Public Comments TWIC Reader ANPRM – 05-29-09 I

The comment period for the TWIC Reader ANPRM closed last week. As is usual there were a large number of last minute filings of comments by large corporations and industry groups. Actually, there was an even larger than normal number of comments filed. It is going to take a number of posts to review all of the comments that have been posted as of Saturday night and we can expect some to continue to trickle in for a couple of weeks. To save some time and space I’ll try to limit the discussion to new issues. In addition to the comments received, the Coast Guard posted a copy of the transcripts from the public meeting held in Arlington Virginia. The comments covered in today’s post came from: Georgia Ports Authority Golding Barge Line Delaware Bay and River Cooperative The American Waterways Operators Magnolia Marine Transport Sayville Ferry Service Black Ball Ferry Line The Fertilizer Institute Illinois Fertilizer and Chemical Association Southern States Cooperative James Transportation LLC Great Lakes Towing Company Georgia Ports Authority Comments Kevin Doyle of the Georgia Ports Authority makes a number of interesting points. He notes that train crew members are not mentioned in the ANPRM and recommends that as long as they stay along side their trains they should not be required to have their cards read. He questions the use of risk-based requirements for biometric validation; he believes it is not equitable. He makes the point that the sinking of a Risk Group C ship in a narrow shipping channel will block the channel as effectively as sinking a Risk Group A Ship. Golding Barge Line Comments Stirlin Hancock, the HR Manager for Golding Barge Line notes that vessels with small crews (less than 14) should not be required to have a TWIC Reader on board regardless of the Risk Group; personal identification in small crews is much more effective. He notes that his company conducts crew changes every 14 days at whatever ports their barges are at; there would not necessarily be a TWIC Reader available to verify TWIC. Delaware Bay and River Cooperative Comments Delaware Bay and River Cooperative is another operator of Oil Spill Response Vessel (OSRV) that objects to such vessels being assigned to Risk Group B. The American Waterways Operators Magnolia Marine Transport James Transportation LLC Great Lakes Towing Company Jennifer A Carpenter, Senior VP for the AWO, writes that they believe that the use of a TWIC Reader should not be required on vessels. They note that there is no legislative requirement to have Readers onboard. They also do not believe that adding an additional layer of security requirements on vessels by a new risk ranking is justified. They do not believe that any incremental increase in security based on this proposed rule can be justified. Sayville Ferry Service Comments John M Caldwell, the Company Security Officer for the SFS, notes that small, seasonal companies such as theirs would have difficulty justifying the cost of a TWIC Reader. Black Ball Ferry Line Comments Terry Troyer, the Company Security Officer for the BBFL, notes that the similarities between the Risk Group A and B requirements at MARSEC 2 and 3 belie the claim that these requirements are Risk Based. He also notes that the term ‘entry’ is not defined and vaguely used. He would like to see the number of personnel granted recurring unescorted access increased for Risk Group B and C vessels. The Fertilizer Institute Comments TFI recommends that the NPRM for this rule be released only after the TWIC Reader Pilot is completed and thoroughly reviewed. They also recommend that that review be included as an integral part of the NPRM. TFI does not believe that the current Risk Group definition adequately addresses the low relative risk at rural inland waterway ports that handle ammonium nitrate or anhydrous ammonia. They believe that the final rule should include a formal procedure for appealing the Risk Group ranking of a facility. They also note that the Risk Group ranking for facilities should be able to change based upon the presence or absence of Certain Dangerous Cargo (CDC). TFI notes that the cost of purchase and maintenance of the TWIC Readers is not addressed in this ANPRM. Illinois Fertilizer and Chemical Association Comments Kevin Runkle, Manager of Regulatory Services for the IFCA, writes that the many port, river and lake, facilities in Illinois that handle ammonium nitrate and anhydrous ammonia should be classified as Risk Group C. They contend that classifying them as Risk Group A or B “would unduly burden shipments of crop nutrient products to the nations food supply during an already short window of application” Southern States Cooperative Comments Jim Wright, Director of Environmental and Compliance Services for SSC, notes that the Coast Guard should develop separate regulations for facilities and vessels. He also writes that Risk Group definitions are do not adequately address the complexity of differences between the wide variety of facilities or vessels; site specific risk factors need to be considered. He also suggests that the ‘regulated community’ be given a chance to review and comment on the peer review being conducted by the Homeland Security Institute of the risk assessment methodology described in the ANPRM. My Comments on Comments Commentors continue to disagree with the methodology of determining to which Risk Group a facility or vessel should belong. The simplistic approach suggested in the ANPRM is easy to write and enforce; it is harder to justify as a risk-based strategy. The inland water way fertilizer facility situation is a bit more complex than noted by the two industry organizations. Bulk ammonium nitrate fertilizer is one of the easiest compounds to use to make very large vehicle-borne improvised explosive devices. This makes these high-turnover facilities particularly good targets for theft/diversion of this material. Of course, DHS is in the process of developing separate rules for the sale and distribution of AN so maybe the industry comments are appropriate. Comments about railroad crews were appropriate. There was no mention of these TWIC holders in the ANPRM. They should certainly be addressed. It would seem to me that the railroads serving Risk Group A and B port areas should be required to have TWIC Readers to verify the crew identity and TWIC cards. Train crews would certainly fall below the 14 person limit for RUA rules but they might not be known to security personnel at each high-risk facility. This would need to be addressed in the NPRM. Finally, looking at the suggested ‘separate regulation’ idea, the Coast Guard would probably be expected to have separate paragraphs describing the specific requirements for vessels, facilities and trains. That should be adequate to clear up the confusion that arose from the organization of the ANPRM.

