II 

Calendar No. 617 

111TH CONGRESS 

2D SESSION H. R. 5026 

[Report No. 111–331] 

IN THE SENATE OF THE UNITED STATES 

JUNE 10, 2010 

Received; read twice and referred to the Committee on Energy and Natural 

Resources 

SEPTEMBER 27, 2010 

Reported by Mr. BINGAMAN, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

AN ACT 

To amend the Federal Power Act to protect the bulk-power 

system and electric infrastructure critical to the defense 

of the United States against cybersecurity and other 

threats and vulnerabilities. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Grid Reliability and 

5 Infrastructure Defense Act’’ or the ‘‘GRID Act’’. 


tjames on DSKG8SOYB1PROD with BILLS
2 

•HR 5026 RS

1 SEC. 2. AMENDMENT TO THE FEDERAL POWER ACT. 

2 (a) CRITICAL ELECTRIC INFRASTRUCTURE SECU3 RITY.—Part II of the Federal Power Act (16 U.S.C. 824 

4 et seq.) is amended by adding after section 215 the fol5 lowing new section: 

6 ‘‘SEC. 215A. CRITICAL ELECTRIC INFRASTRUCTURE SECU7 RITY. 

8 ‘‘(a) DEFINITIONS.—For purposes of this section: 

9 ‘‘(1) BULK-POWER SYSTEM; ELECTRIC RELI10 ABILITY ORGANIZATION; REGIONAL ENTITY.—The 

11 terms ‘bulk-power system’, ‘Electric Reliability Or12 ganization’, and ‘regional entity’ have the meanings 

13 given such terms in paragraphs (1), (2), and (7) of 

14 section 215(a), respectively. 

15 ‘‘(2) DEFENSE CRITICAL ELECTRIC INFRA16 STRUCTURE.—The term ‘defense critical electric in17 frastructure’ means any infrastructure located in the 

18 United States (including the territories) used for the 

19 generation, transmission, or distribution of electric 

20 energy that— 

21 ‘‘(A) is not part of the bulk-power system; 

22 and 

23 ‘‘(B) serves a facility designated by the 

24 President pursuant to subsection (d)(1), but is 

25 not owned or operated by the owner or operator 

26 of such facility. 


tjames on DSKG8SOYB1PROD with BILLS
3 

•HR 5026 RS

1 ‘‘(3) DEFENSE CRITICAL ELECTRIC INFRA2 STRUCTURE VULNERABILITY.—The term ‘defense 

3 critical electric infrastructure vulnerability’ means a 

4 weakness in defense critical electric infrastructure 

5 that, in the event of a malicious act using electronic 

6 communication or an electromagnetic pulse, would 

7 pose a substantial risk of disruption of those elec8 tronic devices or communications networks, includ9 ing hardware, software, and data, that are essential 

10 to the reliability of defense critical electric infra11 structure. 

12 ‘‘(4) ELECTROMAGNETIC PULSE.—The term 

13 ‘electromagnetic pulse’ means 1 or more pulses of 

14 electromagnetic energy emitted by a device capable 

15 of disabling, disrupting, or destroying electronic 

16 equipment by means of such a pulse. 

17 ‘‘(5) GEOMAGNETIC STORM.—The term ‘geo18 magnetic storm’ means a temporary disturbance of 

19 the Earth’s magnetic field resulting from solar activ20 ity. 

21 ‘‘(6) GRID SECURITY THREAT.—The term ‘grid 

22 security threat’ means a substantial likelihood of— 

23 ‘‘(A)(i) a malicious act using electronic 

24 communication or an electromagnetic pulse, or 

25 a geomagnetic storm event, that could disrupt 


tjames on DSKG8SOYB1PROD with BILLS
4 

•HR 5026 RS

1 the operation of those electronic devices or com2 munications networks, including hardware, soft3 ware, and data, that are essential to the reli4 ability of the bulk-power system or of defense 

5 critical electric infrastructure; and 

6 ‘‘(ii) disruption of the operation of such 

7 devices or networks, with significant adverse ef8 fects on the reliability of the bulk-power system 

9 or of defense critical electric infrastructure, as 

10 a result of such act or event; or 

11 ‘‘(B)(i) a direct physical attack on the 

12 bulk-power system or on defense critical electric 

13 infrastructure; and 

14 ‘‘(ii) significant adverse effects on the reli15 ability of the bulk-power system or of defense 

16 critical electric infrastructure as a result of 

17 such physical attack. 

