,i  #aacth ,,congress  #b;d ,session    
,h4 ,r4 #dbih  ,,in ,,the ,,house ,,of  
,,representatives  ,march #bf1 #bjad    
,mr4 ,waxman introduced the following   
bill2 which was referred to the         
,committee on ,energy and ,commerce  ,a 
,,bill  ,to amend the ,federal ,power   
,act to protect the bulk-power system   
and electric infrastructure critical to 
the defense of the ,united ,states      
against cybersecurity1 physical1 and    
other threats and vulnerabilities4  #a4 
,short title ,this ,act may be cited as 
the ,grid ,reliability and              
,infrastructure ,defense ,act or the    
,,grid ,act4  #b4 ,amendment to the     
,federal ,power ,act  7a7 ,critical     
electric infrastructure security ,part  
,,ii of the ,federal ,power ,act 7#af   
,u4,s4,c4 #hbd et seq47 is amended by   
adding after section #bae the following 
new section3  #bae;,a4 ,critical        
electric infrastructure security  7a7   
,definitions ,for purposes of this      
section3  7#a7 ,bulk-power system2      

electric reliability organization2      
regional entity ,the terms bulk-power   
system1 ,electric ,reliability          
,organization1 and regional entity have 
the meanings given such terms in        
paragraphs 7#a71 7#b71 and 7#g7 of      
section #bae7;a71 respectively4  7#b7   
,defense critical electric              
infrastructure ,the term defense        
critical electric infrastructure means  
any infrastructure located in the       
,united ,states 7including the          
territories7 used for the generation1   
transmission1 or distribution of        
electric energy that--  7,a7 is not part
 of the bulk-power system2 and  7,b7    
serves a facility designated by the     
,president pursuant to subsection       
7d77#a71 but is not owned or operated by
 the owner or operator of such facility4
  7#c7 ,defense critical electric       
infrastructure vulnerability ,the term  
defense critical electric infrastructure
 vulnerability means a weakness in      
defense critical electric infrastructure

 that1 in the event of--  7,a7 a        
malicious act using electronic          
communication or an electromagnetic     
pulse1 would pose a substantial risk of 
disruption of those electronic devices  
or communications networks1 including   
hardware1 software1 and data1 that are  
essential to the reliability of defense 
critical electric infrastructure2 or    
7,b7 a direct physical attack on defense
 critical electric infrastructure1 would
 pose a substantial risk of significant 
adverse effects on the reliability of   
defense critical electric               
infrastructure4  7#d7 ,electromagnetic  
pulse ,the term electromagnetic pulse   
means #a or more pulses of              
electromagnetic energy1 emitted by any  
device or weapon capable of generating  
such a pulse1 that would pose a         
substantial risk of disruption to the   
operation of those electronic devices or
 communications networks1 including     
hardware1 software1 and data1 that are  
essential to the reliability of systems 

necessary for the generation1           
transmission1 and distribution of       
electric energy4  7#e7 ,geomagnetic     
storm ,the term geomagnetic storm means 
a temporary disturbance of the ,earth's 
magnetic field resulting from solar     
activity4  7#f7 ,grid security threat   
,the term grid security threat means a  
substantial likelihood of--  7,a7  7i7 a
 malicious act using electronic         
communication or an electromagnetic     
pulse1 or a geomagnetic storm event1    
that could disrupt the operation of     
those electronic devices or             
communications networks1 including      
hardware1 software1 and data1 that are  
essential to the reliability of the     
bulk-power system or of defense critical
 electric infrastructure2 and  7ii7     
disruption of the operation of such     
devices or networks1 with significant   
adverse effects on the reliability of   
the bulk-power system or of defense     
critical electric infrastructure1 as a  
result of such act or event2 or  7,b7   

