Review - TSA Published 60-day ICR Revision for Surface Security Training – 1-10-23

Today the TSA published a 60-day information collection extension notice in the Federal Register (88 FR 1397-1398) supporting their Security Training for Surface Transportation Employees regulations. While this is listed as an ICR extension, the TSA is making a major change to the burden estimate, reporting a reduction in the overall annual burden from 12,318 hours to 4,623 hours, reportedly due to a reduction in the number of reporting entities from 289 to 218.

Commentary

This is the first update of this information collection request. The data provided in the initial ICR notice was an estimate that was broadly based on TSA’s expectations of industry’s response. It is not unexpected that those expectations would be found to be incomplete, thus changes in the burden estimate are to be expected. Having said that, this ICR is much too complicated in the response and burden estimate for TSA to be able to glibly state that a reduction in the estimated burden from a smaller than originally estimated number of responses provides an adequate explanation of the change in burden estimate for this ICR, especially where there is a 62.5% reduction in burden estimate from a 24.6% reduction in the number of expected responses.

 

For more details about this complex ICR, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/tsa-published-60-day-icr-revision - subscription required.

GAO Reports – TSA Surface Transportation Security Training

This week the Government Accounting Office published a report on “Surface Transportation: TSA Implementation of Security Training Requirement”. This report is a look at the training mandate rule for selected surface transportation organizations that was published by TSA in 2020. The compliance date for that rule was extended a couple of times because of the impact of the COVID-19 pandemic.

According to the report the TSA has identified 127 organizations subject to the training requirements of the new regulations. The ‘Highlights’ document accompanying the report notes that:

“As of December 2021, TSA had reviewed each of the 121 submitted training programs and had approved about three-fourths (88 of 121). TSA reported that it returned 84 percent of the submitted programs to owner/operators at least once for revision. The primary reason for TSA-requested revisions was that programs did not cover all the required training topics.”

This report also includes a list of public transportation and passenger railroads that are subject to the training requirements of the rule and a list of urban areas where over-the-road bus companies would be subject to those requirements.

TSA Extends Surface Transport Security Training Rule Compliance Date Again

Yesterday the TSA published a final rule in the Federal Register (86 FR 23629-23633) amending their Security Training for Surface Transportation Employees rule which was published last year and amended similarly twice, in May 2020 and October 2020. Yesterday’s rule also extends two of the compliance dates in the amended rule. It also corrects what TSA is calling ‘citation errors’ in the original rule.

Extension Dates

First, the rule extends the compliance deadline in §1570.109(b) for security program submission from March 22, 2021, to June 21, 2021.

For owner/operators that have already submitted their security program to TSA (about 30% of the affected organizations), the rule provides an additional 90 days (15 months instead of 12 months) from the date of TSA approval to complete the initial training required by 49 CFR 1570.111(a)(1).

Citation Errors

The first error being corrected is in §1570.203(a). TSA is (as it described in the preamble to the original rule) specifically adding bus operations of a public transportation owner/operator and OTRB owner/operator that are required to provide security training under the rule to the “reporting significant security concerns” requirements of §1570.203(a).

Secondly, the rule addresses an incorrect citation in §1582.101(c). It changes “described in §1580.301” to read “described in § 1580.101”.

Finally, again in §1582.101(c), it changes “paragraph (a)(1) or (a)(2)” to read “paragraph (a) or (b)”.

Effective Date

This direct final rule became effective yesterday, May 4^th, 2021.

TSA Amends Surface Security Training Compliance Dates

The TSA published a notice in Monday’s Federal Register (available online today; 85 FR 67681-67683) announcing the extension of compliance deadlines for the “Security Training for Surface Transportation Employees” final rule. This notice further extends one of the compliance deadlines that was revised in May. Both sets of extensions were established because of complications in the transportation sector due to the COVID-19 pandemic.

In this latest extension the TSA keeps the effective date of the regulation at the extended date of September 21^st, 2020. The deadline for notifying TSA of applicability determination (1570.105) remains October 21st, 2020. The deadline for providing security coordinator information (49 CFR 1570.201) remains October 28th, 2020. The notice states that the deadline for §1570.203 (security incident reporting requirement) compliance has not been changed. There was no specific date set in the regulation for that requirement, so the effective date for that requirement is the effective date of the regulation; 9-21-20.

The only change then is the deadline for submission of security training program to TSA for approval {§1570.109(b)}; it is being changed from December 21st, 2020 to March 22^nd, 2021.

TSA is making this change in the regulation without going through the publish and comment process under provisions of 5 USC 553 (b) and (d). They note that:

“TSA has good cause to delay the compliance deadline for submission of security training programs without advance notice and comment or a delayed effective date. To delay taking this action while waiting for public comment would be impracticable and contrary to the public interest. The owner/operators subject to the requirements of the final rule need immediate certainty regarding the deadlines of the final rule so that they may focus on other urgent issues affecting their operations.”

OMB Approves Initial TSA Surface Security Training ICR

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) approved the information collection request (ICR) from the TSA for the “Security Training Program for Surface Transportation Employees”. This new ICR (1652-0066) supports the final rule that was published last March.

