Airport Security

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Parts 107 and 139

[Docket No. FAA-2001-8724; Formerly Docket No. 28979; Amendment No. 107-13, 139-23]

RIN 2120-AD46

Airport Security

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Final rule.

SUMMARY:

This final rule amends the existing airport security rules. It revises certain applicability provisions, definitions, and terms; reorganizes these rules into subparts containing related requirements; and incorporates some requirements already implemented in security programs. This revision also incorporates certain new measures to provide for enhanced airport security. Specifically, this final rule more clearly defines the areas of the airport in which security interests are the most critical and where security measures should be the most stringent. The intent of this final rule is to enhance security for the traveling public, aircraft operators, and persons employed by or conducting business at public airports by increasing awareness of and compliance with civil aviation security measures.

EFFECTIVE DATE:

November 14, 2001.

FOR FURTHER INFORMATION CONTACT:

Robert J. Cammaroto, Office of Civil Aviation Security Policy and Planning, Federal Aviation Administration, 800 Independence Ave., SW., Washington, DC 20591; telephone (202) 267-7723.

SUPPLEMENTARY INFORMATION:

Availability of Final Rule

You can get an electronic copy using the Internet by taking the following steps:

(1) Go to the search function of the Department of Transportation's electronic Docket Management System (DMS) Web page (http://dms.dot.gov/search).

(2) On the search page type in the last four digits of the Docket number shown at the beginning of this notice. Click on “search.”

(3) On the next page, which contains the Docket summary information for the Docket you selected, click on the final rule.

You can also get an electronic copy using the Internet through FAA's web page at http://www.faa.gov/avr/armhome.htm or the

Federal Register

's web page at http://www.access.gpo.gov/su_docs/aces/aces140.html.

You can also get a copy by submitting a request to the Federal Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence Avenue, SW, Washington, DC 20591, or by calling (202) 267-9680. Make sure to identify the amendment number or docket number of this final rule.

Small Business Regulatory Enforcement Fairness Act

The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 1996 requires FAA to comply with small entity requests for information or advice about compliance with statutes and regulations within its jurisdiction. Therefore, any small entity that has a question regarding this document may contact their local FAA official, or the person listed under

FOR FURTHER INFORMATION CONTACT.

You can find out more about SBREFA on the Internet at our site, http://www.faa.gov/avr/arm/sbrefa.htm. For more information on SBREFA, e-mail us 9-AWA-SBREFA@faa.gov.

Background

The FAA published a proposed rule on airport security on August 1, 1997 (62 FR 41760; Notice No. 97-13). On the same date, the FAA issued Notice 9712 to revise part 108, Aircraft Operator Security (62 FR 41730). The crash of TWA 800 on July 17, 1996 raised concerns about the safety and security of civil aviation, leading the President to create the White House Commission on Aviation Safety and Security, headed by the Vice President. The Commission issued an initial report on September 9, 1996, with 20 specific recommendations for improving aviation security. On February 12, 1997, the Commission issued its Final Report with 57 recommendations, 31 of which deal with improving aviation security for travelers. In addition, the Federal Aviation Reauthorization Act of 1996 (Pub. L. 104-264) was signed on October 9, 1996, and directs the FAA to amend rules to upgrade civil aviation security.

The FAA has been working to respond to the recommendations of the Commission and to carry out the legislation, and has issued several proposals, in addition to the proposed rule put forth in Notice No. 97-13. On September 24, 1998, the FAA issued a Final Rule on employment history, verification, and criminal records checks. (63 FR 51218; September 24, 1998).

The rules proposed in Notice No. 97-13 were not written in response to the Commission or the Reauthorization Act. Rather, the notice, which proposed to update the overall regulatory structure for airport and aircraft operator security, involved the FAA, other Federal agencies and commissions, airports and aircraft operators, and the Aviation Security Advisory Committee (ASAC). Nevertheless, the extensive proposed revisions were considered to be consistent with the intentions of the mandates, contained proposals industry had identified as necessary or appropriate, and outlined a new organization for the regulations that would assist in developing future changes to the rules. For these reasons, the FAA published the proposed rule for comment. This final rule addresses comments to that proposal.