7i7 a direct physical attack on the     
bulk-power system or on defense critical
 electric infrastructure2 and  7ii7     
significant adverse effects on the      
reliability of the bulk-power system or 
of defense critical electric            
infrastructure as a result of such      
physical attack4  7#g7 ,grid security   
vulnerability ,the term grid security   
vulnerability means a weakness in the   
bulk-power system that1 in the event    
of--  7,a7 a malicious act using        
electronic communication or an          
electromagnetic pulse1 would pose a     
substantial risk of disruption to the   
operation of those electronic devices or
 communications networks1 including     
hardware1 software1 and data1 that are  
essential to the reliability of the     
bulk-power system2 or  7,b7 a direct    
physical attack on the bulk-power       
system1 would pose a substantial risk of
 significant adverse effects on the     
reliability of the bulk-power system4   
7#h7 ,large transformer ,the term large 

transformer means an electric           
transformer that is part of the         
bulk-power system4  7#i7 ,protected     
information ,the term protected         
information means information1 other    
than classified national security       
information1 designated as protected    
information by the ,commission under    
subsection 7e77#b7--  7,a7 that was     
developed or submitted in connection    
with the implementation of this section2
  7,b7 that specifically discusses grid 
security threats1 grid security         
vulnerabilities1 defense critical       
electric infrastructure vulnerabilities1
 or plans1 procedures1 or measures to   
address such threats or vulnerabilities2
 and  7,c7 the unauthorized disclosure  
of which could be used in a malicious   
manner to impair the reliability of the 
bulk-power system or of defense critical
 electric infrastructure4  7#aj7        
,secretary ,the term ,secretary means   
the ,secretary of ,energy4  7#aa7       
,security ,the definition of security in

 section #c7af7 shall not apply to the  
provisions in this section4  7b7        
,emergency response measures  7#a7      
,authority to address grid security     
threats ,whenever the ,president issues 
and provides to the ,commission 7either 
directly or through the ,secretary7 a   
written directive or determination      
identifying an imminent grid security   
threat1 the ,commission may1 with or    
without notice1 hearing1 or report1     
issue such orders for emergency measures
 as are necessary in its judgment to    
protect the reliability of the          
bulk-power system or of defense critical
 electric infrastructure against such   
threat4 ,as soon as practicable but not 
later than #ahj days after the date of  
enactment of this section1 the          
,commission shall1 after notice and     
opportunity for comment1 establish rules
 of procedure that ensure that such     
authority can be exercised              
expeditiously4  7#b7 ,notification of   
congress ,whenever the ,president issues

 and provides to the ,commission 7either
 directly or through the ,secretary7 a  
written directive or determination under
 paragraph 7#a71 the ,president 7or the 
,secretary1 as the case may be7 shall   
promptly notify congressional committees
 of relevant jurisdiction1 including the
 ,committee on ,energy and ,commerce of 
the ,house of ,representatives and the  
,committee on ,energy and ,natural      
,resources of the ,senate1 of the       
contents of1 and justification for1 such
 directive or determination4  7#c7      
,consultation ,before issuing an order  
for emergency measures under paragraph  
7#a71 the ,commission shall1 to the     
extent practicable in light of the      
nature of the grid security threat and  
the urgency of the need for such        
emergency measures1 consult with        
appropriate governmental authorities in 
,canada and ,mexico1 entities described 
in paragraph 7#d71 the ,secretary1 and  
other appropriate ,federal agencies     
regarding implementation of such        

emergency measures4  7#d7 ,application  
,an order for emergency measures under  
this subsection may apply to--  7,a7 the
 ,electric ,reliability ,organization2  
7,b7 a regional entity2 or  7,c7 any    
owner1 user1 or operator of the         
bulk-power system or of defense critical
 electric infrastructure within the     
,united ,states4  7#e7 ,discontinuance  
,the ,commission shall issue an order   
discontinuing any emergency measures    
ordered under this subsection1 effective
 not later than #cj days after the      
earliest of the following3  7,a7 ,the   
date upon which the ,president issues   
and provides to the ,commission 7either 
directly or through the ,secretary7 a   
written directive or determination that 
the grid security threat identified     
under paragraph 7#a7 no longer exists4  
7,b7 ,the date upon which the           
,commission issues a written            
determination that the emergency        
measures are no longer needed to address
 the grid security threat identified    

under paragraph 7#a71 including by means
 of ,commission approval of a           
reliability standard under section #bae 
that the ,commission determines         
adequately addresses such threat4  7,c7 
,the date that is #a year after the     
issuance of an order under paragraph    
7#a74  7#f7 ,cost recovery ,if the      
,commission determines that owners1     
operators1 or users of the bulk-power   
system or of defense critical electric  
infrastructure have incurred substantial
 costs to comply with an order under    
this subsection and that such costs were
 prudently incurred and cannot          
reasonably be recovered through         
regulated rates or market prices for the
 electric energy or services sold by    
such owners1 operators1 or users1 the   
,commission shall1 after notice and an  
opportunity for comment1 establish a    
mechanism that permits such owners1     
operators1 or users to recover such     
costs4  7c7 ,measures ,to address grid  
security vulnerabilities  7#a7          