The Supporting Statement [.DOCX download link] document provides more details about the ICR than was included in the preamble to the rule, including justification for each of the information collection requirements in the ICR. A separate web page provides links to the detailed information about each of the 15 information collection requirements under the rule.

TSA Extends Security Training Rule Deadlines

Today the Transportation Security Administration (TSA) published a final rule in the Federal Register (85 FR 25315-25317) delaying the effective date of the final rule entitled, “Security Training for Surface Transportation Employees” that was published on April 1^st, 2020. TSA is taking this action because it has determined that covered entities may have difficulties complying with the published deadlines because of actions taken in response to the COVID-19 pandemic.

The effective date of the earlier rule is changed from June 22^nd, 2020 to September 21^st, 2020. As a result of this change the following deadlines within the earlier rule are also being changed. They include:

• Deadline for notifying TSA of applicability determination (1570.105) – from July 22^nd, 2020 to October 21^st, 2020;

• Deadline for providing security coordinator information (49 CFR 1570.201) – from July 29th, 2020 to October 28^th, 2020; and

• Deadline for submission of security training program to TSA for approval (1570.109(b)) – September 20^th, 2020 to December 21^st, 2020.

Because of the nature of the changes made by this new final rule and the imminent nature of the impending deadlines, TSA determined that the normal rule making processes, including OMB review and the publish/public comment process, were not required.

TSA Publishes Surface Transport Security Training Rule

Last week the Transportation Security Agency published a final rule in the Federal Register (85 FR 16456-16517) on “Security Training for Surface Transportation Employees”. The NPRM for this rule was published in January 2017. The rule requires owner/operators of higher-risk freight railroad carriers, public transportation agencies, passenger railroad carriers, and over-the-road bus companies, to provide TSA-approved security training to employees performing security-sensitive functions.

The Rule

The rule would:

• Require security training for employees of higher-risk freight railroad carriers, public transportation agencies (including rail mass transit and bus systems), passenger railroad carriers, and over-the-road bus (OTRB) companies;

• Owner/operators of these higher-risk railroads, systems, and companies would be required to train employees performing security-sensitive functions, using a curriculum addressing preparedness and how to observe, assess, and respond to terrorist-related threats and/or incidents;

• Require affected owner/operators to submit their training programs to TSA for approval;

• Expand current requirements for rail security coordinators and reporting of significant security concerns (currently limited to freight railroads, passenger railroads, and the rail operations of public transportation systems) to include the bus components of higher-risk public transportation systems and higher-risk OTRB companies;

• Make the maritime and land transportation provisions of TSA's regulations consistent with other TSA regulations by codifying general responsibility to comply with security requirements; compliance, inspection, and enforcement; and procedures to request alternate measures for compliance;

• Add a definition for Transportation Security-Sensitive Materials (TSSM); and

• Other provisions are being amended or added, as necessary, to implement these additional requirements.

Changes made from the proposed language in the NPRM include:

• TSA is modifying the recurrent security training schedule to a three-year cycle rather than annual.

• Changes to security programs and plans may require training certain employees within 90 days of the changes.

• The final rule includes a specific list of the types of changes that would trigger the need to update the security training program.

• The final rule requires an amendment to the approved security training program to be requested no later than 65 days after the change to the security program/measures/plans takes effect.

• Final rule limits the scope of the security coordinator requirement to rail operations of public transportation agencies and the bus-only operations of those determined by TSA to be higher-risk.

• Final rule limits the scope of the reporting security issues requirement to rail operations of public transportation agencies and the bus-only operations of those determined by TSA to be higher-risk.

Effective Date

The effective date for this rulemaking is June 22^nd, 2020. Effective dates for specific provisions include:

• Deadline for notifying TSA of applicability determination (1570.105) – July 22^nd, 2020;

• Deadline for providing security coordinator information to TSA (1570.201) – July 29^th, 2020;

• Deadline for submission of security training program to TSA for approval (1570.109(b)) – October 28^th, 2020;

• TSA approval or notification of required modification (1570.109(c)) – 60-days from receipt;

• Initial training of security-sensitive employees (1570.111(a)) – 1-year from TSA approval;

• Recurrent training of security-sensitive employees (1570.111(b)) – 3-years from initial training.

Cybersecurity

There is an interesting mention of cybersecurity in the preamble to the bill. In response to a commenters question about whether a ‘cyber-expert’ would be considered an ‘employee in a security-sensitive position’, the TSA responded:

“A cyber-expert may be considered a security-sensitive employee based upon specific job functions, such as functions involving control or movement of trains, or because of other cyber-security responsibilities related to the owner/operators security measures in its security plan to protect the integrity of its information systems.”

Commentary

It is interesting that the TSA used the congressional mandate for this rulemaking as a response/justification to several commenters’ questions and objections in the formulation of this final rule. The fact that TSA’s hands were tied in a lot instances by the congressional mandate was grandly ignored in one specific instance. In 6 USC 1137(c)(6) (and similarly in §1167 and §1184) Congress required as one of the elements of the mandated training:

“Training related to behavioral and psychological understanding of, and responses to, terrorist incidents, including the ability to cope with hijacker behavior, and passenger responses.”

