```

[Congressional Bills 111th Congress]
[From the U.S. Government Publishing Office]
[H.R. 2165 Introduced in House (IH)]

111th CONGRESS
  1st Session
                                H. R. 2165

      To amend Part II of the Federal Power Act to address known 
cybersecurity threats to the reliability of the bulk power system, and 
to provide emergency authority to address future cybersecurity threats 
  to the reliability of the bulk power system, and for other purposes.

_______________________________________________________________________

                    IN THE HOUSE OF REPRESENTATIVES

                             April 29, 2009

 Mr. Barrow (for himself, Mr. Markey of Massachusetts, and Mr. Waxman) 
 introduced the following bill; which was referred to the Committee on 
                          Energy and Commerce

_______________________________________________________________________

                                 A BILL

 
      To amend Part II of the Federal Power Act to address known 
cybersecurity threats to the reliability of the bulk power system, and 
to provide emergency authority to address future cybersecurity threats 
  to the reliability of the bulk power system, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Bulk Power System Protection Act of 
2009''.

SEC. 2. FINDINGS.

    The Congress finds that--
            (1) it is in the public interest to require the Federal 
        Energy Regulatory Commission to promptly order measures to 
        address known cybersecurity threats to the reliability of the 
        electric bulk power system; and
            (2) the Commission must have the necessary emergency 
        authority to respond promptly to future cybersecurity threats 
        that could compromise reliability of the bulk power system.

SEC. 3. PROTECTION OF BULK POWER SYSTEM FROM CYBERSECURITY THREATS.

    (a) In General.--Part II of the Federal Power Act is amended by 
adding the following new section after section 215:

``SEC. 215A. EMERGENCY AUTHORITY TO ADDRESS CYBERSECURITY THREATS TO 
              THE BULK POWER SYSTEM.

    ``(a) Definitions.--For purposes of this section:
            ``(1) The terms `reliability standard', `bulk power 
        system', `reliable operation', `cybersecurity incident', 
        `Electric Reliability Organization', `regional entity', and 
        `owners, users or operators' shall have the same meaning as 
        when used in section 215.
            ``(2) The term `cybersecurity threat' means that there is 
        credible information or evidence of--
                    ``(A) a likelihood of a malicious act that could 
                disrupt the operation of those programmable electronic 
                devices and communications networks including hardware, 
                software and data that are essential to the reliable 
                operation of the bulk power system; and
                    ``(B) a substantial possibility of disruption to 
                the operation of such devices and networks in the event 
                of such a malicious act.
            ``(3) Classified information.--The term `classified 
        information' means any information that has been determined 
        pursuant to Executive Order 12958, as amended, or successor 
        orders, or the Atomic Energy Act of 1954, to require protection 
        against unauthorized disclosure and that is so designated.
            ``(4) Sensitive cybersecurity information.--The term 
        `sensitive cybersecurity information' means unclassified 
        information that, if an unauthorized disclosure is made, could 
        be used in a malicious manner to impair the reliability or 
        operations of the bulk power system or the supply of 
        electricity to the bulk power system.
            ``(5) The term `Secretary' means the Secretary of Energy.
    ``(b) Interim Authority To Address Existing Cybersecurity 
Threats.--
            ``(1) In general.--After notice and opportunity for 
        comment, and after consultation with appropriate governmental 
        authorities in Canada and Mexico (subject to adequate 
        protections against inappropriate disclosure of security-
        sensitive information), the Commission shall establish, by rule 
        or order, within 120 days after enactment of this section, such 
        measures or actions as are necessary to protect the reliability 
        of the bulk power system against the cybersecurity threats 
        resulting from--
                    ``(A) the vulnerabilities identified in the June 
                21, 2007, communication to certain `Electricity Sector 
                Owners and Operators' from the North American Electric 
                Reliability Corporation, acting in its capacity as the 
                Electricity Sector Information Sharing and Analysis 
                Center; and
                    ``(B) related remote access issues.
        Such measures or actions may be required of any owner, user, or 
        operator of the bulk power system within the United States.