Public Comments TWIC Reader ANPRM – 05-22-09

It has been a busy week and I am just now getting around to looking at last week’s comments posted on the TWIC Reader ANPRM. I considered combining them with this week’s results, but I looked today at how many new comments had been filed and there were 10 pages of new comments. Oh well, this always happens at the end of the comment period. So this posting will look at the five comments submitted last week. Those comments were received from: Marine Spill Response Corporation Joy May Cowan Association of American Port Authorities Gunther Hoock John C Farmer Marine Spill Response Corporation MSRC maintains a fleet of Oil Spill Response Vessels (OSRV) and Oil Spill Response Barges (OSRB). They are concerned that their vessel falls between the definitions for Risk Groups and have received at least one Coast Guard opinion that their fleet would fall into Risk Group B. They object to that characterization and would prefer to see the status of these vessels clearly delineated in Group C. MRSC believes that the 14 crewmember limit for recurring unescorted access is too low and suggest that the number could reasonably be as high as 25. They also object to the RUA requirement for validating TWIC on a weekly/monthly basis using a hot sheet that is less than 24 hours old. They believe that annual and random checks by TSA are adequate checks. Joy May Cowan Comments Ms Cowan is the owner/operator of a paddlewheel boat that is rated to carry 800 passengers. With six employees she believes that it makes no sense for them to have to carry a TWIC reader on-board. She notes that the Coast Guard ‘regularly’ checks their cards. Association of American Port Authorities Comments AAPA believes that the 3 Risk Groups defined in the ANPRM are an inadequate way to evaluate the risk status of port facilities. They suggest that a risk based evaluation be made on an individual basis for each port facility. AAPA appreciates the removal of the requirement for facilities to always know who is on site. They believe that Hot Lists should be available in real time and distinguish between personnel on the list for security reasons and personnel that simply need to replace their cards. AAPA would like to see the Coast Guard to publish the TWIC Reader specs as soon as the pilot programs are completed rather than waiting until the final rule is published. This will allow facilities and vessels to start evaluating and buying Readers more quickly. Gunther Hoock Comments Gunther Hook, of the Horizon Lines, recommends that the limit for recurring unescorted access should be increased from 14 to 30, noting that it would “bring relief to a larger section of covered vessels and facilities as opposed to a limit of 14 while still preserving a controllable environment”. John C Farmer Comments Capt. Farmer notes that unless there is going to be a TWIC Reader at every entrance to every restricted area there is really no point in having TWIC Readers on a vessel. He makes the point that personal recognition is the most secure form of identification. He believes that a TWIC Reader should only be required where there is an expectation of personnel requiring access that would not be recognized by facility personnel or where a very large number of people would be entering and there would be no expectation that a guard would be able to recognize everyone. Capt Farmer makes a final point that he believes that pilot testing of TWIC Readers is premature; a proper test protocol can only be designed once a clear definition of the use has been made. This ANPRM makes clear that that has not yet happened. My Comments on Comments I’m sure that MSRC is not the only owner/operator of a vessel or facility that does not fit into some neatly defined category. Provisions need to be made in the final rule for some consistent method of evaluating non-standard situations and fitting them into one of the Risk Groups. I’m not sure that I would go as far as requiring every port facility to under go a unique risk evaluation, but DHS has established that such a process is possible in the establishment of their Tier levels for high-risk chemical facilities. DHS did have the advantange that much of the analysis process work had already been done under RAMCAP. Still, the Coast Guard might wish to look into the same type evaluation scheme. The continuing discussion of RUA is appropriate; the number of people allowed under the program could depend on a lot of factors. The length of time the crew works together is probably the most important. With crews that are thrown together for a short period of time the size that allows for rapid personal identification is much smaller. Crews that work together for years could be much larger and still allow for personal identification. One thing that I have not heard discussed is how to integrate a new crew member into an RUA crew, especially a larger crew.