That training requirement is conspicuously absent from the requirements in this rulemaking. To be sure, this requirement would have been difficult and time consuming to have been adequately, much less effectively, addressed in a training program, but it was a ‘congressional mandate’; no matter how inappropriate. If that one could be ignored, so could have all of the others.

OMB Approves TSA Surface Security Employee Training Final Rule

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved the final rule from the Transportation Security Administration (TSA) on “Security Training for Surface Transportation Employees”. This final rule was submitted to OIRA back in July. The NPRM was published in December 2016. I did a series of blog posts on the provisions of the NPRM.

This rulemaking was mandated by Congress in the Recommendations of the 9/11 Commission Act of 2007 (PL 110-53) and codified at (6 USC 1137; 6 USC 1167; and 6 USC 1184). That mandate required that these rulemakings be completed by 2008. Needless to say this provides an interesting lesson in the efficacy of congressional mandates.

There was some thought in the industry when the NPRM was published that the Trump Administration would quash this rulemaking or at least fail to act on it. It will be interesting to see what changes have been made by an administration that is reluctant to regulate at best. This could be another rulemaking that makes it into the court system if this final rule deviates too far from the Congressional mandate.

DHS Publishes Semiannual Regulatory Agenda – 11-16-18

Today the Department of Homeland Security (DHS) published their Fall 2018 Semiannual Regulatory Agenda in the Federal Register (83 FR 58031-58038). This is essentially an abstract of some of the information that was originally published in the Fall 2018 Unified Agenda. This Regulatory Agenda identifies a few of the rulemaking activities from the UA that agencies of DHS probably intend to getting around to in the coming six months or so, but is clearly not any indication of whether or not that activity will actually occur.

Some of the DHS rulemakings from this RA that I will be watching if/when they are actually published will be:

• Ammonium Nitrate Security Program;

• Homeland Security Acquisition Regulation: Safeguarding of Controlled Unclassified Sensitive Information (HSAR Case 2015-001);

• Homeland Security Acquisition Regulation: Information Technology Security Awareness Training (HSAR Case 2015-002);

• Chemical Facility Anti-Terrorism Standards (CFATS);

• Security Training for Surface Transportation Employees;

It is odd that the last of the rulemakings listed above is not actually explicated in the DHS document. Instead, you have to go to the Regulatory Information Service Center’s RA entry in the Federal Register to find the full explanation for the security training rulemaking.

Of course, there is nothing new here that was not published weeks ago in the UA; publishing it in the Federal Register just makes is slightly more official. It does not, however, mean that we will see these specific rulemakings any quicker. Rulemaking is like making fine wines, it takes a long time and you cannot tell until the process is completed how good the product actually is.

Thank goodness we are not relying on paper distribution of the Federal Register anymore, this would be a deforestation product.

HR 4474 Introduced – Surface Transportation Security

Last month Rep. Watson-Coleman (D,NJ) introduced HR 4474, the Surface Transportation and Public Area Security Act of 2017. While the main focus of the bill is on public transportation security issues, it would have some impact on chemical transportation security issues.

Sections of the bill that may be of specific interest to readers of this blog include:

§106. Frontline employee security training.

§202. Risk scenarios.

§203. Assessments and security plans.

§301. Threat information sharing.

§302. Integrated and unified operations centers.

§304. Security technologies tied to foreign threat countries.

Security Training

Section 106 attempts to address the failure of the Transportation Security Administration (TSA) to implement surface transportation employee security training requirements established by Congress in 2007 (6 USC 1137, 1167, and 1184). TSA published a notice of proposed rulemaking in December 2016. The Fall 2017 Unified Agenda indicates that the Trump Administration currently intends to publish a final rule in September of next year, though that date slips each time the Unified Agenda is updated.

This section would require a report to Congress by the TSA on the status of the rulemaking and a subsequent review of that report by the DHS Inspector General.

Risk Scenarios

Section 202 would require TSA to annually use terrorist attack scenarios in establishing risk-based priorities supporting the modal transportation security plans currently required by 49 USC 114(s)(1)(B). Those scenarios are specifically required to include “cyber attack scenarios” {§202(b)}. A report to Congress is required on the priorities established, but details on the scenarios used is not required to be part of that report.

Security Plans

Similar to §106, §203 would require a report to Congress (with a subsequent review by the DHS IG) of the status of the rulemaking supporting the congressionally mandated (6 USC 1134, 1162, and 1181) development of security assessments and security plans by various surface transportation organizations. TSA published an advanced notice of proposed rulemaking on these requirements in December 2016 and the Trump Administration re-opened the comment period in March of this year. The current Unified Agenda lists this rulemaking under the ‘Long-Term Actions’ section with a ‘to be determined’ date for the issuance of an NPRM.

Information Sharing

Section 301 would specifically require TSA to provide personnel to support fusion centers “in jurisdictions with a high-risk surface transportation asset” {§302(a)} to improve the “timely sharing of classified information regarding terrorist and other threats”. It would also require DHS to provide assistance in obtaining security clearances for “appropriate owners and operators of surface transportation assets, and any other person that the Secretary determines appropriate to foster greater sharing of classified information relating to terrorist and other threats to surface transportation assets” {§302(c)}.