            ``(2) Additional orders.--Until such time as the interim 
        reliability measures or actions ordered under this subsection 
        are replaced by cybersecurity reliability standards developed, 
        approved, and implemented pursuant to section 215, the 
        Commission may issue additional orders to supplement the 
        initial rule or order issued under this subsection only if, 
        based on subsequent information or petition from an affected 
        entity, the Commission determines that clarification or 
        refinements to the originally ordered measures or actions are 
        necessary to ensure that the threats are adequately and 
        appropriately addressed. Any such additional orders shall be 
        preceded by notice and opportunity for comment.
    ``(c) Future Emergencies Involving Imminent Cybersecurity 
Threats.--
            ``(1) Authority to address imminent cybersecurity 
        threats.--Whenever the President issues and provides to the 
        Commission (either directly or through the Secretary) a written 
        directive or determination that an imminent cybersecurity 
        threat to the reliability of the bulk power system exists, the 
        Commission may on its own motion, with or without notice, 
        hearing, or report issue such orders for emergency measures or 
        actions as are necessary in its judgment to protect the 
        reliability of the bulk power system against such threat.
            ``(2) Consultation.--Before acting under this subsection, 
        to the extent feasible, taking into account the nature of the 
        threat and urgency of need for action, the Commission shall 
        consult with appropriate governmental authorities in Canada and 
        Mexico (subject to adequate protections against inappropriate 
        disclosure of security-sensitive information), entities 
        described in paragraph (3), and officials at other Federal 
        agencies, including the Secretary, as appropriate, regarding 
        implementation of measures or actions that will effectively 
        address the identified threat.
            ``(3) Application of emergency measures.--An order for 
        emergency actions or measures under this subsection may apply 
        to--
                    ``(A) the Electric Reliability Organization 
                referred to in section 215,
                    ``(B) a regional entity with respect to the United 
                States operations of the Electric Reliability 
                Organization,
                    ``(C) the regional entity, or
                    ``(D) any owner, user, or operator of the bulk 
                power system within the United States.
    ``(d) Discontinuance of Interim Measures.--The Commission shall 
issue an order discontinuing any measures or actions ordered under 
subsection (b) upon the earliest of the following:
            ``(1) When the President (either directly or through the 
        Secretary of Energy) issues a written order or directive 
        provided to the Commission to the effect that the threat to the 
        bulk power system that requires such measures, or actions no 
        longer exists.
            ``(2) When the Commission determines in writing that the 
        ordered measures or actions are no longer needed to address the 
        identified threat.
            ``(3) When a reliability standard developed and approved 
        pursuant to section 215 is implemented to address the 
        identified threat.
            ``(4) One year after the issuance of an order under 
        subsections (b) unless the President (either directly or 
        through the Secretary) issues a determination affirming the 
        continuing nature of the threat. A determination issued under 
        this paragraph shall expire upon the implementation of a 
        standard under section 215 to address the identified threat.
The Commission shall issue such order to be effective within 30 days of 
the relevant triggering event set out in paragraphs (1) through (4).
    ``(e) Discontinuance of Emergency Measures.--The Commission shall 
issue an order discontinuing any measures or actions ordered under 
subsection (c) upon the earliest of the following:
            ``(1) When the President (either directly or through the 
        Secretary of Energy) issues a written order or directive 
        provided to the Commission to the effect that the threat to the 
        bulk power system that requires such measures, or actions no 
        longer exists.
            ``(2) When the Commission determines in writing that the 
        ordered measures or actions are no longer needed to address the 
        identified threat.
            ``(3) When a reliability standard developed and approved 
        pursuant to section 215 is implemented to address the 
        identified threat.
            ``(4) With respect to orders under subsection (c), one year 
        after the issuance of an order unless the President (either 
        directly or through the Secretary) issues a determination 
        reaffirming the continuing nature of the threat. A 
        determination issued under this paragraph shall expire upon the 
        implementation of a standard under section 215 to address the 
        identified threat.
The Commission shall issue such order to be effective within 30 days of 
the relevant triggering event set out in paragraphs (1) through (4).