Public Comments TWIC Reader ANPRM – 05-15-09

There were two comments posted this week on the Coast Guard’s TWIC Reader ANPRM. Additionally, the Coast Guard posted a copy of the slides that were used in the public meeting held on May 6th. The comments were received from: MC Morris Tovah LaDier MC Morris Comments Sometimes I begin to wonder who is doing the listing of comments at Regulations.gov. Typically they list organization comments submitted on organization letterhead by the organization name. Otherwise they use the name of the person signing the letter. This letter was signed by MC Morris “By Direction”. The letterhead was from “Commander, Military Sealift Command”. The “By Direction” makes this an official submission by that command. The MSC comment notes that it is not clear whether or not the rules apply to “public vessels and shore activities maintained by the Department of Defense”. They would like to see it explicitly stated that the TWIC Reader rule does not apply to DOD facilities and vessels. Tovah LaDier Comments Again I have an issue with the misleading listing of this comment on Regulations.gov. The document is a copy of the prepared testimony (apparently from the May 6th public meeting) of Megan Gajewski “on behalf of Tovah LaDier” the managing director of the International Biometric Industry Association. It should probably have been listed as IBIA comments. The IBIA notes that:

There are already TWIC Readers commercially available; Vessels and facilities should be allowed to use commercially available TWIC Readers while TSA is ‘evaluating’ TWIC Readers; and The IBIA disagrees with allowing Risk Group B vessels and facilities to only biometrically verify identity ‘randomly once per month’ under MARSEC 1 conditions

My Comments on Comments It should go without saying that the TWIC rules do not apply to military vessels. It is not clear that all of the vessels in being addressed in the MSC letter strictly fall under that description. As long as the MSC vessels are operating out of Navy ports, there not having TWICs will not be a problem. However, I believe that these vessels frequently operate out of civilian ports. For non-military crews to not have TWIC or an operationally equivalent ID could cause some problems in that situation. This certainly needs to be addressed in the NPRM. The IBIA comments about the current availability of TWIC readers are a tad bit self-serving. They note that there are at least 17 models that have successfully undergone TSA ‘laboratory testing’, so they could be voluntarily used by MTSA covered facilities while TSA completes their more extensive ‘functional and environmental’ testing. While I agree that such voluntary interim use could provide valuable information for TSA rule development efforts, I am not sure why the IBIA is making that comment here. TSA is unlikely to ‘officially’ approve voluntary interim use, but it certainly has not prohibited that use. Individual Captains of the Port may currently authorize that interim use as part of facility or vessel security plan approval process. The purpose of the environmental and operational testing being conducted by TSA is to ensure that TWIC readers will reliably work in the sometimes challenging environment associated with port facilities and ships. TSA does not want to require the use of equipment that cannot survive for a reasonable period of time in that environment. Justifiably, IBIA member companies would like to recoup their investments in TWIC Reader developments sooner rather than later. Selling them before they are approved or required could be a challenge for the best sales person, but TSA is not going to ‘authorize’ interim use to aid sales. One minor comment on the Coast Guard meeting slides. Whoever put this .PDF document together oriented the slides so that they show up in the .PDF Reader software rotated 90 degrees out of standard. This means that you have to play with the size controls and turn your head sideways to be able to read the slides. This is the first time that I have seen PowerPoint® slides displayed this way in a .PDF file. It is certainly not user friendly. Not only was this poor attention to detail on the part of the preparer, but who ever approved this document for release needs to be hung from the modern equivalent of the yard arm.