,commission authority ,if the           
,commission1 in consultation with       
appropriate ,federal agencies1          
identifies a grid security vulnerability
 that the ,commission determines has not
 adequately been addressed through a    
reliability standard developed and      
approved under section #bae1 the        
,commission shall1 after notice and     
opportunity for comment and after       
consultation with the ,secretary1 other 
appropriate ,federal agencies1 and      
appropriate governmental authorities in 
,canada and ,mexico1 promulgate a rule  
or issue an order requiring             
implementation1 by any owner1 operator1 
or user of the bulk-power system in the 
,united ,states1 of measures to protect 
the bulk-power system against such      
vulnerability4 ,before promulgating a   
rule or issuing an order under this     
paragraph1 the ,commission shall1 to the
 extent practicable in light of the     
urgency of the need for action to       
address the grid security vulnerability1

 request and consider recommendations   
from the ,electric ,reliability         
,organization regarding such rule or    
order4 ,the ,commission may establish an
 appropriate deadline for the submission
 of such recommendations4  7#b7 ,certain
 existing cybersecurity vulnerabilities 
,not later than #ahj days after the date
 of enactment of this section1 the      
,commission shall1 after notice and     
opportunity for comment and after       
consultation with the ,secretary1 other 
appropriate ,federal agencies1 and      
appropriate governmental authorities in 
,canada and ,mexico1 promulgate a rule  
or issue an order requiring the         
implementation1 by any owner1 user1 or  
operator of the bulk-power system in the
 ,united ,states1 of such measures as   
are necessary to protect the bulk-power 
system against the vulnerabilities      
identified in the ,june #ba1 #bjjg1     
communication to certain ,electricity   
,sector ,owners and ,operators from the 
,north ,american ,electric ,reliability 

,corporation1 acting in its capacity as 
the ,electricity ,sector ,information   
and ,analysis ,center4  7#c7 ,rescission
 ,the ,commission shall approve a       
reliability standard developed under    
section #bae that addresses a grid      
security vulnerability that is the      
subject of a rule or order under        
paragraph 7#a7 or 7#b71 unless the      
,commission determines that such        
reliability standard does not adequately
 protect against such vulnerability or  
otherwise does not satisfy the          
requirements of section #bae4 ,upon such
 approval1 the ,commission shall rescind
 the rule promulgated or order issued   
under paragraph 7#a7 or 7#b7 addressing 
such vulnerability1 effective upon the  
effective date of the newly approved    
reliability standard4  7#d7 ,large      
transformer availability ,not later than
 #a year after the date of enactment of 
this section1 the ,commission shall1    
after notice and an opportunity for     
comment and after consultation with the 

,secretary and other appropriate        
,federal agencies1 issue an order       
directing the ,electric ,reliability    
,organization to submit to the          
,commission for approval under section  
#bae1 not later than #a year after the  
issuance of such order1 reliability     
standards addressing availability of    
large transformers4 ,such standards     
shall require entities that own or      
operate large transformers to ensure1   
individually or jointly1 adequate       
availability of large transformers to   
promptly restore the reliable operation 
of the bulk-power system in the event   
that any such transformer is destroyed  
or disabled as a result of a reasonably 
foreseeable physical or other attack or 
geomagnetic storm event4 ,the           
,commission's order shall specify the   
nature and magnitude of the reasonably  
foreseeable attacks or events that shall
 provide the basis for such standards4  
,such standards shall--  7,a7 provide   
entities subject to the standards with  

the option of meeting such standards    
individually or jointly2 and  7,b7      
appropriately balance the risks         
associated with a reasonably foreseeable
 attack or event1 including any regional
 variation in such risks1 and the costs 
of ensuring adequate availability of    
spare transformers4  7d7 ,critical      
defense facilities  7#a7 ,designation   
,not later than #ahj days after the date
 of enactment of this section1 the      
,president shall designate1 in a written
 directive or determination provided to 
the ,commission1 facilities located in  
the ,united ,states 7including the      
territories7 that are--  7,a7 critical  
to the defense of the ,united ,states2  
and  7,b7 vulnerable to a disruption of 
the supply of electric energy provided  
to such facility by an external         
provider4  ,the number of facilities    
designated by such directive or         
determination shall not exceed #ajj4    
,the ,president may periodically revise 
the list of designated facilities       