18 ‘‘(7) GRID SECURITY VULNERABILITY.—The 

19 term ‘grid security vulnerability’ means a weakness 

20 that, in the event of a malicious act using electronic 

21 communication or an electromagnetic pulse, would 

22 pose a substantial risk of disruption to the operation 

23 of those electronic devices or communications net24 works, including hardware, software, and data, that 


tjames on DSKG8SOYB1PROD with BILLS
5 

•HR 5026 RS

1 are essential to the reliability of the bulk-power sys2 tem. 

3 ‘‘(8) LARGE TRANSFORMER.—The term ‘large 

4 transformer’ means an electric transformer that is 

5 part of the bulk-power system. 

6 ‘‘(9) PROTECTED INFORMATION.—The term 

7 ‘protected information’ means information, other 

8 than classified national security information, des9 ignated as protected information by the Commission 

10 under subsection (e)(2)— 

11 ‘‘(A) that was developed or submitted in 

12 connection with the implementation of this sec13 tion; 

14 ‘‘(B) that specifically discusses grid secu15 rity threats, grid security vulnerabilities, de16 fense critical electric infrastructure 

17 vulnerabilities, or plans, procedures, or meas18 ures to address such threats or vulnerabilities; 

19 and 

20 ‘‘(C) the unauthorized disclosure of which 

21 could be used in a malicious manner to impair 

22 the reliability of the bulk-power system or of 

23 defense critical electric infrastructure. 

24 ‘‘(10) SECRETARY.—The term ‘Secretary’ 

25 means the Secretary of Energy. 


tjames on DSKG8SOYB1PROD with BILLS
6 

•HR 5026 RS

1 ‘‘(11) SECURITY.—The definition of ‘security’ 

2 in section 3(16) shall not apply to the provisions in 

3 this section. 

4 ‘‘(b) EMERGENCY RESPONSE MEASURES.— 

5 ‘‘(1) AUTHORITY TO ADDRESS GRID SECURITY

6 THREATS.—Whenever the President issues and pro7 vides to the Commission (either directly or through 

8 the Secretary) a written directive or determination 

9 identifying an imminent grid security threat, the 

10 Commission may, with or without notice, hearing, or 

11 report, issue such orders for emergency measures as 

12 are necessary in its judgment to protect the reli13 ability of the bulk-power system or of defense critical 

14 electric infrastructure against such threat. As soon 

15 as practicable but not later than 180 days after the 

16 date of enactment of this section, the Commission 

17 shall, after notice and opportunity for comment, es18 tablish rules of procedure that ensure that such au19 thority can be exercised expeditiously. 

20 ‘‘(2) NOTIFICATION OF CONGRESS.—Whenever 

21 the President issues and provides to the Commission 

22 (either directly or through the Secretary) a written 

23 directive or determination under paragraph (1), the 

24 President (or the Secretary, as the case may be) 

25 shall promptly notify congressional committees of 


tjames on DSKG8SOYB1PROD with BILLS
7 

•HR 5026 RS

1 relevant jurisdiction, including the Committee on 

2 Energy and Commerce of the House of Representa3 tives and the Committee on Energy and Natural Re4 sources of the Senate, of the contents of, and jus5 tification for, such directive or determination. 

6 ‘‘(3) CONSULTATION.—Before issuing an order 

7 for emergency measures under paragraph (1), the 

8 Commission shall, to the extent practicable in light 

9 of the nature of the grid security threat and the ur10 gency of the need for such emergency measures, con11 sult with appropriate governmental authorities in 

12 Canada and Mexico, entities described in paragraph 

13 (4), the Secretary, and other appropriate Federal 

14 agencies regarding implementation of such emer15 gency measures. 

16 ‘‘(4) APPLICATION.—An order for emergency 

17 measures under this subsection may apply to— 

18 ‘‘(A) the Electric Reliability Organization; 

19 ‘‘(B) a regional entity; or 

20 ‘‘(C) any owner, user, or operator of the 

21 bulk-power system or of defense critical electric 

22 infrastructure within the United States. 

23 ‘‘(5) DISCONTINUANCE.—The Commission shall 

24 issue an order discontinuing any emergency measVerDate Mar 15 2010 03:17 Sep 28, 2010 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6401 E:\BILLS\H5026.RS H5026

tjames on DSKG8SOYB1PROD with BILLS
8 

•HR 5026 RS

1 ures ordered under this subsection, effective not 

2 later than 30 days after the earliest of the following: 

3 ‘‘(A) The date upon which the President 

4 issues and provides to the Commission (either 

5 directly or through the Secretary) a written di6 rective or determination that the grid security 

7 threat identified under paragraph (1) no longer 

8 exists. 

9 ‘‘(B) The date upon which the Commission 

10 issues a written determination that the emer11 gency measures are no longer needed to address 

12 the grid security threat identified under para13 graph (1), including by means of Commission 

14 approval of a reliability standard under section 

15 215 that the Commission determines adequately 

16 addresses such threat. 