Security Technologies

Section 304 would require DHS to provide a report to Congress on the threats posed to surface transportation assets “posed by the use of security technologies, including soft4

ware and networked technologies, developed or manufactured by firms that are owned or closely linked to the governments of countries that are known to pose a cyber or homeland security threat”.

Moving Forward

Watson-Coleman is a member of the House Homeland Security Committee (as are a number of her co-sponsors), one of the two committees to which this bill was assigned for consideration. Other co-sponsors {including Rep. Lipinski, (D,IL)} are members of the House Transportation and Infrastructure Committee, the other committee to which the bill was assigned. This means that it is possible that this bill could be considered in either or both committees. There are no Republican co-sponsors, however, which would suggest that there is insufficient bipartisan support to move the bill forward in Committee.

The security training and security plan provisions of this bill are sure to draw objections from owners of the potentially affected transportation companies and their lobbying organizations. This makes it unlikely that the bill would be supported by a sufficient number of Republicans to move the bill forward in the House.

DHS Publishes Regulatory Agenda

Today DHS published their section of the Administration’s Semiannual Regulatory Agenda in the Federal Register (82 FR 40290-40299). This provides some additional information on some of the regulatory activities planned by the Administration that were listed in the Unified Agenda last month.

Items that may be of specific interest to readers of this blog include:

• Chemical Facility Anti-Terrorism Standards (CFATS);

• Ammonium Nitrate Security Program;

• Updates to Maritime Security; and

• Security Training for Surface Transportation Employees

There really is not much in the way of new information here. DHS has provided ‘expected dates’ for the next rulemaking action for the CFATS update (10-17) and the TSA security training rule (09-18). Since these ‘expected dates’ have little or no relationship to actual future actions these dates cannot really be classified as ‘new information’.

The only really new information here is that the Coast Guard’s Updates to Maritime Security has been officially removed from the regulatory agenda. This rulemaking activity has never really gone anywhere, bouncing back-and-forth between the Current Agenda and the Long-Term Agenda on the Unified Agenda. Even the abstract that was listed in the last Obama Administration Unified Agenda was short on specifics of what the rulemaking would have included.

TSA Security Training NPRM – Training Program Requirements

This is part of a continuing series of blog posts about the recent TSA NPRM on security training for surface transportation organizations. Earlier posts in the series included:

TSA Publishes Security Training NPRM

TSA Security Training NPRM - §1570 Rewrite

In this blog post I will look at the requirements laid out in the NPRM for the training programs mandated by Congress.

General Requirements

The training program general requirements are included in three separate modal sections of the proposed rule; §1580.113 (FR), §1582.113 (PT), and §1584.113 (OTRB). The requirements under each of these sections is essentially the same and include information on:

Owner/operator;

How training will be provided;

Ensuring supervision of untrained employees;

Providing notice of changes effecting training;

Methods for determining effectiveness of training; and

Relation to other training.

TSA is being very careful to be as non-prescriptive as possible in each of these requirements. For the most part they are simply outlining what information that will be submitted to TSA as part of the training plan approval process. For example, in the preamble discussion about methods for determining effectiveness of training, TSA explains:

“TSA would afford flexibility to each individual owner/operator to measure effectiveness of their security training program using methods and criteria appropriate for their operations. TSA does not prescribe the method in the proposed rule, but does propose that every training program specify the manner and method by which the effectiveness of the training program would be evaluated by the owner/operator.”

Even where there is specific requirements for actions on the part of owner operators, for example when changes in security plans or operations are made, the rule calls for the owner/operator to provide information about how those changes to previously received training would be communicated to employees. It does not prescribe how those changes would be communicated.

Security Training and Knowledge

Again, the specific training requirements are spelled out in the three separate modal sections; §1580.113 (FR), §1582.113 (PT), and §1584.115 (OTRB). Most of the wording in the three separate sections is the same except where the freight railroad requirements include specific information supporting current security requirements of the existing §1580 and §174.9.

In addressing the knowledge requirements to be covered in the security training, TSA breaks those elements into four broad categories: prepare, observe, assess, and respond. Interestingly, the preamble discussions of these requirements frequently refer to ‘security plans or measures’. This rulemaking does not mandate the preparation of security plans; that is being addressed in a separate rulemaking.

Other Training Programs

Congress mandated for the freight railroad and OTRB training programs that TSA should “take into consideration any current security training requirements or best practices” {6 USC §1167(a) and §1184(a)} in establishing this training regulation. The preamble to the NPRM addresses this issue while noting that they expect that “additional training would be needed for some of the knowledge required by the ‘prepare’ category of training in proposed §§ 1580.115(c), 1582.115(c), and 1584.115(c)”. The other training programs discussed include those addressed in:

• FRA safety training requirements;

• FTA safety requirements;

• OTRB safety requirements; and

• Hazardous materials regulations.

