4659897 Formal Case No. 1111, In the Matter of the Investigation of the Public Service Commission into its Rules of Practice and Procedure Pertaining to Critical Infrastructure
-
PUBLIC SERVICE COMMISSION OF THE DISTRICT OF COLUMBIA
NOTICE OF PROPOSED RULEMAKING
FORMAL CASE NO. 1111, IN THE MATTER OF THE INVESTIGATION OF THE PUBLIC SERVICE COMMISSION INTO ITS RULES OF PRACTICE AND PROCEDURE PERTAINING TO CRITICAL INFRASTRUCTURE INFORMATION
1. The Public Service Commission of the District of Columbia (“Commission”) hereby gives notice pursuant to Sections 34-802 and 2-505 of the District of Columbia Code[1] of its intent to amend Chapter 1, “Rules of Practice and Procedure” of Title 15 of the District of Columbia Municipal Regulations (“DCMR”), in not less than 30 days from the date of publication of this Notice of Proposed Rulemaking (“NOPR”) in the D.C. Register.
2. The proposed amendments to Chapter 1 of the Commission’s rules adds a new Section 151 (“Critical Infrastructure Information”) and adds two new definitions (“Critical Infrastructure” and “Critical Infrastructure Information”) to Section 199 (“Definitions”). The purpose of the amendments is to establish procedures for the Commission’s treatment of information claimed by a party to be confidential critical infrastructure information, including procedures for determining production or disclosure of such information requested by other parties.
3. Section 151 is added to Chapter 1 of the Commission’s rules as follows:
151 CRITICAL INFRASTRUCTURE INFORMATION
151.1 If a party or an intervenor makes a request for information from a public utility company (“Company”) during the course of a Commission investigation or proceeding and the Company objects to the production of the requested information because it deems the requested information to be “critical infrastructure information” (“CII”), and the requesting party files a motion to compel the production of the requested information, the following procedures shall be applied:
(a) Within five (5) days from the date that a motion to compel disclosure of the information is filed, the Company shall file with the Office of the Commission Secretary a confidential filing that identifies the materials that it deems to be “critical infrastructure information” (“CII”) for which it is seeking privileged material protection. The filing shall contain the following information:
(1) A sealed copy of the requested information for the Commission’s inspection in camera or, a description of the information requested and an explanation for why the information is not being filed at this time;
(2) An explanation of the internal measures that are currently in place to protect the requested information;
(3) A statement of whether the information is currently being provided to any non-company personnel and, if so, to whom and under what circumstances;
(4) A statement of whether any special level of security clearance is required to view all or a portion of the requested information;
(5) A copy of a Non-Disclosure Agreement setting out the terms and conditions under which the requested information would be provided, or an explanation of why a Non-Disclosure Agreement would not suffice to protect the requested information and no Non-Disclosure Agreement is being provided;
(6) An explanation of the alternative controls, if any, pursuant to which the Company would make available the requested information;
(7) Any other information that the Company believes is relevant to its request to protect the requested information; and
(8) A sworn affidavit signed by an Executive Officer of the Company attesting to the information being submitted.
(b) The Company shall also file in the Office of the Commission Secretary a public version of its filing with a notation and shall serve a copy of its filing on the requesting party.
(c) Within five (5) days of receiving the Company’s filing, the requesting party shall file a response with the Office of the Commission Secretary. The response shall contain the following information:
(1) The name of the requesting party and the names, titles and company affiliations of each person who would be granted access to the requested information;
(2) The reason(s) that the requested information is needed, including why it is relevant and material to the subject matter of the investigation or the proceeding at the Commission;
(3) The reason(s) why the requesting party should be granted access to the requested information, including whether the requesting party has any requisite security clearance, if applicable;
(4) Whether the requesting party is prepared to sign the Non-Disclosure Agreement provided by the Company and if not, why not;
(5) Whether the requesting party is prepared to accept the alternative controls identified by the Company for the receipt of the requested information;
(6) Any additional information that the requesting party believes is relevant to the request for the information; and
(7) An affidavit from the head of the organization of the requesting party attesting to the information in the response.