17 ‘‘(C) The date that is 1 year after the 

18 issuance of an order under paragraph (1). 

19 ‘‘(6) COST RECOVERY.—If the Commission de20 termines that owners, operators, or users of the 

21 bulk-power system or of defense critical electric in22 frastructure have incurred substantial costs to com23 ply with an order under this subsection and that 

24 such costs were prudently incurred and cannot rea25 sonably be recovered through regulated rates or 


tjames on DSKG8SOYB1PROD with BILLS
9 

•HR 5026 RS

1 market prices for the electric energy or services sold 

2 by such owners, operators, or users, the Commission 

3 shall, after notice and an opportunity for comment, 

4 establish a mechanism that permits such owners, op5 erators, or users to recover such costs. 

6 ‘‘(c) MEASURES TO ADDRESS GRID SECURITY

7 VULNERABILITIES.— 

8 ‘‘(1) COMMISSION AUTHORITY.—If the Commis9 sion, in consultation with appropriate Federal agen10 cies, identifies a grid security vulnerability that the 

11 Commission determines has not adequately been ad12 dressed through a reliability standard developed and 

13 approved under section 215, the Commission shall, 

14 after notice and opportunity for comment and after 

15 consultation with the Secretary, other appropriate 

16 Federal agencies, and appropriate governmental au17 thorities in Canada and Mexico, promulgate a rule 

18 or issue an order requiring implementation, by any 

19 owner, operator, or user of the bulk-power system in 

20 the United States, of measures to protect the bulk21 power system against such vulnerability. Before pro22 mulgating a rule or issuing an order under this 

23 paragraph, the Commission shall, to the extent prac24 ticable in light of the urgency of the need for action 

25 to address the grid security vulnerability, request 


tjames on DSKG8SOYB1PROD with BILLS
10 

•HR 5026 RS

1 and consider recommendations from the Electric Re2 liability Organization regarding such rule or order. 

3 The Commission may establish an appropriate dead4 line for the submission of such recommendations. 

5 ‘‘(2) CERTAIN EXISTING CYBERSECURITY

6 VULNERABILITIES.—Not later than 180 days after 

7 the date of enactment of this section, the Commis8 sion shall, after notice and opportunity for comment 

9 and after consultation with the Secretary, other ap10 propriate Federal agencies, and appropriate govern11 mental authorities in Canada and Mexico, promul12 gate a rule or issue an order requiring the imple13 mentation, by any owner, user, or operator of the 

14 bulk-power system in the United States, of such 

15 measures as are necessary to protect the bulk-power 

16 system against the vulnerabilities identified in the 

17 June 21, 2007, communication to certain ‘Electricity 

18 Sector Owners and Operators’ from the North 

19 American Electric Reliability Corporation, acting in 

20 its capacity as the Electricity Sector Information 

21 and Analysis Center. 

22 ‘‘(3) RESCISSION.—The Commission shall ap23 prove a reliability standard developed under section 

24 215 that addresses a grid security vulnerability that 

25 is the subject of a rule or order under paragraph (1) 


tjames on DSKG8SOYB1PROD with BILLS
11 

•HR 5026 RS

1 or (2), unless the Commission determines that such 

2 reliability standard does not adequately protect 

3 against such vulnerability or otherwise does not sat4 isfy the requirements of section 215. Upon such ap5 proval, the Commission shall rescind the rule pro6 mulgated or order issued under paragraph (1) or (2) 

7 addressing such vulnerability, effective upon the ef8 fective date of the newly approved reliability stand9 ard. 

10 ‘‘(4) GEOMAGNETIC STORMS.—Not later than 1 

11 year after the date of enactment of this section, the 

12 Commission shall, after notice and an opportunity 

13 for comment and after consultation with the Sec14 retary and other appropriate Federal agencies, issue 

15 an order directing the Electric Reliability Organiza16 tion to submit to the Commission for approval under 

17 section 215, not later than 1 year after the issuance 

18 of such order, reliability standards adequate to pro19 tect the bulk-power system from any reasonably 

20 foreseeable geomagnetic storm event. The Commis21 sion’s order shall specify the nature and magnitude 

22 of the reasonably foreseeable events against which 

23 such standards must protect. Such standards shall 

24 appropriately balance the risks to the bulk-power 

25 system associated with such events, including any 


tjames on DSKG8SOYB1PROD with BILLS
12 

•HR 5026 RS

1 regional variation in such risks, and the costs of 

2 mitigating such risks. 