Public Comments TWIC Reader ANPRM – 05-08-09

There were two comments posted this week on the Coast Guard’s TWIC Reader ANPRM. The comments were received from Acheson Ventures Kerneos Inc Acheson Ventures Comments Acheson Ventures is the owner/operator of the Point Huron Terminal Company. They would like to see the ‘routine unescorted access provision’ changed to allow the facility security plan set the maximum number of personnel allowed RUA. This would still require COTP approval as part of the FSP approval process. They would also like to see a separate number for security personnel and non-security personnel. They expressed their desire to see a Great Lakes port included in the pilot program evaluation of the TWIC Reader. They would like to see a one year time limit for amending the FSP to take into account TWIC Reader requirements. Acheson Ventures recommends that when a facility occasionally handles a cargo/ship outside of their risk group description that they handle the additional security requirements with a simple notification to the COTP. Kerneos Inc Comments Kerneos is the operator of a bulk-solid commodity, low-consequence facility that is required to implement §105 security actions about two days per month. They would be classified as a Risk Group C facility. The Kerneos comments completely support the proposed regulations that pertain to facilities in that Risk Group. My Comments on Comments The Acheson Ventures comments on RUA procedures provide an interesting look at potential ways to modify the Coast Guard provisions. The idea of allowing the facility to set the number of personnel authorized RUA in there FSP is keeping with the general risk-based philosophy that Congress has directed DHS to use in all of their security processes. The facility would still have to justify the number to the COPT, so this should stop this RUA provision from just being a way to completely avoid the use of the TWIC Reader. The suggestion about a separate RUA limit for security personnel and non-security personnel is also an interesting suggestion. The point of the RUA procedures is to acknowledge that small working groups are essentially impossible to infiltrate on a short term basis. Large facilities have a number of such working groups and many times they work in areas of the facility with tighter restrictions on access. The Coast Guard should consider extending the RUA concept to working groups within specially designated security areas. The group members would be required to have to authenticate their identity and TWIC upon entry into the facility, but use the TWIC as a visual identification for their designated security area. Acheson also addressed the issue of facilities that only rarely handle cargos or vessels that would raise their Risk Group ranking. For facilities that plan to do this on a recurring basis, this fact should be established in their FSP, with appropriate security measures spelled out for those periodic increases in risk rating. Then, when such a shift is expected, the facility would simply have to notify the COTP that they are putting the pre-approved security measures into effect. These regulations should also make provisions for facilities to handle higher-risk cargoes or vessels in unusual circumstances. Separate provisions would be required for situations with some short notice time before the situation and for emergency situations. The regulations would have to set a time limit for advance notice that would not require amending the FSP. For situations less than that time limit, the regulations would require a letter notification that includes a listing of the proposed security measures that would be put into place. For emergency situations, the notification letter or message would essentially be a request for security assistance from the COTP. As always it is good to see comments that affirmatively support the proposed rule. Too often people will not take the effort to let the government know when it is proposing to do things right. Not only is this a refreshing affirmation of the work being done by people in those agencies, but it also aids the agency in appropriately judging the negative comments. The Kerneos comments are especially helpful in the former situation because they lay out the specific things that affect their facility that they agree with. This may allow the Coast Guard to limit the changes that others may suggest to those provisions.