through a subsequent written directive  
or determination provided to the        
,commission1 provided that the total    
number of designated facilities at any  
time shall not exceed #ajj4  7#b7       
,commission authority ,if the           
,commission identifies a defense        
critical electric infrastructure        
vulnerability that the ,commission1 in  
consultation with owners and operators  
of any facility or facilities designated
 by the ,president pursuant to paragraph
 7#a71 determines has not adequately    
been addressed through measures         
undertaken by owners or operators of    
defense critical electric               
infrastructure1 the ,commission shall1  
after notice and an opportunity for     
comment and after consultation with the 
,secretary and other appropriate        
,federal agencies1 promulgate a rule or 
issue an order requiring implementation1
 by any owner or operator of defense    
critical electric infrastructure1 of    
measures to protect the defense critical

 electric infrastructure against such   
vulnerability4 ,the ,commission shall   
exempt from any such rule or order any  
specific defense critical electric      
infrastructure that the ,commission     
determines already has been adequately  
protected against the identified        
vulnerability4 ,the ,commission shall   
make any such determination in          
consultation with the owner or operator 
of the facility designated by the       
,president pursuant to paragraph 7#a7   
that relies upon such defense critical  
electric infrastructure4  7#c7 ,cost    
recovery ,an owner or operator of       
defense critical electric infrastructure
 shall be required to take measures     
under paragraph 7#b7 only to the extent 
that the owners or operators of a       
facility or facilities designated by the
 ,president pursuant to paragraph 7#a7  
that rely upon such infrastructure agree
 to bear the full incremental costs of  
compliance with a rule promulgated or   
order issued under paragraph 7#b74  7e7 

,protection of information  7#a7        
,prohibition of public disclosure of    
protected information ,protected        
information--  7,a7 shall be exempt from
 disclosure under section #eeb7;b77#c7  
of title #e1 ,united ,states ,code2 and 
7,b7 shall not be made available        
pursuant to any ,state1 local1 or tribal
 law requiring disclosure of information
 or records4  7#b7 ,information sharing 
7,a7 ,in general ,consistent with the   
,controlled ,unclassified ,information  
framework established by the ,president1
 the ,commission shall promulgate such  
regulations and issue such orders as    
necessary to designate protected        
information and to prohibit the         
unauthorized disclosure of such         
protected information4  7,b7 ,sharing of
 protected information ,the regulations 
promulgated and orders issued pursuant  
to subparagraph 7,a7 shall provide      
standards for and facilitate the        
appropriate sharing of protected        
information with1 between1 and by       

,federal1 ,state1 local1 and tribal     
authorities1 the ,electric ,reliability 
,organization1 regional entities1 and   
owners1 operators1 and users of the     
bulk-power system in the ,united ,states
 and of defense critical electric       
infrastructure4 ,in promulgating such   
regulations and issuing such orders1 the
 ,commission shall take account of the  
role of ,state commissions in reviewing 
the prudence and cost of investments    
within their respective jurisdictions4  
,the ,commission shall consult with     
appropriate ,canadian and ,mexican      
authorities to develop protocols for the
 sharing of protected information with1 
between1 and by appropriate ,canadian   
and ,mexican authorities and owners1    
operators1 and users of the bulk-power  
system outside the ,united ,states4     
7#c7 ,submission of information to      
congress ,nothing in this section shall 
permit or authorize the withholding of  
information from ,congress1 any         
committee or subcommittee thereof1 or   

the ,comptroller ,general4  7#d7        
,disclosure of non-protected information
 ,in implementing this section1 the     
,commission shall protect from          
disclosure only the minimum amount of   
information necessary to protect the    
reliability of the bulk-power system and
 of defense critical electric           
infrastructure4 ,the ,commission shall  
segregate protected information within  
documents and electronic communications1
 wherever feasible1 to facilitate       
disclosure of information that is not   
designated as protected information4    
7#e7 ,duration of designation           
,information may not be designated as   
protected information for longer than #e
 years1 unless specifically redesignated
 by the ,commission4  7#f7 ,removal of  
designation ,the ,commission may remove 
the designation of protected            
information1 in whole or in part1 from a
 document or electronic communication if
 the unauthorized disclosure of such    
information could no longer be used to  