The revision of part 108, published concurrently with this rule, contains a discussion of the current terrorist threat that also is applicable to concerns under part 107.

The Role of the ASAC

On April 3, 1989, the Secretary of Transportation announced the formation of a national ASAC under the provision of the Federal Advisory Committee Act (Title 5 U.S. Code, Appendix II).

The ASAC was formed to examine all areas of civil aviation security and to ensure a higher degree of safety for the traveling public by recommending improvement of aviation security equipment and procedures. The ASAC is chaired by the FAA's Assistant Administrator for Civil Aviation Security and makes recommendations to the FAA Administrator. Committee membership represents a balance of Federal government, aviation industry, and consumer advocacy groups.

All ASAC meetings are open to the public and are announced in the

Federal Register

. Meetings typically are held three times a year. Members of the public are permitted to attend and appear before the committee, subject to reasonable limitations of space and time.

In December 1993, the FAA sought the ASAC's comments on a “discussion paper” that included a broad range of security issues and concerns. A copy of this paper is filed in the FAA public docket for Notice No. 97-13 (Docket No. 28979).

To address the issues raised in the discussion paper, the ASAC formed two subcommittees, and developed recommendations on airport and aircraft operator security issues, which were reported to the FAA on March 15, 1994. Individual ASAC members also provided comments on issues when their respective organizations disagreed with the position of the committee.

Then the ASAC's and individual committee members' comments were forwarded to the FAA with an overall recommendation that security regulations should remain flexible and contain only general security performance standards.

General Discussion of the Rule

The FAA is required to prescribe rules as needed, to protect persons and property on aircraft against acts of criminal violence and aircraft piracy, and to prescribe rules for screening passengers and property for dangerous weapons, explosives, and destructive substances (

See

49 U.S.C. 44901 through 44904).

To comply with the statute, the FAA has issued rules that require airport operators to perform various duties to ensure the security of civil aviation. Title 14, Code of Federal Regulations, contains part 107 that is directed specifically toward airport operators, and contains general requirements for promoting civil aviation security.

Airport operators are required by new § 107.101 to have a security program, approved by the Administrator that specifies measures they will use to perform their regulatory and statutory responsibilities. The airport security program contains sensitive security information (SSI) and is available only to persons with a need-to-know. Most airport security programs include the following information: descriptions of the air operations area (AOA), each area on or adjacent to the airport that affects the security of the AOA, and air carriers exclusive areas; procedures to control access to the AOA; alternate security procedures for use in emergency and other unusual conditions; and law enforcement support training and record maintenance programs in furtherance of part 107. Programs for some airports include a description of the law enforcement support training program and the system for maintaining records.

Other sources of information and measures are contained in Security Directives and Information Circulars described in new § 107.303. These sources address threats to civil aviation security as well as responsive measures to those threats.

The airport security program is far more detailed than the regulations and, therefore, there will be items specifically addressed in detail that may only be broadly addressed in the regulatory language of part 107. Once approved, the security program has the force of law, and like the part 107 regulations, airport operators must comply with their security program.

This revision of part 107 comprehensively updates airport security regulations to more efficiently and effectively address terrorist and other criminal threats to civil aviation. This action incorporates procedures currently in security programs into part 107, in a manner that is intended to allow regulated entities and individuals to better understand their respective security responsibilities. Concurrent with the issuance of this final rule, the FAA is updating relevant guidance that will help to ensure that airport security programs are consistent with this rule. Lastly, the final rule incorporates certain new measures that will provide for enhanced security. For example, the revisions make individuals directly accountable to the FAA for non-compliance with certain regulations.

Furthermore, local authorities will not be prevented from also taking action against an individual for non-compliance with the regulation, even if the FAA previously has taken action against that individual for the same offense. In fact, the FAA realizes that some local actions may be imposed more quickly and effectively than the agency's actions.