(d) If the response contains confidential information, the requesting party shall file a confidential and a public version of the response.
151.2 Within five (5) days after the requesting party has filed its response, either the Company or the requesting party may file a motion requesting an evidentiary hearing. The party making the request shall list in its motion each and every fact in dispute requiring resolution and the reasons therefore. Responses to the motion shall be filed within five (5) days after the motion has been filed.
151.3 The Commission will review the filings made pursuant to §§ 151.1 and 151.2 and conduct an in camera review of the information that has been submitted. The Commission may request additional information from the Company or the requesting party, such information to be provided at the Commission’s option through additional affidavits, through proffers by counsel, or in an evidentiary hearing.
151.4 Within ten (10) days of the receipt of all filings, including supplemental filings where required, the Commission shall issue an order that contains the following determinations:
(a) Whether the Company has met its burden of proving that the requested information is CII and subject to the rules and procedures under Section 151;
(b) If the requested information is deemed CII, whether the Company has justified the restrictions, if any, that it has requested for the disclosure of the information to the requesting party;
(c) If the requested material is CII, whether the requesting party has justified its need for the requested information in light of the sensitivity of the information and has demonstrated that it is eligible to receive the requested information;
(d) If the Commission determines that a protective order is necessary for the disclosure of the CII, the conditions to be placed on the release of the information.
151.5 Any person may file an application in writing requesting a reconsideration or modification of the matters involved pursuant to the rules for reconsideration set forth in Section 140 of Chapter 1 of the Commission’s rules, except that any application for reconsideration or modification shall be filed within ten (10) days after the issuance of the order or decision.
151.6 If a person that is not a party in an investigation or proceeding before the Commission makes a request of the Commission for information received from a Company that has been deemed CII, or that may be CII, the request shall be handled pursuant to the procedures for a Freedom of Information Act Request as set forth in Chapter 7 of the Commission’s rules.
4. Section 199 of Chapter 1 of the Commission’s rules is amended by adding the following definitions:
199 DEFINITIONS
Critical Infrastructure - existing and proposed infrastructure systems and assets, whether physical or virtual so vital to the District of Columbia or the United States that the incapacity or destruction of such infrastructure system or asset could jeopardize the physical security, economic security, health, safety, or welfare of the public.
Critical Infrastructure Information - information not customarily in the public domain that is related to the security of critical infrastructure of companies that are regulated by the Public Service Commission of the District of Columbia including:
(a) actual, potential, or threatened interference with, attack on, compromise of, or incapacitation of critical infrastructure or protected systems by either physical or computer-based attack or similar conduct (including the misuse of or unauthorized access to all types of communications and data transmission systems) that violates Federal, or District of Columbia laws, harms interstate commerce of the United States or the economy of the District of Columbia, or threatens public health or safety;
(b) the ability of any critical infrastructure or protected system to resist such interference, compromise, or incapacitation, including any planned or past assessment, projection, or estimate of the vulnerability of critical infrastructure or a protected system, including security testing, risk evaluation thereto, risk management planning, or risk audit; or
(c) any planned or past operational problem or solution regarding critical infrastructure or protected systems, including repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to such interference, compromise, or incapacitation.
5. Any person interested in commenting on the subject matter of this proposed rulemaking must submit comments and reply comments in writing no later than thirty (30) days and forty-five (45) days, respectively, from the date of publication of this Notice in the D.C. Register. Comments and reply comments are to be addressed to Brinda Westbrook-Sedgwick, Commission Secretary, Public Service Commission of the District of Columbia, 1333 H Street, N.W., West Tower, Suite 200, Washington D.C., 20005. After the comment period expires, the Commission will take final rulemaking action.