3 ‘‘(5) LARGE TRANSFORMER AVAILABILITY.— 

4 Not later than 1 year after the date of enactment 

5 of this section, the Commission shall, after notice 

6 and an opportunity for comment and after consulta7 tion with the Secretary and other appropriate Fed8 eral agencies, issue an order directing the Electric 

9 Reliability Organization to submit to the Commis10 sion for approval under section 215, not later than 

11 1 year after the issuance of such order, reliability 

12 standards addressing availability of large trans13 formers. Such standards shall require entities that 

14 own or operate large transformers to ensure, individ15 ually or jointly, adequate availability of large trans16 formers to promptly restore the reliable operation of 

17 the bulk-power system in the event that any such 

18 transformer is destroyed or disabled as a result of 

19 a reasonably foreseeable physical or other attack or 

20 geomagnetic storm event. The Commission’s order 

21 shall specify the nature and magnitude of the rea22 sonably foreseeable attacks or events that shall pro23 vide the basis for such standards. Such standards 

24 shall— 


tjames on DSKG8SOYB1PROD with BILLS
13 

•HR 5026 RS

1 ‘‘(A) provide entities subject to the stand2 ards with the option of meeting such standards 

3 individually or jointly; and 

4 ‘‘(B) appropriately balance the risks asso5 ciated with a reasonably foreseeable attack or 

6 event, including any regional variation in such 

7 risks, and the costs of ensuring adequate avail8 ability of spare transformers. 

9 ‘‘(d) CRITICAL DEFENSE FACILITIES.— 

10 ‘‘(1) DESIGNATION.—Not later than 180 days 

11 after the date of enactment of this section, the 

12 President shall designate, in a written directive or 

13 determination provided to the Commission, facilities 

14 located in the United States (including the terri15 tories) that are— 

16 ‘‘(A) critical to the defense of the United 

17 States; and 

18 ‘‘(B) vulnerable to a disruption of the sup19 ply of electric energy provided to such facility 

20 by an external provider. 

21 The number of facilities designated by such directive 

22 or determination shall not exceed 100. The Presi23 dent may periodically revise the list of designated fa24 cilities through a subsequent written directive or de25 termination provided to the Commission, provided 


tjames on DSKG8SOYB1PROD with BILLS
14 

•HR 5026 RS

1 that the total number of designated facilities at any 

2 time shall not exceed 100. 

3 ‘‘(2) COMMISSION AUTHORITY.—If the Commis4 sion identifies a defense critical electric infrastruc5 ture vulnerability that the Commission, in consulta6 tion with owners and operators of any facility or fa7 cilities designated by the President pursuant to 

8 paragraph (1), determines has not adequately been 

9 addressed through measures undertaken by owners 

10 or operators of defense critical electric infrastruc11 ture, the Commission shall, after notice and an op12 portunity for comment and after consultation with 

13 the Secretary and other appropriate Federal agen14 cies, promulgate a rule or issue an order requiring 

15 implementation, by any owner or operator of defense 

16 critical electric infrastructure, of measures to protect 

17 the defense critical electric infrastructure against 

18 such vulnerability. The Commission shall exempt 

19 from any such rule or order any specific defense 

20 critical electric infrastructure that the Commission 

21 determines already has been adequately protected 

22 against the identified vulnerability. The Commission 

23 shall make any such determination in consultation 

24 with the owner or operator of the facility designated 


tjames on DSKG8SOYB1PROD with BILLS
15 

•HR 5026 RS

1 by the President pursuant to paragraph (1) that re2 lies upon such defense critical electric infrastructure. 

3 ‘‘(3) COST RECOVERY.—An owner or operator 

4 of defense critical electric infrastructure shall be re5 quired to take measures under paragraph (2) only to 

6 the extent that the owners or operators of a facility 

7 or facilities designated by the President pursuant to 

8 paragraph (1) that rely upon such infrastructure 

9 agree to bear the full incremental costs of compli10 ance with a rule promulgated or order issued under 

11 paragraph (2). 

12 ‘‘(e) PROTECTION OF INFORMATION.— 

13 ‘‘(1) PROHIBITION OF PUBLIC DISCLOSURE OF

14 PROTECTED INFORMATION.—Protected informa15 tion— 

16 ‘‘(A) shall be exempt from disclosure under 

17 section 552(b)(3) of title 5, United States Code; 

18 and 

19 ‘‘(B) shall not be made available pursuant 

20 to any State, local, or tribal law requiring dis21 closure of information or records. 

22 ‘‘(2) INFORMATION SHARING.— 

23 ‘‘(A) IN GENERAL.—Consistent with the 

24 Controlled Unclassified Information framework 

25 established by the President, the Commission 


tjames on DSKG8SOYB1PROD with BILLS
16 

•HR 5026 RS

1 shall promulgate such regulations and issue 

2 such orders as necessary to designate protected 

3 information and to prohibit the unauthorized 

4 disclosure of such protected information. 