Public Comments TWIC Reader ANPRM – 05-01-09

One comment on the TWIC Reader ANPRM was reported the Regulations.gov web site over the last week; it came from Noble Drilling Services. In addition, the Coast Guard added some additional supporting documents that were used in the formulation of the ANPRM. These documents were Coast Guard advisory committee responses to specific questions asked by the rule developers. The responses were received from: Towing Safety Advisory Committee (TSAC) National Maritime Security Advisory Committee (NMSAC) Merchant Marine Personnel Advisory Committee (MERPAC) Noble Drilling Services Comments Noble supports the three risk group categories and specifically believes that the assignment of MODU’s regulated under 33 CFR 104 to risk group C is appropriate. They disagree however with the assignments of Outer Continental Shelf (OCS) facilities to risk group B; they don’t believe that level of risk assessment is warranted. They believe that it is the employer’s responsibility to decide where to reassign people who’s TWIC has been suspended or revoked. Records of such actions should be subject to inspection. Finally they don’t believe that off shore facilities should be required to have a TWIC reader on board; they suggest that the TWIC Readers should be used to verify identity and validate the TWIC card of employees at embarkation points enroute to the facility. My Comments on Comments As I have noted in earlier blogs, there appears to be a wide spread misunderstanding of the concept of recurring unescorted access (RUA). Here Noble makes the comment that: “Noble believes for offshore facilities this is an inappropriate number to safely supervise and ensure their actions as safe. A typical work party on the drill floor may be made up of this many persons but at a minimum there should be at least 2-3 supervisory TWIC holding personnel on hand.” The RUA proposal does not remove the requirement to possess a TWIC for personal placed in the RUA status; it just relives the requirement to have to use a TWIC Reader every time the RUA crew members enter the secure area of the facility or vessel.

Public Comments TWIC Reader ANPRM – 04-24-09

More comments on the TWIC Reader ANPRM are starting to trickle into the Regulations.gov web site over the last week. We have two separate comments from one individual and comments from one company. The comments are from Tracy L Royce, #1, #2 Clipper Navigation Tracy L Royce Comments In the first comment Tracy Royce agrees that Risk Group C should not require on-board TWIC Readers. Would like to see rule specify a ‘minimum percentage of persons onboard’ are randomly verified. Royce would also like to see a ‘specified time interval’ for supplying company security officer with updated list of ‘suspended and revoked’ TWIC. Rule should require a report back to Coast Guard if person with a newly suspended or revoked TWIC were found on board. The second comment objects to the classification of coastal drilling platforms on the Outer Continental Shelf (OCS) as Risk Group B. Tracy Royce does not believe that that classification is justified. Clipper Navigation Comments Clipper Navigation echoes the comments of Jack Harmon that were reported in a previous blog that there should be public meetings outside of the Washington, DC area. Again, Clipper Navigation specifically recommends that a public meeting be held in the Seattle, WA area because of the large maritime community. My Comments on Comments Tracy Royce brings up a couple of interesting issues that were not dealt with in the ANPRM. First, off-shore facilities/vessels with large crews are going to find it difficult to do 100% weekly verification of TWIC. The suggestion for requiring a percentage of TWIC checks where there is little change in crew composition should be considered. The second suggestion points out something that should have been considered in drafting the ANPRM; what to do if a check shows that a current crew member’s TWIC is no longer valid. The planned regulation should require removal from sensitive duties and unaccompanied access to critical areas. It should certainly require reporting to the Coast Guard.