impair the reliability of the bulk-power
 system or of defense critical electric 
infrastructure4  7#g7 ,judicial review  
of designations ,notwithstanding        
subsection 7f7 of this section or       
section #cac1 a person or entity may    
seek judicial review of a determination 
by the ,commission concerning the       
designation of protected information    
under this subsection exclusively in the
 district court of the ,united ,states  
in the district in which the complainant
 resides1 or has his principal place of 
business1 or in the ,district of        
,columbia4 ,in such a case the court    
shall determine the matter de novo1 and 
may examine the contents of documents or
 electronic communications designated as
 protected information in camera to     
determine whether such documents or any 
part thereof were improperly designated 
as protected information4 ,the burden is
 on the ,commission to sustain its      
designation4  7f7 ,judicial review ,the 
,commission shall act expeditiously to  

resolve all applications for rehearing  
of orders issued pursuant to this       
section that are filed under section    
#cac7;a74 ,any party seeking judicial   
review pursuant to section #cac of an   
order issued under this section may     
obtain such review only in the ,united  
,states ,court of ,appeals for the      
,district of ,columbia ,circuit4  7g7   
,provision of assistance to industry in 
meeting grid security protection needs  
7#a7 ,expertise and resources ,the      
,secretary shall establish a program1 in
 consultation with other appropriate    
,federal agencies1 to develop technical 
expertise in the protection of systems  
for the generation1 transmission1 and   
distribution of electric energy against 
geomagnetic storms or malicious acts    
using electronic communications or      
electromagnetic pulse that would pose a 
substantial risk of disruption to the   
operation of those electronic devices or
 communications networks1 including     
hardware1 software1 and data1 that are  

essential to the reliability of such    
systems4 ,such program shall include the
 identification and development of      
appropriate technical and electronic    
resources1 including hardware1 software1
 and system equipment4  7#b7 ,sharing   
expertise ,as appropriate1 the          
,secretary shall offer to share         
technical expertise developed under the 
program under paragraph 7#a71 through   
consultation and assistance1 with       
owners1 operators1 or users of systems  
for the generation1 transmission1 or    
distribution of electric energy located 
in the ,united ,states and with ,state  
commissions4 ,in offering such support1 
the ,secretary shall assign higher      
priority to systems serving facilities  
designated by the ,president pursuant to
 subsection 7d77#a7 and other           
critical-infrastructure facilities1     
which the ,secretary shall identify in  
consultation with the ,commission and   
other appropriate ,federal agencies4    
7#c7 ,security clearances and           

communication ,the ,secretary shall     
facilitate and1 to the extent           
practicable1 expedite the acquisition of
 adequate security clearances by key    
personnel of any entity subject to the  
requirements of this section to enable  
optimum communication with ,federal     
agencies regarding grid security        
threats1 grid security vulnerabilities1 
and defense critical electric           
infrastructure vulnerabilities4 ,the    
,secretary1 the ,commission1 and other  
appropriate ,federal agencies shall1 to 
the extent practicable and consistent   
with their obligations to protect       
classified and protected information1   
share timely actionable information     
regarding grid security threats1 grid   
security vulnerabilities1 and defense   
critical electric infrastructure        
vulnerabilities with appropriate key    
personnel of owners1 operators1 and     
users of the bulk-power system and of   
defense critical electric               
infrastructure4  7h7 ,certain federal   

entities ,for the #aa-year period       
commencing on the date of enactment of  
this section1 the ,tennessee ,valley    
,authority and the ,bonneville ,power   
,administration shall be exempt from any
 requirement under subsection 7b7 or 7c7
 7except for any requirement addressing 
a malicious act using electronic        
communication74  4  7b7 ,conforming     
amendments  7#a7 ,jurisdiction ,section 
#bja7;b77#b7 of the ,federal ,power ,act
 7#af ,u4,s4,c4 #hbd7;b77#b77 is amended
 by inserting #bae;,a1 after #bae1 each 
place it appears4  7#b7 ,public utility 
,section #bja7;e7 of the ,federal ,power
 ,act 7#af ,u4,s4,c4 #hbd7;e77 is       
amended by inserting #bae;,a1 after     
#bae14