5 ‘‘(B) SHARING OF PROTECTED INFORMA6 TION.—The regulations promulgated and orders 

7 issued pursuant to subparagraph (A) shall pro8 vide standards for and facilitate the appropriate 

9 sharing of protected information with, between, 

10 and by Federal, State, local, and tribal authori11 ties, the Electric Reliability Organization, re12 gional entities, and owners, operators, and 

13 users of the bulk-power system in the United 

14 States and of defense critical electric infrastruc15 ture. In promulgating such regulations and 

16 issuing such orders, the Commission shall take 

17 account of the role of State commissions in re18 viewing the prudence and cost of investments 

19 within their respective jurisdictions. The Com20 mission shall consult with appropriate Canadian 

21 and Mexican authorities to develop protocols for 

22 the sharing of protected information with, be23 tween, and by appropriate Canadian and Mexi24 can authorities and owners, operators, and 


tjames on DSKG8SOYB1PROD with BILLS
17 

•HR 5026 RS

1 users of the bulk-power system outside the 

2 United States. 

3 ‘‘(3) SUBMISSION OF INFORMATION TO CON4 GRESS.—Nothing in this section shall permit or au5 thorize the withholding of information from Con6 gress, any committee or subcommittee thereof, or 

7 the Comptroller General. 

8 ‘‘(4) DISCLOSURE OF NON-PROTECTED INFOR9 MATION.—In implementing this section, the Com10 mission shall protect from disclosure only the min11 imum amount of information necessary to protect 

12 the reliability of the bulk-power system and of de13 fense critical electric infrastructure. The Commission 

14 shall segregate protected information within docu15 ments and electronic communications, wherever fea16 sible, to facilitate disclosure of information that is 

17 not designated as protected information. 

18 ‘‘(5) DURATION OF DESIGNATION.—Informa19 tion may not be designated as protected information 

20 for longer than 5 years, unless specifically redesig21 nated by the Commission. 

22 ‘‘(6) REMOVAL OF DESIGNATION.—The Com23 mission may remove the designation of protected in24 formation, in whole or in part, from a document or 

25 electronic communication if the unauthorized discloVerDate Mar 15 2010 03:17 Sep 28, 2010 Jkt 089200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6401 E:\BILLS\H5026.RS H5026

tjames on DSKG8SOYB1PROD with BILLS
18 

•HR 5026 RS

1 sure of such information could no longer be used to 

2 impair the reliability of the bulk-power system or of 

3 defense critical electric infrastructure. 

4 ‘‘(7) JUDICIAL REVIEW OF DESIGNATIONS.— 

5 Notwithstanding subsection (f) of this section or sec6 tion 313, a person or entity may seek judicial review 

7 of a determination by the Commission concerning 

8 the designation of protected information under this 

9 subsection exclusively in the district court of the 

10 United States in the district in which the complain11 ant resides, or has his principal place of business, or 

12 in the District of Columbia. In such a case the court 

13 shall determine the matter de novo, and may exam14 ine the contents of documents or electronic commu15 nications designated as protected information in 

16 camera to determine whether such documents or any 

17 part thereof were improperly designated as protected 

18 information. The burden is on the Commission to 

19 sustain its designation. 

20 ‘‘(f) JUDICIAL REVIEW.—The Commission shall act 

21 expeditiously to resolve all applications for rehearing of 

22 orders issued pursuant to this section that are filed under 

23 section 313(a). Any party seeking judicial review pursuant 

24 to section 313 of an order issued under this section may 


tjames on DSKG8SOYB1PROD with BILLS
19 

•HR 5026 RS

1 obtain such review only in the United States Court of Ap2 peals for the District of Columbia Circuit. 

3 ‘‘(g) PROVISION OF ASSISTANCE TO INDUSTRY IN

4 MEETING GRID SECURITY PROTECTION NEEDS.— 

5 ‘‘(1) EXPERTISE AND RESOURCES.—The Sec6 retary shall establish a program, in consultation with 

7 other appropriate Federal agencies, to develop tech8 nical expertise in the protection of systems for the 

9 generation, transmission, and distribution of electric 

10 energy against geomagnetic storms or malicious acts 

11 using electronic communications or electromagnetic 

12 pulse that would pose a substantial risk of disrup13 tion to the operation of those electronic devices or 

14 communications networks, including hardware, soft15 ware, and data, that are essential to the reliability 

16 of such systems. Such program shall include the 

17 identification and development of appropriate tech18 nical and electronic resources, including hardware, 

19 software, and system equipment. 