    ``(f) Protection of Unclassified Sensitive Cybersecurity 
Information.--
            ``(1) Confidentiality procedures.--After notice and 
        opportunity for comment, the Commission shall promulgate rules 
        and procedures to prohibit the unauthorized disclosure of 
        unclassified sensitive cybersecurity information--
                    ``(A) which was developed or used in connection 
                with the implementation of this section,
                    ``(B) which specifically discusses cybersecurity 
                threats, vulnerabilities, mitigation plans or security 
                procedures, and
                    ``(C) the unauthorized disclosure of which could be 
                used in a malicious manner to impair the reliability or 
                operations of the bulk power system or the supply of 
                electricity to the bulk power system.
        Such rules and procedures shall require the inventory and 
        safeguarding of such information during its creation, storage 
        and transmittal by the Commission or by any other entity, 
        including any vendor, contractor or consultant.
            ``(2)  Limited disclosure to entities subject to commission 
        action.--In the rules and procedures promulgated under 
        paragraph (1), the Commission shall authorize the release of 
        sensitive cybersecurity information to entities subject to 
        Commission action under this section and to their employees, 
        contractors and third-party representatives, to the extent 
        necessary to enable such entities to implement Commission 
        rules, orders or measures. Entities originating, receiving or 
        possessing such information shall comply with Commission rules 
        and procedures to limit disclosure of such information to any 
        other entities that have been determined to have a need to 
        know, have executed non disclosure agreements, and have been 
        deemed by the entity to be trustworthy and reliable. Any entity 
        which signed such non disclosure agreement and was found by the 
        Commission or by another entity subject to this section to have 
        improperly disclosed sensitive cybersecurity information shall 
        thereafter be denied access to such information, and the 
        Commission shall suspend ability of the entity disclosing such 
        information to appear before the Commission. The sanctions 
        under this paragraph against any individual or other entity 
        shall be in addition to, and not in lieu of, any other actions 
        Commission is authorized to take pursuant to section 316A for 
        failure to comply with the rules or procedures established by 
        the Commission under this section. Information designated 
        sensitive cybersecurity information pursuant to this section 
        shall not be subject to disclosure under the Freedom of 
        Information Act (5 U.S.C. 552).
            ``(3) Limitations.--
                    ``(A) The Commission shall consult with national 
                security or national intelligence agencies, as 
                appropriate, for purposes of designating certain 
                information as sensitive cybersecurity information, but 
                shall not designate as sensitive cybersecurity 
                information any information that has been classified by 
                another Federal agency.
                    ``(B) Nothing in this section shall be construed to 
                authorize the withholding of information from the 
                committees of the Congress with jurisdiction over the 
                Commission or the Comptroller General.
                    ``(C) In promulgating and implementing rules and 
                procedures under this section, the Commission shall 
                protect from disclosure only the minimum amount of 
                sensitive cybersecurity information necessary to 
                protect the reliability or operations of the bulk power 
                system or the supply of electricity to the bulk power 
                system. The Commission shall segregate sensitive 
                cybersecurity information within documents, electronic 
                communications, and rules, orders or records associated 
                with such rules and orders, wherever feasible, to 
                facilitate disclosure of information which is not 
                designated as sensitive cybersecurity information.
                    ``(D) Information may not be designated as 
                sensitive cybersecurity information for longer than 10 
                years, unless specifically redesignated by the 
                Commission.
                    ``(E) The Commission is authorized to remove the 
                designation of sensitive cybersecurity information, in 
                whole or in part, from a document or electronic 
                communication if the unauthorized disclosure could not 
                be used to impair the reliability or operations of the 
                bulk power system or the supply of electricity to the 
                bulk power system.
            ``(4) Consistency of markings.--The Commission is 
        authorized to place markings on documents, in whole or in part, 
        which designate the degree of sensitivity and limitations on 
        dissemination. Regulations and related procedures may be 
        modified, as appropriate, to ensure consistency with applicable 
        Executive Orders or laws pertaining to controlled unclassified 
        information.
