TWIC Reader Hearing Redux

Earlier this week the Subcommittee on Border and Maritime Security of the House Homeland Security Committee held a hearing to look at “Threat, Risk and Vulnerability: The Future of the TWIC Program”. Since this was more than a month since we sat through a similar hearing held by the Government Operations Subcommittee of the House Oversight and Government Affairs Committee, I had hoped to hear some new information about the TWIC Reader program, particularly from the GAO. Fortunately, I am used to being disappointed by Congressional hearings.

Looking at the written testimony presented by Mr. Lord (GAO) it looks like we entered a short time warp and were transported back to May 8^th. The differences between the GAO report presented at that hearing and the one presented this week can’t be more than a couple of hundred words and most of those are the salutations to the committee chair and members.

The prepared testimony presented by Mr Sadler (TSA), on the other hand, was almost completely re-written, but it did not shed any new light on the issues at hand. Sadler (and presumably his bosses) still maintains that the TWIC Reader Pilot demonstrated that the “TWIC reader systems function properly when they are designed, installed, and operated in a manner consistent with the characteristics and business needs of the facility or vessel operation. People who watched the last hearing can probably still hear that refrain echoing through their minds.

We did have two new additions to this revival show; Rear Admiral Servidio (Coast Guard) and Mr. Woodring (Port of Houston Authority). The only information that the Admiral added was that the Coasties had extended the comment period by 30-days to give folks a chance to respond to the GAO charges that the TWIC Reader Pilot was inadequately designed and executed. As I have noted in other blog posts, that extension of the comment period has not brought much discussion of the TWIC Reader Pilot.

Mr. Woodring, a retired 27 year veteran of the Coast Guard and now working on the civilian side of the same street, brings an interesting perspective to the testimony. Having said that, he also ignores the TWIC Reader Pilot issue while pointing out the strong and weak points of the TWIC system (well worth reading for those not familiar with the program).

Oh well, I have come to expect the rehash or earlier information when multiple committees look at the same topic. It would have been more helpful if the two Subcommittees could have done this all at one time.

BTW: I don’t think I’m going to waste my time watching the replay video; I have never been a fan of re-runs or re-makes.

TWIC Reader Hearing

Well, I finally had a chance to go back and watch the web cast of last Thursday’s hearing of the

Government Operations Subcommittee of the House Oversight and Government Affairs Committee on the GAO’s report on the TWIC Reader Pilot. Well, it was supposed to be about Federal Government Approaches to Issuing Biometric IDs, but no other agencies could show up and there was this GAO report, so it was essentially about the report.

Now I described the report in an earlier post, but in summary the GAO found all sorts of methodological problems with the way the TWIC Reader Pilot was run by TSA. As a result of those problems GAO questions whether the conclusions drawn from the pilot report can be used to justify the use of TWIC Readers. GAO did not question the utility or performance of the Readers, just whether or not the TWIC Reader Pilot results could be used to justify the use of the Readers.

Politics

The hearing was very poorly attended on both sides of the Committee Room. There were only four congressmen present, the Chair and Vice-Chair, the Ranking Members of both the Committee and Sub-Committee. The Rep. Mica (R,FL) noted that there were only three people in the press gallery. Even with the advanced notice of the results of the GAO report, there was little interest in the hearing.

The hearing was, however, a model of bipartisan agreement; TSA was in deep trouble and had a great deal of explaining to do. With only four congresscritters asking questions there was a great deal of follow-up questioning and when one congressman’s turn was done the next took up the same line of questioning as if it were rehearsed.

For the most part the questioners did listen to the responses and modify their subsequent questions appropriately. The only major exception to this was Chairman Mica’s continuing reference to the susceptibility of the TWIC to forgery, even after Mr. Lord explained that the GAO’s forged cards did not pass muster in the TWIC Reader. Lord explained that the holders were allowed facility entrance despite the lack of TWIC Reader approval; certainly not the fault of TSA.

To TWIC or Not To TWIC

Every one of the Subcommittee members present questioned whether or not DHS should consider replacing the TWIC with something more effective. Committee Ranking Member Cummings (D,MD) made the comment in his opening remarks that there is no “reliable data proving that the TWIC card” is part of an effective port security program. Mr. Sadler from TSA disagreed, of course, but even Mr. Lord from GSA admitted that there was no proof that the TWIC wasn’t effective.