20 ‘‘(2) SHARING EXPERTISE.—As appropriate, 

21 the Secretary shall offer to share technical expertise 

22 developed under the program under paragraph (1), 

23 through consultation and assistance, with owners, 

24 operators, or users of systems for the generation, 

25 transmission, or distribution of electric energy loVerDate Mar 15 2010 03:17 Sep 28, 2010 Jkt 089200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6401 E:\BILLS\H5026.RS H5026

tjames on DSKG8SOYB1PROD with BILLS
20 

•HR 5026 RS

1 cated in the United States and with State commis2 sions. In offering such support, the Secretary shall 

3 assign higher priority to systems serving facilities 

4 designated by the President pursuant to subsection 

5 (d)(1) and other critical-infrastructure facilities, 

6 which the Secretary shall identify in consultation 

7 with the Commission and other appropriate Federal 

8 agencies. 

9 ‘‘(3) SECURITY CLEARANCES AND COMMUNICA10 TION.—The Secretary shall facilitate and, to the ex11 tent practicable, expedite the acquisition of adequate 

12 security clearances by key personnel of any entity 

13 subject to the requirements of this section to enable 

14 optimum communication with Federal agencies re15 garding grid security threats, grid security 

16 vulnerabilities, and defense critical electric infra17 structure vulnerabilities. The Secretary, the Com18 mission, and other appropriate Federal agencies 

19 shall, to the extent practicable and consistent with 

20 their obligations to protect classified and protected 

21 information, share timely actionable information re22 garding grid security threats, grid security 

23 vulnerabilities, and defense critical electric infra24 structure vulnerabilities with appropriate key per25 sonnel of owners, operators, and users of the bulkVerDate Mar 15 2010 03:17 Sep 28, 2010 Jkt 089200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6401 E:\BILLS\H5026.RS H5026

tjames on DSKG8SOYB1PROD with BILLS
21 

•HR 5026 RS

1 power system and of defense critical electric infra2 structure. 

3 ‘‘(h) CERTAIN FEDERAL ENTITIES.—For the 11-year 

4 period commencing on the date of enactment of this sec5 tion, the Tennessee Valley Authority and the Bonneville 

6 Power Administration shall be exempt from any require7 ment under subsection (b) or (c) (except for any require8 ment addressing a malicious act using electronic commu9 nication).’’. 

10 (b) CONFORMING AMENDMENTS.— 

11 (1) JURISDICTION.—Section 201(b)(2) of the 

12 Federal Power Act (16 U.S.C. 824(b)(2)) is amend13 ed by inserting ‘‘215A,’’ after ‘‘215,’’ each place it 

14 appears. 

15 (2) PUBLIC UTILITY.—Section 201(e) of the 

16 Federal Power Act (16 U.S.C. 824(e)) is amended 

17 by inserting ‘‘215A,’’ after ‘‘215,’’. 

18 SEC. 3. BUDGETARY COMPLIANCE. 

19 The budgetary effects of this Act, for the purpose of 

20 complying with the Statutory Pay-As-You-Go Act of 2010, 

21 shall be determined by reference to the latest statement 

22 titled ‘‘Budgetary Effects of PAYGO Legislation’’ for this 

23 Act, submitted for printing in the Congressional Record 

24 by the Chairman of the House Budget Committee, proVerDate Mar 15 2010 03:17 Sep 28, 2010 Jkt 089200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6401 E:\BILLS\H5026.RS H5026

tjames on DSKG8SOYB1PROD with BILLS
22 

•HR 5026 RS

1 vided that such statement has been submitted prior to the 

2 vote on passage. 

3 SECTION 1. CRITICAL ELECTRIC INFRASTRUCTURE. 

4 Part II of the Federal Power Act (16 U.S.C. 824 et 

5 seq.) is amended by adding at the end the following: 

6 ‘‘SEC. 224. CRITICAL ELECTRIC INFRASTRUCTURE. 

7 ‘‘(a) DEFINITIONS.—In this section: 

8 ‘‘(1) CRITICAL ELECTRIC INFRASTRUCTURE.— 

9 The term ‘critical electric infrastructure’ means sys10 tems and assets, whether physical or virtual, used for 

11 the generation, transmission, or distribution of elec12 tric energy affecting interstate commerce that, as de13 termined by the Commission or the Secretary (as ap14 propriate), are so vital to the United States that the 

15 incapacity or destruction of the systems and assets 

16 would have a debilitating impact on national secu17 rity, national economic security, or national public 

18 health or safety. 