Public Comments TWIC Reader ANPRM – 04-17-09

More comments on the TWIC Reader ANPRM are starting to trickle into the Regulations.gov web site. We have three new comments posted in the last two weeks. Additionally the Coast Guard has posted two new supporting documents to the site. The comments were received from: Judy Visscher Lake Carrier’s Association Jack Harmon The supporting documents are: USCG Analysis in Support of the Transportation Worker USCG Analysis in Support of the Transportation Worker Identification Credential (TWIC) Program Independent Verification and Validation of Development of Transportation Worker Identification Credentials Reader Requirements Judy Visscher Comments Ms Visscher, writing for the James De Young Generating Facility, applauds the Coast Guard establishing the Risk Groups, noting that, with the limited use of the restricted area at their facility, it would not make economic sense to buy and maintain a TWIC Reader. Lake Carrier’s Association Comments LCA represents companies operating 65 US-flag vessels on the Great Lakes. LCA supports not requiring low-risk vessels to have a TWIC Reader on board. They do, however, doubt that there will be enough TWIC readers located in the Great Lakes area to meet the requirements of the one-time biometric match requirement. They recommend that computer software be made available to accomplish that match. They recommend that the Recurring Unaccompanied Access (RUA) provisions be extended to cover a loading crew of up to 14 individuals at each Port of Call. LCA notes that their members use an Association developed Alternative Security Plan (ASP). They recommend that they be allowed to avoid making the required changes to that 200 page ASP until the next required review. They suggest that a one-page supplemental document covering the RUA provisions would be an adequate interim measure. Jack Harmon Comments Mr. Harmon’s comments are actually on the planned public meeting in the Washington, D.C. He would like to suggest that the Coast Guard conduct additional public meetings at other areas across the country, particularly in the Seattle, WA area. Mr. Harmon notes that many smaller operators cannot afford to travel to Washington, D.C. to attend such meetings. Supporting Documents The two documents posted to the docket website last week deal with the risk analysis that was done to establish the Risk Groups used to regulate when a TWIC Reader would be required to be used to verify the identity of a worker to granted unaccompanied access to a secure area of an MTSA covered vessel or facility. The Coast Guard document details the analytical method used to establish the Risk Groups. The second document details the peer review process conducted by the Homeland Security Institute to validate the Coast Guard method. Both documents are heavily redacted, removing a wide range of Sensitive Security Information (SSI) that was used in the analysis. My Comments on Comments It seems to me that LCA misread the intent of the Recurring Unaccompanied Access provisions of the TWIC Reader ANPRM. The way that I read the ANPRM, the Coast Guard intended the RUA procedure to be used (on vessels) to avoid repetitive ID checks of the vessel crew. The intent was not to allow shore based personnel at each new port of call to have RUA to the vessel. RUA is based on personal recognition of the personnel that one works with on a daily basis. Once an individual’s identity is adequately identified, personal recognition by co-workers, especially in the intimate setting of a vessel or small facility, is always going to be a more secure method of identification than any other kind of ID system. That intimate personal recognition would be absent for the work crews that had to board a ship for a relatively brief period of time involved in a loading/unloading situation.

Public Comments TWIC Reader ANPRM – 04-03-09

The first three comments on the TWIC Reader ANPRM came a lot quicker (within a week) than I would have expected. Two of these were private individual comments rather than company comments so they did not have to go through the normal corporate approval process. In fact, the comment from Mr. Ainsworth was more of a TWIC related comment not a TWIC Reader comment. The comments were received from: Edwin Madura John Ainsworth Bayou Tugs Edwin Madura Comments Mr. Madura notes that there should be provisions made for facilities that only periodically fall under the high-risk category. He provides the example of “a facility [that] ships one container of small arms ammo every three years… should not be classified as a Risk Group A for the intervening 35 months”. Bayou Tugs Comments Mr. Naquin of Bayou Tugs has two question:

“Does the term "each entry" refer to each entry into a designated Restricted Area or each entry into the vessel?” “What technology will be used to download Hotlist data?”

On the second question he notes that vessels frequently operate outside of wireless internet access zones. My Comments on Comments The problem of intermittent security status needs to be addressed in these regulations. I am afraid that some facilities are going to have to make a decision as to whether or not they feel that the cost of security requirements will be worth the intermittent business. Security plans will certainly have to address the transition between Risk Groups. The regulations will have to address the requirements for the transition; for example how long before and after the high-risk cargo leaves the facility will the security procedures need to be applied. As I understand things the ‘for each entry’ requirements are for each entry into an MTSA ‘secure area’. In some cases this will be an entire vessel, in other cases it will only be designated areas within the vessel. A large cruise line vessel would certainly not be a unitary ‘secure’ area. This definition will need to be made clear. Finally, the issue of ‘Hot List’ updates will need close attention. This will almost certainly be done via the internet, but provisions will have to be made for vessels out of contact with internet service. In most cases vessels will not need to have their ‘Hot List’ updated until just before they come into port, so this may not be a serious issue.