Mr. Sadler said time and again (in very repetitive language, obviously rehearsed to emphasize the limitations) that, when properly installed and maintained, and the operators and card holders were properly trained, the TWIC Readers in the study properly performed their scanning and verification function. No one disputed this oft repeated statement.

What wasn’t directly mentioned here was the fact that neither TSA or GAO have any control over whether or not the TWIC program continues, is cancelled or is significantly modified. All of that rests with the Congress. Of course, scrapping the program and starting anew will cost a great deal of money, something that will be politically impossible to do. Even making significant changes to the TWIC program will be costly and politically difficult to achieve in the current political and economic environment.

Interestingly, the GAO does not recommend making changes to either the TWIC or the TWIC Readers. The conclusion of this report states:

“Given that the results of the pilot are unreliable for informing the TWIC card reader rule on the technology and operational impacts of using TWIC cards with readers, we recommended that Congress should consider repealing the requirement that the Secretary of Homeland Security promulgate final regulations that require the deployment of card readers that are consistent with the findings of the pilot program; and that Congress should consider requiring that the Secretary of Homeland Security complete an assessment that evaluates the effectiveness of using TWIC with readers for enhancing port security. This would be consistent with the recommendation that we made in our May 2011 report. These results could then be used to promulgate a final regulation as appropriate.” (pg 10)

In other words, Congress should remove their mandate to use the TWIC Reader Pilot as the justification for requiring the use of TWIC Readers and put the burden back on DHS to justify the use of TWIC Readers on the basis of improved security. The reason for requiring the TWIC Reader shouldn’t be that it works, but rather that it is needed.

TWIC Antennas

There was an important technical issue that was only peripherally addressed in this hearing and in the GAO report. The GAO report noted that there was insufficient information provided in the TWIC Reader pilot to identify how many cards were not read due to broken antennas. Since the TWIC is an RFID device that can be remotely queried by the TWIC Reader a broken antenna makes it useless as a contactless identification.

Mr. Sadler noted in response to questioning that the contactless mode of operation is what distinguishes the TWIC from the Common Access Card (CAC) readers used by the military. He used this to explain why the Subcommittee members {particularly Ranking Member Connolly (D,VA)} should not try to compare the ruggedness of the CAC to the less robust TWIC.

He then claimed that only a contactless reader could be used at port facility truck gates. This does not appear to be factually correct. There are hand-held TWIC Readers that could be used, allowing the more robust antenna available on such devices to be used to contact a local base station rather than using the embedded antennas to allow the TWIC to communicate with the Reader.

IRIS Biometric

A topic near and dear to the heart of Chairman Mica is the lack of an iris scan biometric encoded in the TWIC. Each time he brings this up, apparently, he has been told that NIST does not yet established a standard for encoding the iris biometric, but is coming in the next couple of months. TSA rightly maintains that it is not up to them to establish the standard, just to implement one if it is feasibly available.

Mica requested both witnesses and the committee staff to contact NIST to see if they could get a consistent answer as to when such a standard might become available.

TWIC NPRM Reader Extension

Mr. Lord did note in response to some question about the timetable for the implementation of the TWIC Reader NPRM (a concept that Chairman Mica appeared to be completely unfamiliar with) that the Coast Guard had recently extended the comment period on the NPRM to 90 days. Then, almost in passing, he suggested that they might want to make another 90 day extension to allow comments to be formulated about the results of the GAO report on the TWIC Reader Pilot.

Since there have been no comments to date on the TWIC Reader Pilot, I would not be surprised to hear that someone in industry doesn’t request another extension to review their initial acceptance of the NPRM in light of the reported inconsistencies in the pilot report. With just a little over a month remaining on the revised comment period, the Coast Guard would certainly be justified in approving such a request.

Video Timeline

A long time reader, Donald Bruce of the Houston/Galveston, TX Area Maritime Security Committee, was kind enough to send me an annotated timeline of the important parts (in his estimation) of the web cast of the hearing. I have not checked every listing, but it was helpful to me in following the video so I thought that I would pass it along. Note: Everything up to about the 39 minute mark was essentially opening statements.

Min 39 - Iris Scan issues

Min 42 – Use of Fake Cards

Min 43 – Questions from Rep. Connolly – Was the Pilot Successful?

Min 57 – What if we cancel the program?