Additionally, the TSA recognizes that there are existing security training programs that are voluntarily in use by many organizations that could be used to fulfill portions of the training requirements outlined in this NPRM. They include:

• First Observer™; and

• SmartToolBox;

TSA Security Training NPRM - §1570 Rewrite

This is the second in a continuing series of blog posts about the recent TSA NPRM on security training for surface transportation organizations. Earlier posts in the series included:

TSA Publishes Security Training NPRM

The current 49 CFR 1570 addresses the General Rules of Subchapter D, Maritime and Land Transportation. The primary focus has been on the Transportation Workers Identification Credential (TWIC) enforcement process by TSA. This NPRM proposes a complete re-write of the section to more broadly provide the general rules for enforcement of all surface transportation requirements, current and those proposed in this rule. The only sections that have not been rewritten is §1570.1, outlining the scope of the section’s requirements, §1570.5, prohibiting fraud in record keeping under the subchapter.

Definitions

As I mentioned in the earlier post, TSA is making a number of changes to §1570.3, Definitions. A large number of the changes are simply moving definitions from other sections of 49 CFR Chapter XII or referencing other definitions in other portions of the Code Federal Regulations. TSA is, however, adding five new definitions to help provide clarity to other specific definitions used in the modal portions of this rule. Those new definitions are:

• Contractor;

• Employee;

• Immediate supervisor;

• Security sensitive employee; and

• Security sensitive job function

The last two are not really defined in §1570.3; they simply refer to the actual definitions in the modal sections of the proposed rule.

Provisions Moved

The rewrite of §1570 includes moving three of the current provisions of the section to new subparts of the section. The two TWIC specific sections (§1570.7, Fraudulent use or manufacture; responsibilities of persons; and §1570.9, Inspection of credential) have been moved to the new Subpart D, Security Threat Assessments (to Sections 1570.301 and 1570.303 respectively). Also moved to this subpart is §1570.13, False statements [by employers] regarding security background checks. This was moved to §1570.305.

Security Responsibilities

While most of the rule applies to owner/operators, §1570.7 specifically clarifies that all individuals are required to comply with the security requirements established under this rule. Every attempt was made to make the wording as inclusive as possible in describing the ways that security measures could be contravened. For example, the proposed §1570.7(a)(1) states that no person may: “Tamper or interfere with, compromise, modify, attempt to circumvent, or cause another person to tamper or interfere with, compromise, modify, or attempt to circumvent any security measure implemented under this subchapter.”

The problem with such attempts at making all-inclusive language is that someone slightly more creative can come up with something not covered. For instance the paragraph does not prevent someone from knowingly allowing someone ‘to tamper or interfere with…’

After developing the detailed inclusive language described above, someone realized that the regulation would effectively prohibit TSA, DHS and corporate inspectors from trying to test security measures. Thus, paragraph (b) was added to exempt inspectors from the prohibitions listed in paragraph (a).

Security Programs

Subpart B of §1570 is completely new in the proposed rule. It establishes the general security program requirements for surface transportation. The requirements in this section are fairly generic with the details being provided in the new modal sections being proposed in the NPRM. The three most important parts of this subpart are found in §1570.105, §1570.109 and §1570.111.

Section 1570.105 establishes the methodology for determining if an organization is covered by the new rules in the NPRM. First TSA has established the criteria for determining if an organization would be covered. The detailed requirements are found in the modal sections {§1580.101 – FR; §1582.101 – PT, and §1584.101 – OTRB). Then organizations are required to review those requirements and notify the TSA if they are a covered organization. Organizations would have 90 days to make that notification.

This self-identification of coverage is almost certainly going to result in the lack of 100% coverage of the organizations that should report their coverage. The major players will all self-report within the specified time (30 days after the final rule effective date), but there will be some number of smaller players (probably highest in the OTRB category) that, through either negligence or malfeasance, that will fail to self-identify.

To overcome this problem, TSA is going to have to have an effective outreach program to ensure that all of the potentially affected organizations know about the reporting requirements. As we know from the CFATS program and the West Fertilizer incident, the agency will be criticized when an incident happens involving an organization that did not appropriately self-identify and complete the subsequent regulatory requirements.

Section 1570.109 provides the regulatory time-table for completing the remaining regulatory requirements of this surface-transportation training program:

• 90-days from the effective date of the regulation to submit initial training plan for approval for affected organizations in existence when the final rule becomes effective;

• 90-days from the start of operations or modification of operations to submit initial or revised training plan after the effective date of the regulations; and

• 30-days to submit a petition for reconsideration after receiving from the TSA a notice to modify the training plan.

Similarly, §1570.111 provides the time-table for the implementation of the training program. Time limits have been set for initial training under a new/revised training program (1-year), training of new employees under an existing training program (60-days), and recurrent training (every year ± one month).

Operations

Subpart C addresses two requirements, both of which were previously seen in the existing §1580 requirements for freight railroad carriers and passenger railroad carriers. The proposed rule would make those requirements apply to public transportation systems and Those requirements are

§1570.201 – Security Coordinator; and

§1570.203 – Reporting significant security concerns

TSA Publishes Security Training NPRM

Yesterday the DHS Transportation Security Administration (TSA) published in the Federal Register (81 FR 91336-91401) their long-awaited rule on security training for surface transportation employees. Not only does this rule provide proposed requirements for training employees of railroads (both passenger and freight) and over-the-road bus (OTRB) companies, but it also makes supporting revisions to several other surface transportation security regulations.

