” means the Secretary of Energy. (1) Whenever the President issues and provides to the Secretary a written directive or determination identifying a grid security emergency, the Secretary may, with or without notice, hearing, or report, issue such orders for emergency measures as are necessary in the judgment of the Secretary to protect or restore the reliability of critical electric infrastructure or of defense critical electric infrastructure during such emergency. As soon as practicable but not later than 180 days after December 4, 2015, the Secretary shall, after notice and opportunity for comment, establish rules of procedure that ensure that such authority can be exercised expeditiously. (2) Whenever the President issues and provides to the Secretary a written directive or determination under paragraph (1), the President shall promptly notify congressional committees of relevant jurisdiction, including the Committee on Energy and Commerce of the House of Representatives and the Committee on Energy and Natural Resources of the Senate, of the contents of, and justification for, such directive or determination. (3) Before issuing an order for emergency measures under paragraph (1), the Secretary shall, to the extent practicable in light of the nature of the grid security emergency and the urgency of the need for action, consult with appropriate governmental authorities in Canada and Mexico, entities described in paragraph (4), the Electricity Sub-sector Coordinating Council, the Commission, and other appropriate Federal agencies regarding implementation of such emergency measures. (4) An order for emergency measures under this subsection may apply to— (A) the Electric Reliability Organization; (B) a regional entity; or (C) any owner, user, or operator of critical electric infrastructure or of defense critical electric infrastructure within the United States. (A) Except as provided in subparagraph (B), an order for emergency measures issued under paragraph (1) shall expire no later than 15 days after its issuance. (B) The Secretary may reissue an order for emergency measures issued under paragraph (1) for subsequent periods, not to exceed 15 days for each such period, provided that the President, for each such period, issues and provides to the Secretary a written directive or determination that the grid security emergency identified under paragraph (1) continues to exist or that the emergency measure continues to be required. (A) If the Commission determines that owners, operators, or users of critical electric infrastructure have incurred substantial costs to comply with an order for emergency measures issued under this subsection and that such costs were prudently incurred and cannot reasonably be recovered through regulated rates or market prices for the electric energy or services sold by such owners, operators, or users, the Commission shall, consistent with the requirements of section 824d of this title, after notice and an opportunity for comment, establish a mechanism that permits such owners, operators, or users to recover such costs. (B) To the extent the owner or operator of defense critical electric infrastructure is required to take emergency measures pursuant to an order issued under this subsection, the owners or operators of a critical defense facility or facilities designated by the Secretary pursuant to subsection (c) that rely upon such infrastructure shall bear the full incremental costs of the measures. (7) The Secretary, and other appropriate Federal agencies, shall, to the extent practicable and consistent with their obligations to protect classified information, provide temporary access to classified information related to a grid security emergency for which emergency measures are issued under paragraph (1) to key personnel of any entity subject to such emergency measures to enable optimum communication between the entity and the Secretary and other appropriate Federal agencies regarding the grid security emergency. (c) Not later than 180 days after December 4, 2015, the Secretary, in consultation with other appropriate Federal agencies and appropriate owners, users, or operators of infrastructure that may be defense critical electric infrastructure, shall identify and designate facilities located in the 48 contiguous States and the District of Columbia that are— (1) critical to the defense of the United States; and (2) vulnerable to a disruption of the supply of electric energy provided to such facility by an external provider. (1) Critical electric infrastructure information— (A) shall be exempt from disclosure under section 552(b)(3) of title 5; and (B) shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records. (2) Not later than one year after December 4, 2015, the Commission, after consultation with the Secretary, shall promulgate such regulations as necessary to— (A) establish criteria and procedures to designate information as critical electric infrastructure information; (B) prohibit the unauthorized disclosure of critical electric infrastructure information; (C) ensure there are appropriate sanctions in place for Commissioners, officers, employees, or agents of the Commission or the Department of Energy who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized under this section; and (D) taking into account standards of the Electric Reliability Organization, facilitate voluntary sharing of critical electric infrastructure information with, between, and by— (i) Federal, State, political subdivision, and tribal authorities; (ii) the Electric Reliability Organization; (iii) regional entities; (iv) information sharing and analysis centers established pursuant