Min 58 – We should recommend readers

Min 110 – Answer to benefit of TWIC Pilot – Definition of a Successful Reader Project

Min 111 – We will go forward

Min 113 – The TWIC Pilot is very useful for the USCG in the NPRM

Min 114 – CAC described use in Afghanistan – a success story

Min 119 –Contact biometric will not work in a maritime environment

Min 120 – TSA Given 60 days to review over Biometric Card success (CAC)

Min 122 – Look NIST Iris standard (Alternate Biometric)

Moving Forward

Chairman Mica said that the Subcommittee will be holding additional hearings looking at other forms of Federal identification that include encoded biometrics. He also gave Mr. Sadler 60 days to look at the CAC and get back to the Committee with an explanation of why the TWIC and the CAC should/should not be compared.

TWIC Reader Pilot Hearing

Last Sunday in my blog post about upcoming congressional hearings I noted that the hearing scheduled for tomorrow before the Subcommittee on Governmental Operations of the House Oversight & Government Reform Committee on “Federal Government Approaches to Issuing Biometric IDs” might contain mention of the Transportation Workers Identification Credential (TWIC). I was wrong; this hearing will be just about the TWIC and it appears that it could get nasty.

There are currently two witnesses listed on the O&GR web site:

• Mr. Stephen Sadler, TSA

• Mr. Stephen A. Lord, GAO

The witness testimony is already posted to the site and you would be hard pressed to see two diametrically different views about the TWIC. As one might expect Mr. Sadler’s testimony has all sorts of good things to say about the TWIC. Mr. Lord’s testimony, on the other hand is a fairly scathing (couched in appropriate bureaucratese) attack on the competency of the TSA effort to conduct the TWIC Reader pilot.

The GAO report identified “eight areas where TWIC reader pilot data collection, supporting documentation, and recording weaknesses affected the completeness, accuracy, and reliability of the pilot data” (page 6). They were:

1. Installed TWIC readers and access control systems could not collect required data on TWIC reader use, and TSA and the independent test agent did not employ effective compensating data collection measures.

2. Reported transaction data did not match underlying documentation.

3. Pilot documentation did not contain complete TWIC reader and access control system characteristics.

4. TSA and the independent test agent did not record clear baseline data for comparing operational performance at access points with TWIC readers.

5. TSA and the independent test agent did not collect complete data on malfunctioning TWIC cards.

6. Pilot participants did not document instances of denied access.

7. TSA and the independent test agent did not collect consistent data on the operational impact of using TWIC cards with readers.

8. Pilot site records did not contain complete information about installed TWIC readers’ and access control systems’ design.

Lord’s report concluded by saying, in part:

“Given that the results of the pilot are unreliable for informing the TWIC card reader rule on the technology and operational impacts of using TWIC cards with readers, we recommended that Congress should consider repealing the requirement that the Secretary of Homeland Security promulgate final regulations that require the deployment of card readers that are consistent with the findings of the pilot program; and that Congress should consider requiring that the Secretary of Homeland Security complete an assessment that evaluates the effectiveness of using TWIC with readers for enhancing port security.”

Tomorrow’s hearing will be interesting.

TWIC Reader Pilots Results

The folks over at Maritime Transportation Security News have an interesting post about some of the results from the recently completed (but yet to be reported) TWIC Reader pilot study conducted by TSA. The information in the post is based upon presentations at the recent American Association of Port Authorities (AAPA) Port Operations, Safety and Technology Seminar.

Read that entire post for details, but the results did not seem promising for the expanded use of the Transportation Workers Identification Credential (TWIC) as something more than just another picture ID. Problems ranging from card delamination to training issues were noted.

The biggest problem from a security systems perspective appears to be the amount of time that it takes to process a person through the Reader. The post makes the following observation from the presentation of Jill Taylor, Deputy Director of Homeland Security, Port of Los Angeles:

“When operating in the biometric mode, all evidently significantly exceed the maximum times the National Maritime Security Advisory Committee (NMSAC) initially thought would be acceptable to industry. Even when not comparing biometrics, most still have transaction times exceeding NMSAC’s standard.”

While none of these problems directly effects the potential use of the TWIC for background check purposes, it does call the basic program into question. The whole idea for the TWIC was that the identification would be difficult to counterfeit because of the provisions for a readily verifiable biometric component in the identification process. Without an effective TWIC reader component, the cost of the program may be hard to justify to a cost conscious Congress.

We can expect to see some interesting hearings later this summer when TSA officially publishes their report on the TWIC Reader pilot.