According to the summary in the preamble to this NPRM the proposed rule would:

• Require security training for employees of higher-risk freight railroad carriers, public transportation agencies (including rail mass transit and bus systems), passenger railroad carriers, and over-the-road bus (OTRB) companies;

• Owner/operators of these higher-risk railroads, systems, and companies would be required to train employees performing security-sensitive functions, using a curriculum addressing preparedness and how to observe, assess, and respond to terrorist-related threats and/or incidents;

• Expand current requirements for rail security coordinators and reporting of significant security concerns (currently limited to freight railroads, passenger railroads, and the rail operations of public transportation systems) to include the bus components of higher-risk public transportation systems and higher-risk OTRB companies;

• Make the maritime and land transportation provisions of TSA's regulations consistent with other TSA regulations by codifying general responsibility to comply with security requirements; compliance, inspection, and enforcement; and procedures to request alternate measures for compliance; and

• Add a definition for Transportation Security-Sensitive Materials (TSSM). Other provisions are being amended or added, as necessary, to implement these additional requirements.

Definitions

In this rulemaking TSA is proposing to add a large number of definitions to 49 CFR 1500. Many of these definitions are being adopted from other places in the CFR. New and revised definitions being added include:

• Authorized representative;

• Host railroad;

• Motor vehicle;

• Owner/operator;

• Rail hazardous materials shipper;

• Transportation security equipment and systems;

• Transportation or transport;

• Transportation facility;

Training Requirements

The general security training requirements are outlined in the new Subpart B of 49 CFR 1570. Modal specific requirements will be found at §1580.115 (freight rail - FR), §1582.115 (public transportation and passenger rail - PT), and §1584.115 (OTRB). The modal specific requirements are all essentially the same with some minor wording variations reflecting some basic differences in type transportation provided.

Owner/operators would be given 90-days from the adoption of the final rule to complete their development of a security training program and to submit that program to TSA for review and approval. TSA would be given 60-days to approve the program or require changes to be made. Existing employees would then have to be trained in accordance with the submitted training program within one year. New employees could work in security-sensitive positions could work up to 60-days under ‘direct supervision’ (not specifically defined) before receiving the required training.

There would be four required components to be covered in the training:

• Prepare;

• Observe;

• Assess; and

• Respond

Public Comments

The TSA is soliciting public comments on this NPRM. Written comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # TSA-2015-0001). Comments should be submitted by March 16, 2017.

In addition to comments about the actual proposed rulemaking (much of which is mandated by law), the TSA is also seeking specific feedback on five questions concerning implementation of the rule:

• The preferred avenue to submit security training programs to TSA, such as through email, secure Web site, or mailing address;

• TSA is proposing to use accumulated days of employment as one of the factors triggering whether an employee must be trained and requests comment specifically on how to calculate accumulated days and to ensure contractors are not used to avoid the requirements of this proposed rule;

• The use of previous training to satisfy requirements in the proposed rule;

• Options for harmonizing the proposed training schedule with existing training schedules and for adding efficiencies with other relevant regulatory requirements, including identification of any laws, regulations, or orders not identified by TSA that commenters believe would conflict with the provisions of the proposed rule; and

• Options for ensuring training is effective in the absence of proficiency standards.

Commentary

TSA is going to be between a rock and a legal hard place when it comes to the bulk of the legitimate (more on ‘legitimate’ below) comments that it receives. Industry is going to complain large and loud about how comprehensive (and over-reaching) the training requirements are in this NPRM and how short the time frame is for them to submit training programs to TSA for approval. Unfortunately for TSA both of these issues are spelled out in detail the Congressional mandate for this training requirement (6 USC 1137 – PT; 6 USC 1167 – FR; and 6 USC 1184 -OTRB).

Two of the Congressional training requirements are going to be particularly difficult to implement:

• Appropriate responses to defend oneself, including using nonlethal defense devices; and

• Training related to behavioral and psychological understanding of, and responses to, terrorist incidents, including the ability to cope with hijacker behavior, and passenger responses.

If the first presupposes that employees have an obligation to defend themselves (as opposed to providing legal cover for their doing so) then there are going to be some legal objections from employers and compensation issues (medical and legal counsel) raised by employees and their representatives.

The second could be a master’s level course in applied psychology and hardly appropriate for first line employees; the vast majority of whom will never see a terrorist attack.

Neither of these requirements is adequately addressed in the proposed language. For example the self-defense language is limited to: “Use any applicable self-defense devices or other protective equipment provided to employees by the owner/operator.” {proposed §1582.115(f)(3)} The second is simply not addressed in the requirement to interact “with the public and first responders at the scene of the threat or incident, including communication with passengers on evacuation and any specific procedures for individuals with disabilities and the elderly” {proposed §1582.115(f)(2)}. There is nothing about understanding and responding to the terrorists involved in the incident.

Legitimate responses – The earlier ANPRM also requested public feedback and it did receive lots of feedback; much of it vitriolic. Reading most of the comments from individuals you can clearly see that many people object to anything that the TSA tries to do based solely on their interactions with TSA screeners at the airports. The ANPRM was issued during the height of the complaints about new TSA pat-downs and the improved screening devices and many of the comments reflected that.