The proposal would have required that an airport's security program include specific local disciplinary actions and penalties for employees who do not comply with security requirements. Initially, this proposal was quite controversial. However, the public's opinion regarding this issue apparently has changed. In response, the FAA reopened the comment period from August 10-September 24, 1999, to receive additional comments from the public on the individual accountability issue [64 FR 43321 (August 10, 1999)]. Therefore, the FAA will not address this issue in this final rule, it will be addressed in a future rulemaking.

Through these changes, the FAA hopes to create a more effective mix of individual and corporate responsibility for complying with security regulations, particularly those relating to access controls and challenge procedures.

General Discussion of the Comments

The NPRM initially requested comments by December 1, 1997. Two public meetings were announced on October 15, 1997, in Washington, DC, and on October 22, 1997, in Fort Worth, TX. On April 14, 1998, the FAA reopened the comment period and announced two public meetings on the NPRM. The public meetings were held on May 21, 1998, in Washington, DC, and June 4, 1998, in Nashville, TN.

As of June 26, 1998, the closing of the second comment period, about 200 comments were received addressing the NPRM. Comments were received from 62 airports, two State and local governments, four law enforcement entities, eight air carriers, and seven industry associations representing these interests. Comments were also received from numerous individuals.

Secured Area, Air Operations Area (AOA), and Security Identification Display Area (SIDA)

Proposal:

Notice 97-13 proposed to change the names of the various areas controlled under part 107, and to make some changes in the security measures that apply to each. Under the current rule there are several areas that have been introduced over the years for various security purposes.

Security measures have been required in the AOA since the inception of part 107 in 1972. The definition of AOA in current § 107.1(b)(2) is “a portion of an airport designed and used for landing, takeoff, or surface maneuvering of airplanes. * * *” Current § 107.13 provides the security requirements for the AOA. Basically, the airport operator must use the measures in its security program to control access to the AOA and prevent entry of unauthorized persons and ground vehicles; to control movement of persons and ground vehicles, including display of ID when appropriate; and to detect and control each unauthorized penetration.

The secured area was introduced in 1989 in § 107.14. Its location on airports intentionally was not defined to avoid compromising airport operators' security programs. See 54 FR 582 at 584 (January 6, 1989). Section 107.14 requires enhanced access controls for secured areas of the airport mostly using computerized access controls. This area for most airports has evolved to be mainly portions of the AOA near the terminal and in baggage make-up areas, where the highest levels of security are needed. For some airports, the entire AOA is a secured area, because of such factors as the location of the airport and the inability to use adequate security controls to separate general aviation and other areas from air carrier operations.

The SIDA was defined in 1991. The SIDA is defined in current § 107.25(a) as “any area identified in the airport security program as requiring each person to continuously display on their outermost garment, an airport-approved ID medium unless under airport-approved escort.” The ID medium is referred to as being used for both access control and controlling the presence and movement of persons. The portions of the airport that must be a SIDA are not set out in current part 107. The

preambles to proposed and final § 107.205, however, indicate that SIDA generally would include secured areas (§ 107.14), air operations areas (§ 107.1(b)(2)), cargo and baggage make-up areas, and other areas specified in individual airport security programs. SIDA would not include the sterile area. There also would be site-specific provisions at those airports where general aviation and other areas are positively separated from air carrier operations [56 FR 13552 at 13553, and 56 FR 41412 at 41413]. Thus, the secured area, part or all of the AOA, and some areas that are neither secured areas nor AOA (such as some cargo makeup areas) could be within a SIDA. The security measures required in the SIDA are in §§ 107.25 and 107.31. These sections require training of persons with unescorted access to the SIDA, and employment history, verification, and criminal history records checks of those persons.

This systematic design of interlocking areas has created some confusion in the past. It has not been clear where the limits of the secured area should be, for instance. Notice 97-13 attempted to propose a design that would be simpler and clearer. It proposed to eliminate overlapping areas, such as where both the AOA rules and the secured area rules apply. It also proposed, based in part on recommendations from the ASAC, to rename the areas so that what is now the secured area would be the critical security area (CSA), and what is now the AOA outside of the secured area would be the restricted operations area (ROA). Definitions of these terms were proposed in § 107.3. Sections 107.201 and 107.203 proposed specific requirements for access systems, ID systems, and other security measures to be applied in the CSA and ROA, respectively. The intent was to more clearly describe those areas of the airport in which the security interests are the most critical and require the most stringent measures, and to enhance the security of other parts of the ROA.