19 ‘‘(2) CRITICAL ELECTRIC INFRASTRUCTURE IN20 FORMATION.—The term ‘critical electric infrastruc21 ture information’ means critical infrastructure infor22 mation relating to critical electric infrastructure. 

23 ‘‘(3) CRITICAL INFRASTRUCTURE INFORMA24 TION.—The term ‘critical infrastructure information’ 

25 has the meaning given the term in section 212 of the 


tjames on DSKG8SOYB1PROD with BILLS
23 

•HR 5026 RS

1 Critical Infrastructure Information Act of 2002 (6 

2 U.S.C. 131). 

3 ‘‘(4) CYBER SECURITY THREAT.—The term 

4 ‘cyber security threat’ means the imminent danger of 

5 an act that disrupts, attempts to disrupt, or poses a 

6 significant risk of disrupting the operation of pro7 grammable electronic devices or communications net8 works (including hardware, software, and data) essen9 tial to the reliable operation of critical electric infra10 structure. 

11 ‘‘(5) CYBER SECURITY VULNERABILITY.—The 

12 term ‘cyber security vulnerability’ means a weakness 

13 or flaw in the design or operation of any program14 mable electronic device or communication network 

15 that exposes critical electric infrastructure to a cyber 

16 security threat. 

17 ‘‘(6) SECRETARY.—The term ‘Secretary’ means 

18 the Secretary of Energy. 

19 ‘‘(b) AUTHORITY OF COMMISSION.— 

20 ‘‘(1) IN GENERAL.—The Commission shall issue 

21 such rules or orders as are necessary to protect crit22 ical electric infrastructure from cyber security 

23 vulnerabilities. 

24 ‘‘(2) EXPEDITED PROCEDURES.—The Commis25 sion may issue a rule or order without prior notice 


tjames on DSKG8SOYB1PROD with BILLS
24 

•HR 5026 RS

1 or hearing if the Commission determines the rule or 

2 order must be issued immediately to protect critical 

3 electric infrastructure from a cyber security vulner4 ability. 

5 ‘‘(3) CONSULTATION.—Before issuing a rule or 

6 order under paragraph (2), to the extent practicable, 

7 taking into account the nature of the threat and ur8 gency of need for action, the Commission shall consult 

9 with the entities described in subsection (e)(1) and 

10 with officials at other Federal agencies, as appro11 priate, regarding implementation of actions that will 

12 effectively address the identified cyber security 

13 vulnerabilities. 

14 ‘‘(4) TERMINATION OF RULES OR ORDERS.—A 

15 rule or order issued to address a cyber security vul16 nerability under this subsection shall expire on the ef17 fective date of a standard developed and approved 

18 pursuant to section 215 to address the cyber security 

19 vulnerability. 

20 ‘‘(c) EMERGENCY AUTHORITY OF SECRETARY.— 

21 ‘‘(1) IN GENERAL.—If the Secretary determines 

22 that immediate action is necessary to protect critical 

23 electric infrastructure from a cyber security threat, 

24 the Secretary may require, by order, with or without 

25 notice, persons subject to the jurisdiction of the ComVerDate Mar 15 2010 03:17 Sep 28, 2010 Jkt 089200 PO 00000 Frm 00024 Fmt 6652 Sfmt 6203 E:\BILLS\H5026.RS H5026

tjames on DSKG8SOYB1PROD with BILLS
25 

•HR 5026 RS

1 mission under this section to take such actions as the 

2 Secretary determines will best avert or mitigate the 

3 cyber security threat. 

4 ‘‘(2) COORDINATION WITH CANADA AND MEX5 ICO.—In exercising the authority granted under this 

6 subsection, the Secretary is encouraged to consult and 

7 coordinate with the appropriate officials in Canada 

8 and Mexico responsible for the protection of cyber se9 curity of the interconnected North American elec10 tricity grid. 

11 ‘‘(3) CONSULTATION.—Before exercising the au12 thority granted under this subsection, to the extent 

13 practicable, taking into account the nature of the 

14 threat and urgency of need for action, the Secretary 

15 shall consult with the entities described in subsection 

16 (e)(1) and with officials at other Federal agencies, as 

17 appropriate, regarding implementation of actions 

18 that will effectively address the identified cyber secu19 rity threat. 

20 ‘‘(4) COST RECOVERY.—The Commission shall 

21 establish a mechanism that permits public utilities to 

22 recover prudently incurred costs required to imple23 ment immediate actions ordered by the Secretary 

24 under this subsection. 


tjames on DSKG8SOYB1PROD with BILLS
26 

•HR 5026 RS

1 ‘‘(d) DURATION OF EXPEDITED OR EMERGENCY

2 RULES OR ORDERS.—Any rule or order issued by the Com3 mission without prior notice or hearing under subsection 

4 (b)(2) or any order issued by the Secretary under subsection 

5 (c) shall remain effective for not more than 90 days unless, 

6 during the 90 day-period, the Commission— 

7 ‘‘(1) gives interested persons an opportunity to 

8 submit written data, views, or arguments (with or 

9 without opportunity for oral presentation); and 

10 ‘‘(2) affirms, amends, or repeals the rule or 

11 order. 