There is nothing in this NPRM (nor was there in the ANPRM) about the use of TSA screeners for surface security applications. While there may have been an increase in concerns about protecting public transportation against the increased number of personal (as opposed to wholesale) terrorist attacks on European public transit, nobody is proposing (for economic reasons if nothing else) to extend airport type passenger screening to public transportation or OTRB operations. Hopefully, commenters on this rule will realize that and limit their comments appropriately.

One last point. In a response to my earlier post about this NPRM being approved by OMB I was told by a colleague in the training community that they had been told by a transportation company that this rulemaking would not go forward under the Trump Administration. I think that it is way too early to tell what the new administration will or will not do with regards to regulatory reform, but I am certain that there will be new regulations promulgated by the Federal government over the next four (eight?) years.

Whether or not this specific rule will move forward remains to be seen. There has been a strong push by congressional committees (all Republican controlled) for TSA to complete this rulemaking. Anyone that declines to raise legitimate issues in the rulemaking process based upon their belief in future inaction upon the part of the TSA is making a potentially big mistake. The only thing that is certain to kill this rulemaking is a general showing that the cost of implementation is too high relative to the potential benefits. That would require that industry provide detailed feedback on the cost of implementation. And, potential providers of the required training owe it to their future business in this area to provide some realistic cost estimates about the development of training packages.

One more last point (really last this time). There is no mention of any cybersecurity aspect in these training requirements. Given the increased and mandated use of positive train control technology, the security of the control systems involved should have been addressed in this rulemaking. But, of course, Congress did not consider it when they established the mandate back in 2007 (nobody did then) so the TSA ignored the issue.

OMB Approves TSA Surface Transportation Security Training NPRM

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a notice of proposed rulemaking (NPRM) from the DHS Transportation Security Administration (TSA) regarding transportation security training requirements for surface transportation organizations. The rulemaking was submitted to the OMB back in July.

This rulemaking was required by Congress in 2007 in the Implementing Recommendations of the 9/11 Commission Act of 2007 (PL 110-53). Security training requirements for surface transportation organizations were specifically required by:

Section 1408 (6 USC 1137), Public transportation security training program;

Section 1517 (6 USC 1167), Railroad security training program;

Section 1534 (6 USC 1184), Over-the-road bus security training program;

Congress required that each of these training program rules to be established within six months of the adoption of the bill (August 3, 2007). Each of these training program requirements include the same program elements including the requirement to submit those training programs to DHS for approval.

There have recently been some significant delays in many rulemakings between the time of OIRA approval and publication in the Federal Register. This probably entails an internal requirement for additional justification of publishing rulemakings this late in the Obama administration. Since this has no chance of moving to a final rule until well after the Trump administration inauguration this rulemaking may escape that midnight rule review delay.

OMB Receives TSA Surface Transportation Security Training Rule

On Tuesday the OMB’s Office of Information and Regulatory Affairs (OIRA) received a notice of proposed rulemaking (NPRM) from the TSA covering surface transportation training requirements for security training. This rule was mandated by the Implementing Recommendations of the 9/11 Commission Act of 2007 (§1408 of PL 110-53) and was supposed to have been published in 2008.

According to the latest Unified Agenda abstract:

“This rule would require security awareness training for front-line employees for potential terrorism-related security threats and conditions pursuant to the 9/11 Act. This rule would apply to higher-risk public transportation, freight rail, and over-the-road bus owner/operators and take into consideration the many actions higher-risk owner/operators have already taken since 9/11 to enhance the baseline of security through training of their employees. The rulemaking will also propose extending security coordinator and reporting security incident requirements applicable to rail operators under current 49 CFR part 1580 to the non-rail transportation components of covered public transportation agencies and over-the-road buses.”

It will be interesting to see how long it takes OIRA to approve this NPRM. They have a number of rulemakings to review in order to avoid the midnight rule restrictions imposed by President Obama. This rulemaking hardly fits in the category of a last minute partisan rule.

Transportation Security Subcommittee Amends and Adopts 3 Bills

Today the Transportation Subcommittee of the House Homeland Security Committee met to markup three bills. Two of the bills (HR 3102 and HR 3144) dealt exclusively with airport security issues, but the third bill (not yet introduced) did deal with surface transportation security issues that I addressed in an earlier blog.

Surface Transportation Security Amendments

The Subcommittee did amend the Transportation Security Administration Reform and Improvement Act of 2015. One of the amendments dealt with redress issues in the portion of the bill dealing with airport personnel security checks. The only other amendment replaced §203, the section that I took objection to in my earlier post.

The new §203 continues to deal with security training issues related to front line employees in public transportation and over-the-road bus-lines. Instead of eliminating the current requirement for TSA to establish requirements for such training programs the new section requires a report by the TSA Administrator on the status of the implementation of 6 USC 1137 and 6 USC 1184, the statutory sections requiring such training. The report is to address the specific challenges TSA has had in establishing regulations requiring the provision “of basic security training to public transportation frontline employees and over-the-road bus frontline employees for preparedness for potential security threats and conditions”

Commentary

The original bill and the amended version both completely ignore the fact that a similar security training program requirement for freight railroads (6 USC 1167) has also been effectively ignored by the TSA.