Comments on changing the names of the areas:

Many commenters object to changing the names of the secured area, AOA, and SIDA. They state that the industry has become familiar with these names and that changing them now would create confusion. It would also result in very large expenses to change training programs and videos, airport manuals, emergency plans, signs, and many other items. The commenters note that spending a significant amount of time, effort, and funds on retraining, signs, documentation, and security programs for renaming the above noted areas, would not improve security. The commenters strongly urge that the names not be changed.

One commenter suggests that acronyms for defined terms should be included in the definitions. Another commenter says that the FAA should avoid using 3-letter acronyms that replicate an airport's 3-letter designator code.

FAA response:

The FAA has decided not to change the names of the areas to CSA and ROA. After further consideration, changing these names would create a burden to change numerous documents, signs, training programs, and the like with insufficient benefit. The industry has become used to these names and there is not the same concern there was several years ago about them.

Regarding the use of acronyms, the FAA will adopt the suggestion to reference commonly used acronyms in the definitions. Also, in response to the comment on acronyms relating to security terms as opposed to 3-letter airport designator codes, the FAA notes that security terms and their acronyms are based on functional descriptions of what they are intended to define. The FAA's system of 3-letter airport designator codes is a separate and distinct program. The agency recognizes that some acronyms and 3-letter airport identifiers may be unintentionally identical, but it is not aware of any conflicts at this time. However, it is expected that the context in which overlapping terms would be used will indicate their intent.

Comments on definitions of critical security area, restricted security area, secured area, AOA, and SIDA:

National Air Transport Association (NATA) and Missoula International Airport comment that areas used by general aviation should be excluded from the critical security area and maintained in the AOA, and have less intrusive security requirements. The ATA requests a definition of “AOA.” Several commenters including three airports requested a definition of “SIDA.”

The Port Authority of NY and NJ suggests that “critical security area” should be defined as “where aircraft operators and foreign aircraft operators enplane and deplane passengers and sort and load baggage and any

immediately

adjacent areas that are not separated by security controls, physical or visual barriers, adequate time and distance separation or visual surveillance.”

Atlanta Hartsfield International Airport requests that the FAA add the phrase “time and distance” after the phrase “physical barriers” in the definition of “restricted operations area.” Furthermore, Ft. Wayne Airport suggests the definition should be modified to include

only

areas that are used by aircraft operators for the carriage of passengers. Another commenter says that the restricted operations area should allow the use of “visual barriers,” such as lines or words painted on the pavement.

One commenter requests clarification of the phrases “adjacent areas” and “other security measures” which are used in the definition of “critical security area.”

The NATA requests a definition of the area of an airport where general aviation activities occur. One suggestion is to define the term “General Aviation Security Area” so that the general aviation areas are not included in the critical security area or restricted operations area.

Two airports state that the ROA should be defined and limited to only those areas outside the critical security area and immediately adjacent to facilities needed for aircraft operators to land, depart, taxi, park, and maneuver aircraft. All other areas should be considered non-restricted AOA portions of the airport and a definition for an AOA included in the new part 107. The proposed rule, as written, would require a massive expenditure of critically needed funds to extend and upgrade the systems presently installed.

The Airport Council International-North America (ACI-NA), American Association of American Executives (AAAE), and two airports state that increasing the size of the restricted operations area directly contravenes the recommendations of the ASAC working group.

FAA Response:

This rule adds definitions to better describe the limits of the secured area, AOA, and SIDA. These definitions in part are intended to conform part 107 to what has become common practice in determining the limits of these areas at airports. The FAA anticipates that there will be few changes needed in the boundaries of current secured areas, SIDAs, and AOAs based on these rule changes, although nationwide we anticipate a small reduction in the current security areas and corresponding increase in the AOA. These definitions reduce the overlap between the areas by clearly separating the AOA from the secured area. Each will be a distinct area, with different requirements. This assists in accomplishing the goal of providing for the highest levels of security at those places where operations regulated under parts 108 and 129 are conducted.

