FERC, CFTC, and State Energy Law Developments

At its last open meeting on Jan. 19, 2017, the Federal Energy Regulatory Commission (FERC) issued a policy statement that serves to reaffirm FERC’s efforts to encourage the development of electric storage resources. Of all the publications from FERC so far in calendar year 2017, this policy statement is one of the most important for entities in the electric power sector.

Read the full article.

Energy partner Ken Kulak recently participated in an Energy Policy Now podcast produced by the Kleinman Center for Energy Policy at the University of Pennsylvania. During the podcast, Ken discussed the Federal Energy Regulatory Commission’s (FERC’s) Notice of Proposed Rulemaking (NOPR) on electric storage, highlighting several issues raised in the NOPR regarding the development of “participation models” for electric storage and distributed energy resources in organized electricity markets. Comments to the FERC NOPR are due by February 13, 2017.

The White House’s newly released National Electric Grid Security and Resilience Action Plan contains dozens of directives to various federal agencies for enhancing the electric grid’s resilience in the face of cyber threats, physical attacks, and natural disasters. Many of the directives build on different programs that federal agencies already run, but for the first time, this action plan synthesizes those disparate initiatives and focuses them on three goals: protecting the grid’s vulnerabilities, improving responses to contingencies, and building a more resilient system.

Notably, the action plan realizes that many of these directives can only be achieved with public utilities’ participation and that cost recovery of investments for grid resiliency is essential if the government expects significant private investment to address the existing system vulnerabilities.

Read the full LawFlash: White House Releases Checklist to Improve Grid Resiliency.

This week, FERC submitted its annual financial report to the US Congress. Although part of the regular slate of voluminous reports sent up to Capitol Hill each year, FERC’s report often includes certain nuggets of information useful to the regulated community.

Buried in the report this year was a reminder that FERC—for the first time—has adjusted the civil monetary penalties that it may administer in response to violations of its rules.

As of July 16, 2016, the following civil monetary penalties apply:

  • $1,193,970 per violation, per day for violations of any provision of Part II of the Federal Power Act (FPA) or FERC’s regulations and orders thereunder, including the electric market manipulation provisions of the FPA and mandatory reliability standards.
  • $1,193,970 per violation, per day for violations of the Natural Gas Act or FERC’s implementing regulations and orders thereunder, including the natural gas market manipulation provisions.
  • $1,193,970 per violation, per day for violations of the Natural Gas Policy Act or FERC’s implementing regulations and orders thereunder.

FERC’s various organic statutes contain a variety of other miscellaneous civil penalty provisions as well, all of which were raised.

These adjustments were formally implemented through Order No. 826 in response to the Federal Civil Penalties Inflation Adjustment Act of 2015 and were the first modifications to the significant civil penalty authority given to FERC in the Energy Policy Act of 2005. Under the law, FERC will be required to update its monetary penalty amounts every January 15.

On December 7, the Energy Bar Association sponsored a discussion on FERC-led audits of entities’ compliance with the North American Electric Reliability Corporation’s (NERC’s) critical infrastructure protection (CIP) Reliability Standards. Staff members from FERC and NERC led the discussion and fielded questions from industry participants. This session provided the first public peek into the process for the CIP audits.

While FERC has the authority to conduct its CIP audits with or without NERC and the regional entities charged with front-line enforcement of the Reliability Standards, the panelists explained that FERC wanted to coordinate with NERC and the regional entities to leverage their collective compliance and enforcement experience.

On November 17, FERC adopted regulations to enhance the protection of Critical Energy Infrastructure Information (CEII) using its new statutory authority from the Fixing America’s Surface Transportation Act (FAST Act), which added Section 215A to the Federal Power Act.

In addition to finalizing the new protections for CEII promised in the initial notice of proposed rulemaking, the final rule also adopts a prohibition on the disclosure of CEII under the Freedom of Information Act (FOIA). The FAST Act had, for the first time, exempted CEII from FOIA disclosure. In the past, FERC had taken the position that it would not disclose CEII in response to FOIA requests, but there was no explicit statutory basis for doing so. With the new statute and implementing regulations, there is no longer any legal doubt regarding the FOIA-exempt nature of CEII.

Despite the apparent strict nature of these protections, the degree to which CEII will be protected remains to be seen. Although CEII is FOIA-exempt under the FAST Act, FERC continues to provide procedures whereby interested parties can submit requests for CEII and be granted access if such interested parties show a legitimate need and commit to non-disclosure. In the past, FERC has generally been willing to share CEII upon request; the new regulations provide modest additional regulatory procedures for such requests, but it is possible that FERC will continue its policy of making CEII easily available to interested parties. The language in the FAST Act does allow FERC to decline to disclose CEII, but—so far—FERC has not chosen to take that route.

In a final rule issued on September 22, the Federal Energy Regulatory Commission (FERC) established requirements for certain entities to assess the vulnerability of their transmission systems to geomagnetic disturbance (GMD) events. Such events occur when the sun ejects charged particles that interact and cause changes in the earth’s magnetic fields.

Reliability Standard TPL-007-1 (Transmission System Planned Performance for Geomagnetic Disturbance Events) sets requirements for certain transmission and generator owners, planning coordinators, and transmission planners to assess the vulnerability of their systems to a benchmark GMD event, described as a “one-in-100-year” event. Those entities are required to develop

  • system models necessary to complete the vulnerability assessments at least once in every 60 calendar months and
  • criteria for acceptable steady state voltage performance during a benchmark GMD event.

On July 21, FERC directed NERC to develop a new or modified “forward-looking, objective-driven” Reliability Standard that addresses supply chain risk management for industrial control system hardware, software, and computing and networking services (“cyber controls”) associated with BES operations. FERC required the standard to address

  • software integrity and authenticity;
  • vendor remote access;
  • information system planning; and
  • vendor risk management and procurement controls.

FERC is concerned that a “gap” exists in the CIP Reliability Standards, which has been highlighted by recent events where malware campaigns have targeted supply chain vendors in BES cyber control systems.

FERC expressed concern that vulnerable systems may be attacked either through hardware or software components of a cyber-control system or a third-party service provider may be attacked who has access to sensitive IT infrastructure or that holds or maintains sensitive data.

On July 21, prompted by cyberattacks highlighting cyber system vulnerabilities that may be exploited to attack the operation and maintenance of interconnected networks, FERC sought comment from industry participants on possible modifications to the CIP Reliability Standards that could address the cybersecurity of control centers used to monitor and control the BES in real time.

The Commission seeks comment on the following:

  • The operational impact of forming a separation between the internet and BES control center cyber systems performing transmission operator functions through use of physical (hardware) or logical (software means).
  • Whether rules should be implemented concerning “application whitelisting,” computer administration practices that would prevent unauthorized programs from running on a system network. FERC believes that application whitelisting could be a more effective mitigation tool than other mitigation measures because whitelisting allows only software applications and processes that are reviewed and tested before use in the system network.

In a final rule issued on June 16, the Federal Energy Regulatory Commission (FERC) directed the North American Electric Reliability Corporation (NERC) to make available to FERC staff certain databases developed by NERC that contain detailed, entity-specific information on transmission and generation assets as well as protection system misoperations.

FERC concluded that it needs access to the information in these databases to carry out its reliability responsibilities under section 215 of the Federal Power Act, including the identification of needed new or modified reliability standards and a better understanding of NERC’s periodic reliability and adequacy assessments. The only changes from FERC’s initial proposal were to limit FERC staff’s access to information about US facilities and to exclude any information voluntarily provided to NERC.