12 ‘‘(e) JURISDICTION.— 

13 ‘‘(1) IN GENERAL.—Notwithstanding section 201, 

14 this section shall apply to any entity that owns, con15 trols, or operates critical electric infrastructure. 

16 ‘‘(2) COVERED ENTITIES.— 

17 ‘‘(A) IN GENERAL.—An entity described in 

18 paragraph (1) shall be subject to the jurisdiction 

19 of the Commission for purposes of— 

20 ‘‘(i) carrying out this section; and 

21 ‘‘(ii) applying the enforcement authori22 ties of this Act with respect to this section. 

23 ‘‘(B) JURISDICTION.—This subsection shall 

24 not make an electric utility or any other entity 


tjames on DSKG8SOYB1PROD with BILLS
27 

•HR 5026 RS

1 subject to the jurisdiction of the Commission for 

2 any other purpose. 

3 ‘‘(3) ALASKA AND HAWAII EXCLUDED.—Except 

4 as provided in subsection (f), nothing in this section 

5 shall apply in the State of Alaska or Hawaii. 

6 ‘‘(f) DEFENSE FACILITIES.—Not later than 1 year 

7 after the date of enactment of this section, the Secretary 

8 of Defense shall prepare, in consultation with the Secretary, 

9 the States of Alaska and Hawaii, the Territory of Guam, 

10 and the electric utilities that serve national defense facilities 

11 in those States and Territory, a comprehensive plan that 

12 identifies the emergency measures or actions that will be 

13 taken to protect the reliability of the electric power supply 

14 of the national defense facilities located in those States and 

15 Territory in the event of an imminent cybersecurity threat. 

16 ‘‘(g) PROTECTION OF CRITICAL ELECTRIC INFRA17 STRUCTURE INFORMATION.— 

18 ‘‘(1) IN GENERAL.—Section 214 of the Critical 

19 Infrastructure Information Act of 2002 (6 U.S.C. 

20 133) shall apply to critical electric infrastructure in21 formation submitted to the Commission or the Sec22 retary under this section to the same extent as that 

23 section applies to critical infrastructure information 

24 voluntarily submitted to the Department of Homeland 

25 Security under that Act (6 U.S.C. 131 et seq.). 


tjames on DSKG8SOYB1PROD with BILLS
28 

•HR 5026 RS

1 ‘‘(2) RULES PROHIBITING DISCLOSURE.—Not2 withstanding section 552 of title 5, United States 

3 Code, the Secretary and the Commission shall pre4 scribe regulations prohibiting disclosure of informa5 tion obtained or developed in ensuring cyber security 

6 under this section if the Secretary or Commission, as 

7 appropriate, decides disclosing the information would 

8 be detrimental to the security of critical electric infra9 structure. 

10 ‘‘(3) PROCEDURES FOR SHARING INFORMA11 TION.— 

12 ‘‘(A) IN GENERAL.—The Secretary and the 

13 Commission shall establish procedures on the re14 lease of critical infrastructure information to en15 tities subject to this section, to the extent nec16 essary to enable the entities to implement rules 

17 or orders of the Commission or the Secretary. 

18 ‘‘(B) REQUIREMENTS.—The procedures 

19 shall— 

20 ‘‘(i) limit the redissemination of infor21 mation described in subparagraph (A) to 

22 ensure that the information is not used for 

23 an unauthorized purpose; 

24 ‘‘(ii) ensure the security and confiden25 tiality of the information; 


tjames on DSKG8SOYB1PROD with BILLS
29 

•HR 5026 RS

1 ‘‘(iii) protect the constitutional and 

2 statutory rights of any individuals who are 

3 subjects of the information; and 

4 ‘‘(iv) provide data integrity through 

5 the timely removal and destruction of obso6 lete or erroneous names and information.’’. 


tjames on DSKG8SOYB1PROD with BILLS
Calendar No. 617 

111TH CONGRESS 

2D SESSION H. R. 5026 

[Report No. 111–331] 

AN ACT 

To amend the Federal Power Act to protect the 

vulnerabilities. against cybersecurity and other threats and critical to the defense of the United States bulk-power system and electric infrastructure 

SEPTEMBER 27, 2010 

Reported with an amendment 


tjames on DSKG8SOYB1PROD with BILLS