to Presidential Decision Directive 63; (v) owners, operators, and users of critical electric infrastructure in the United States; and (vi) other entities determined appropriate by the Commission. (3) Information may be designated by the Commission or the Secretary as critical electric infrastructure information pursuant to the criteria and procedures established by the Commission under paragraph (2)(A). (4) In exercising their respective authorities under this subsection, the Commission and the Secretary shall take into consideration the role of State commissions in reviewing the prudence and cost of investments, determining the rates and terms of conditions for electric services, and ensuring the safety and reliability of the bulk-power system and distribution facilities within their respective jurisdictions. (5) The Commission and the Secretary shall, in consultation with Canadian and Mexican authorities, develop protocols for the voluntary sharing of critical electric infrastructure information with Canadian and Mexican authorities and owners, operators, and users of the bulk-power system outside the United States. (6) Nothing in this section shall require a person or entity in possession of critical electric infrastructure information to share such information with Federal, State, political subdivision, or tribal authorities, or any other person or entity. (7) Nothing in this section shall permit or authorize the withholding of information from Congress, any committee or subcommittee thereof, or the Comptroller General. (8) In implementing this section, the Commission and the Secretary shall segregate critical electric infrastructure information or information that reasonably could be expected to lead to the disclosure of the critical electric infrastructure information within documents and electronic communications, wherever feasible, to facilitate disclosure of information that is not designated as critical electric infrastructure information. (9) Information may not be designated as critical electric infrastructure information for longer than 5 years, unless specifically re-designated by the Commission or the Secretary, as appropriate. (10) The Commission or the Secretary, as appropriate, shall remove the designation of critical electric infrastructure information, in whole or in part, from a document or electronic communication if the Commission or the Secretary, as appropriate, determines that the unauthorized disclosure of such information could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities. (11) Notwithstanding section 825l(b) of this title, with respect to a petition filed by a person to which an order under this section applies, any determination by the Commission or the Secretary concerning the designation of critical electric infrastructure information under this subsection shall be subject to review under chapter 7 of title 5, except that such review shall be brought in the district court of the United States in the district in which the complainant resides, or has his principal place of business, or in the District of Columbia. In such a case the court shall examine in camera the contents of documents or electronic communications that are the subject of the determination under review to determine whether such documents or any part thereof were improperly designated or not designated as critical electric infrastructure information. (e) The Secretary shall facilitate and, to the extent practicable, expedite the acquisition of adequate security clearances by key personnel of any entity subject to the requirements of this section, to enable optimum communication with Federal agencies regarding threats to the security of the critical electric infrastructure. The Secretary, the Commission, and other appropriate Federal agencies shall, to the extent practicable and consistent with their obligations to protect classified and critical electric infrastructure information, share timely actionable information regarding grid security with appropriate key personnel of owners, operators, and users of the critical electric infrastructure. (1) Except as provided in paragraph (4), to the extent any action or omission taken by an entity that is necessary to comply with an order for emergency measures issued under subsection (b)(1), including any action or omission taken to voluntarily comply with such order, results in noncompliance with, or causes such entity not to comply with any rule, order, regulation, or provision of this chapter, including any reliability standard approved by the Commission pursuant to section 824o of this title, such action or omission shall not be considered a violation of such rule, order, regulation, or provision. (2) Except as provided in paragraph (4), an action or omission taken by an owner, operator, or user of critical electric infrastructure or of defense critical electric infrastructure to comply with an order for emergency measures issued under subsection (b)(1) shall be treated as an action or omission taken to comply with an order issued under section 824a(c) of this title for purposes of such section. (3) No cause of action shall lie or be maintained in any Federal or State court for the sharing or receipt of information under, and that is conducted in accordance with, subsection (d). (4) Nothing in this subsection shall be construed to require dismissal of a cause of action against an entity that, in the course of complying with an order for emergency measures issued under subsection (b)(1) by taking an action or omission for which they would be liable but for paragraph (1) or (2), takes such action or omission in a grossly negligent manner.