The secured area is that area where the highest level of security measures

are needed. This includes areas where part 108 operations enplane and deplane passengers and sort and load baggage, and adjacent areas that are not separated by adequate security measures. Unlike the current rule, the term “secured area” is not used only to describe the area where enhanced access controls are required. It is used to describe an area where a range of enhanced security measures are required, including identification media, escort, and challenge programs. This is consistent with current practice. For example, those areas in which the enhanced access controls are considered necessary are also SIDAs with ID display required.

The SIDA is essentially not changed from the current rule. It overlays secured area, in that the secured area must be a SIDA. It may overlap an AOA, in that at some airports it may be necessary for part or all of the AOA to be a SIDA. The SIDA may also be in an area outside of either the secured area or AOA, such as a cargo makeup area. The security measures required for the SIDA have not been changed significantly.

The AOA is almost the same concept as used in current part 107, except that it is limited to those areas that are used by parts 108 and 129 operations, and those adjacent areas that are not separated by adequate security measures. Further, the secured area is no longer considered part of the AOA. The security measures required in the AOA include controlling access and presence of unauthorized persons and vehicles. There remains flexibility as to exact measures to be used to accomplish these tasks, because each airport is different and may have different needs in the AOA. For instance, personnel ID systems may or may not be used in the AOA.

The proposal used the phrase “any adjacent areas that are not separated by security controls or physical barriers.” The final rule uses the phrase “adjacent areas that are not separated by adequate security systems, measures, or procedures.” Physical barriers are one sort of security measure, and may be a critical part of a security system that permits an adjacent area to be excluded from a secured area or an AOA. There are many other provisions that in appropriate combinations may provide adequate security systems, measures, or procedures. They include remoteness from the adjacent operation (“time and distance”) combined with specific measures to detect and respond to unauthorized penetrations, fences, personnel ID systems, closed circuit TV, clear markings, and security patrols. Given the wide variations in airports and the various security systems in use, it is impossible to state specifically in the rule what is needed at each airport. Further, much of the information on the security systems to be used at each airport must be kept non-public to avoid giving unauthorized persons information that could be used to attempt to defeat them.

As to signs, markings, and visual barriers, it must be noted that these are effective mostly for people who are attempting in good faith to comply with the security systems at the airport. Standing alone, they are not very effective at keeping out persons who are intending to defeat the system.

The FAA considered using the term “immediately adjacent,” rather than just “adjacent.” However, this might be viewed as too limiting. The key is whether the adjacent area can be separated by adequate security measures. Distance alone is not sufficient. For instance, to be effective, distance must be coupled with adequate measures to detect and respond to unauthorized persons attempting to cross that distance. In each case, the airport operator and the FAA must consider not only how close the adjacent area is, but also what security measures are present, what related activity is in the area, and all other factors. It is impossible to state specifically how far an area might extend before it is excluded from the secured area or the AOA. For instance, at airports where general aviation (GA) activity is sufficiently remote from the secured area and there are dedicated measures to detect and challenge persons moving from the GA area to the secured area, that GA area may not need to be included in the secured area. At other locations where the GA activity is close to the terminal, and it is not possible to erect adequate physical barriers, there may be no way to provide adequate security measures to exclude the GA area from the secured area. Removing GA areas from the AOA, this too depends on the airport. GA areas are usually near taxiways and/or runways used by parts 108 and 129 aircraft, and are usually within the perimeter fence of the airport. Even if a GA area is remote from the secured area it may not be possible to have adequate security measures to omit it from the AOA. However, if the GA area is separated from the taxiways and runways by a fence and controlled gate, there may be a basis to exclude it from the AOA. Again, the FAA does not consider the secured area and AOA, as defined in the final rule, to be vastly different than what currently exists at the airports. This final rule to a large extent more clearly reflects the areas as they have evolved from the more general and vague language of the current rule.