Completely missing from the bill now is any reference to the two sections mentioned in the earlier version requiring vetting of those personnel against the TSDB. While I am glad to see that the Subcommittee decided not to eliminate those provisions, I was disappointed in seeing that there was no requirement for TSA to explain why 6 USC 1140 and §1520 of the 9/11 Commission Act of 2007 had not been complied with any better than had the training requirements.

While the security awareness training of public transportation employees is important, I think that it is much more important to ensure that those employees are not known to have associations with terrorist organizations. As the recent attack by a trusted vendor delivery driver at the Air Products facility in France last month showed us, failure to check personnel against such lists puts people at risk.

Semiannual Regulatory Agenda Published

Yesterday the various departments of the Executive Branch published their Semiannual Regulatory Agenda’s in the Federal Register. This agenda includes their Regulatory Plan (a listing “of the most important significant regulatory actions that the agency reasonably expects to issue in proposed or final form in that fiscal year”) and the regulatory flexibility agenda (a listing of the rules that are “likely to have a significant economic impact on a substantial number of small entities”). The DHS portion of the Semiannual Regulatory Agenda can be found at 77 FR 7960-7965.

Unified Agenda Listings

As I noted in an earlier blog post the Unified Agenda  (a listing of all “current and projected rulemakings, as well as actions completed since the publication of the last regulatory agenda”) was published sometime earlier this year at www.reginfo.com. Before I discuss the Agenda published yesterday it may be helpful to look at the Unified Agenda items of principal concern to the chemical security community. The two tables below (Proposed Rule Stage and Final Rule Stage) list all of the current rule making efforts and the date of their next expected action.

Proposed Rule Stage

Agency	Next Action	Title	RIN #
DHS/OS	Final Rule – No date	Secure Handling of Ammonium Nitrate Program	1601-AA52
DHS/OS	NPRM – 06-12	Petitions for Rulemaking, Amendment, or Repeal	1601-AA56
DHS/USCG	NPRM – 07-12	Transportation Worker Identification Credential (TWIC); Card Reader Requirements	1625-AB21
DHS/USCG	NPRM – 09-12	Updates to Maritime Security	1625-AB38
DHS/USCG	NPRM – 06-12	Top Screen Information Collection from MTSA-Regulated Facilities Handling Chemicals	1625-AB64
DHS/USCG	Final Rule – No date	Reconsideration of Letters of Recommendation for Waterfront Facilities Handling LNG and LHG	1625-AB67
DHS/TSA	NPRM – 06-12	Sensitive Security Information: Disclosure in Federal Civil Court Proceedings	1652-AA54
DHS/TSA	NPRM – 05-12	Freight Railroads, Public Transportation and Passenger Railroads, and Over-the-Road Buses--Security Training of Employees	1652-AA55
DHS/TSA	NPRM – 09-12	Freight Railroads and Passenger Railroads--Vulnerability Assessment and Security Plan	1652-AA56
DHS/TSA	NPRM – 08-12	Standardized Vetting, Adjudication, and Redress Services	1652-AA61

Final Rule Stage

Agency	Next Action	Title	RIN #
DHS/USCG	Final Rule – 04-12	Revision to Transportation Worker Identification Credential (TWIC) Requirements for Mariners	1625-AB80
DHS/TSA	Notice – 06-12	Air Cargo Screening	1652-AA64

The only significant changes from the previous Unified Agenda are that DHS has issued the NPRMs for the Ammonium Nitrate Security Program and the LNG Letter of Recommendation Program. Oh, and of course the dates of the next expected action have slipped again as DHS continues to miss its regulatory mandates. One should be surprised if any of the dates listed above are actually met; really surprised.

Regulatory Plan

Only two of the rulemaking efforts listed in the tables above made it to the DHS Regulatory Plan; the Ammonium Nitrate Security Program (ANSP) and the Update to Maritime Security (MTSA II). One might expect from the listing in yesterday’s Federal Register that these would be the two rulemaking efforts most likely to be completed in the next six months or so before the next Regulatory Plan is issued, but I doubt it.

The MTSA revision is most likely to be published since it is fairly well along the regulatory process, but this has not yet been submitted to the OMB for approval. With the international implications of expected provisions of this rule the OMB approval process could be quite lengthy.

Since the public comment period on the Ammonium Nitrate Security Program NPRM was just closed in December I expect that it will be some time yet before we see a final rule published. This is especially true since this rule will have a significant impact on the agricultural community and they have the most powerful lobbying team in Washington.

I really expect that we might see some other rules from the above lists make it into the Federal Register before the AMNSP (certainly) or the MTSA II (likely) rules are published. I would think that since the Coast Guard has informally implemented some of their revisions to the TWIC requirements that the Final Rule for the TWIC Requirements for Mariners would have a high chance of getting published.

I also expect that the TSA will finally get around to publishing their very long overdue rules on security training. The only impediment to this is the fact that they have combined what used to be three separate rule making efforts (freight rail, passenger rail, and bus operators) into one rule. Even so, this should not be difficult to get published.