HR 2402 Introduced – Protected Electric Security Information

Earlier this month Rep. Lofgren (D,CA) introduced HR 2402, the Protecting Critical Infrastructure Act. The bill would create a new class of controlled unclassified information (CUI) to protect information sharing within the bulk power distribution system and with Federal, State and local government agencies.

In many ways the bill shares elements in common with HR 2271 and S 1068, but there are two major differences. First there is no authorization for the Secretary of Energy to take any actions to protect cybersecurity. Second instead of recognizing the current Critical Energy Infrastructure Information (CEII) category of CUI it constructs a new category out of whole cloth.

Protected Electric Security Information

As I have mentioned in other blogs the current CEII would be classified as CUI Basic under the rulemaking on CUI currently being undertaken by the National Archives and Records Administration (NARA) of the OMB. This means that the NARA regulations would govern markings, protective measures, classification authority and declassification authority for CEII.

This bill, on the other hand would establish a new category of CUI, Protected Electric Security Information (PESI) as a matter of law. That would place PESI in the CUI Specified category. This means that the NARA CUI regulations (when finalized, maybe next year) would only govern those aspects of security not specifically covered in this bill or subsequent regulations issued in accordance with this bill.

The information protection items specifically addressed in the bill include:

∙ Protection from disclosure under Federal, State and local freedom of information rules {new §215A(a)(1)};

∙ Duration of protection, maximum 5 years §215A(a)(6)};

∙ Early declassification authority, resides in FERC §215A(a)(7)};

∙ Judicial review process §215A(a)(8)};

Additionally, FERC is given authority to draft regulations governing the sharing of CEII information between and amongst government agencies (at all levels in the US) and private entities, as well as with Mexican and Canadian authorities as necessary.

Moving Forward

Neither Lofgren nor her cosponsor {Rep. Gowdy (R,SC)} are members of the House Energy and Commerce Committee so it is unlikely that this bill will make it to committee consideration, especially considering that sponsors of HR 2271 are on that Committee.