            ``(5) Nondisclosure of sensitive cybersecurity information 
        in rules or orders.--If a rule or order issued pursuant to this 
        section contains sensitive cybersecurity information or if 
        information in the record associated with such rule or order 
        constitutes sensitive cybersecurity information, the Commission 
        may make the rule, order or information non-public in whole or 
        in part. The Commission may disclose such non-public rule, 
        order or information to entities other than the recipient of 
        the rule or order, as the Commission deems necessary, to carry 
        out the rule or order and protect the reliability of the bulk 
        power system.
            ``(6) Judicial review of designations.--Any determination 
        by the Commission concerning the designation of sensitive 
        cybersecurity information shall be subject to judicial review 
        pursuant to subsection (a)(4)(B) of section 552 of title 5 of 
        the United States Code.
    ``(g) Review.--The Commission shall act expeditiously to resolve 
all applications for rehearing of orders issued pursuant to this 
section which are filed under section 313(a). Any person or other 
entity seeking judicial review pursuant to section 313 may obtain such 
review only in the United States Court of Appeals for the District of 
Columbia Circuit. In the case of any petition for review involving 
rules or orders containing or relating to security-sensitive 
information, the Commission and parties shall develop with the court 
appropriate measures to ensure the confidentiality of such information, 
including, but not limited to, court filings under seal or otherwise in 
non-public form, or judicial review in camera.
    ``(h) Enforcement Discretion.--The Commission is authorized to 
impose penalties pursuant to section 316A for any violation of a rule 
or order of the Commission under this section. The Commission shall 
exercise its discretion in engaging in enforcement actions under this 
section to recognize good faith efforts to comply with directives of 
the Commission.
    ``(i) Paperwork Reduction.--Chapter 35 of title 44, United States 
Code (44 U.S.C. 3501 et seq.) (commonly referred to as the `Paperwork 
Reduction Act') shall not apply to collections of information that 
relate to measures or actions described in this section.
    ``(j) Provision of Assistance to Industry in Meeting Cybersecurity 
Protection Needs.--
            ``(1) Expertise and resources.--The Secretary shall 
        establish a program to develop expertise and identify technical 
        and electronic resources, including hardware, software and 
        system equipment, helpful to cybersecurity protection of the 
        electric grid and all electric systems, including distribution-
        level electric systems.
            ``(2) Sharing expertise.--The Secretary shall offer to 
        share such expertise through consultation and assistance with 
        any owner, operator, or user of the bulk power system, to any 
        owner or operator of an electricity distribution system located 
        in the United States whether or not connected to the bulk power 
        system, and specifically to any owner or operator of an 
        electricity distribution system that may provide electricity to 
        national defense and other critical-infrastructure facilities 
        of the United States.
            ``(3) Priority.--The Secretary shall consult with the 
        Commission, the Secretary of Defense, the Secretary of Homeland 
        Security, and other Federal agencies to confirm the identity of 
        States and electric systems serving such national defense and 
        critical-infrastructure facilities, and shall assign higher 
        priority to such States and systems in offering such support.
            ``(4) Clearances.--The Secretary shall facilitate the 
        acquisition by key security personnel of any electric entity 
        affected by this subsection of sufficient security clearances 
        to allow such personnel access to information that would enable 
        optimum understanding of cybersecurity threats and ability to 
        respond.
            ``(5) Defense facilities.--Within one year of the date of 
        enactment of this section, the States of Alaska and Hawaii and 
        the Territory of Guam shall prepare, in consultation with the 
        Secretary of Energy, the Secretary of Defense, and the electric 
        utilities that serve national defense facilities in those 
        jurisdictions, a comprehensive plan, to be implemented by the 
        relevant State and territorial governmental authorities, 
        identifying the emergency measures or actions that will be 
        taken to protect the reliability of the electric power supply 
        of the national defense facilities located in those 
        jurisdictions in the event of an imminent cybersecurity threat. 
        A copy of each such plan shall be provided to the Secretary of 
        Energy and the Secretary of Defense.''.
    (b) Conforming Amendment.--Section 201(b)(2) of the Federal Power 
Act is amended by inserting ``215A'' after ``215''.
                                 <all>
```