The security measures required in each area are discussed more fully in the Section-by-Section Analysis.

The Notice did not propose to retain the term SIDA. As discussed above, the FAA has decided to retain this term, with modifications. As used in current § 107.25, SIDA refers to “any area identified in the airport security program as requiring each person to continuously display on their outermost garment, an airport-approved identification medium unless under airport-approved escort.” It was based on the idea that, if the area was of such an importance to security to have a requirement in the security program for the continuous display of identification, it should also have the training requirements in § 107.25 to ensure that airport personnel know their duties to challenge persons without ID, and the employment verification of § 107.31.

This final rule changes the definition of SIDA to “a portion of an airport, specified in the airport security program, in which security measures specified in this part are carried out. This area includes the secured area and may include other areas of the airport, such as areas where there are activities related to the operations of aircraft operators and foreign air carriers that have security programs under part 108 or § 129.25 of this chapter.” This definition is intended to capture the original intent of the SIDA. It includes the secured area, in which the highest level of security is required. An airport operator may include in the SIDA other areas, such as cargo makeup areas, fuel farms, and other areas, particularly where activities related to part 108 and part 129 operations are carried out. On some airports the entire AOA may be designated a SIDA. Again, because of the varied configuration of airports it is not possible to describe exactly the limits of the SIDA.

New § 107.205 states the security measures that must be carried out in the SIDA, and is discussed in the Section-by-Section Analysis.

A strict reading of current § § 107.25 and 107.31 would suggest that any area in which continuous display of ID is provided for in the security program also requires the more extensive training in escort and challenge procedures, and employment verification in these sections. It has become evident to the FAA that there are areas of airports outside of the secured area in which, due to local circumstances, the continuous display of ID is required by

local rule, but that do not necessarily warrant the higher security requirements of a SIDA. Examples include areas used exclusively by an aircraft manufacturer or other private corporation, in which continuous display of a corporate ID is required largely for corporate security purposes. Such areas are described in the airport security program because they are part of the overall security situation at the airport. For instance, the airport would make sure that the color and appearance of the corporate ID was not confusingly similar to that of the airport IDs used in the SIDA. The corporate areas, however, need not have all the measures that apply to the SIDA. Nevertheless, the definition as it appears in current part 107 could be read to mean that such areas must be formal SIDA's. New § 107.203(b)(5) acknowledges that such areas may exist in the AOA without them being deemed SIDA's under new § 107.205.

The Notice proposed, in essence, that the CSA (now the secured area) would have all the attributes of the SIDA, with full training and employment verification. The proposed ROA (now AOA) would have ID display required, but not have the same extensive training or employment verification as the SIDA. The final rule represents a middle ground between the current rule and the proposal by requiring the secured area to be a SIDA, and providing the option of less burdensome ID requirements in the AOA.

Time Limits

Proposal:

The Notice proposed various time limits for carrying out various tasks, such as approval of a security program, amendments to security programs, and changed conditions affecting security. These tasks were presented with deadlines that were in terms of calendar days and hours.

Comments:

A commenter states that compliance timeframes should be adjusted to reflect realistic opportunities. The recommendation was made that the FAA refer to “business days” versus a specified number of hours when setting deadlines for compliance.

FAA response:

Regarding the use of business days in favor of a specific number of hours, the FAA notes that its regulations usually deal in terms of calendar days or hours (for instance, 30 days or 72 hours). When setting deadlines for compliance the FAA will set reasonable deadlines, based on circumstances, while taking into account holidays and weekends. In emergency situations, it may not be in the interest of security to delay compliance for a weekend or holiday. The agency sees no need to alter its practice. Further, the use of “business days” can be confusing. Most airports are open for business every day of the week, including holidays. Further, the observance of holidays is not uniform throughout the country.

Compliance Dates

Proposal:

The Notice requested comments regarding compliance dates.

Comments:

ACI-NA and AAAE comment that the FAA should provide sufficient time following issuance of a final rule for airports to be in compliance. A minimum phase-in period of 18 months was suggested.

FAA response:

The FAA believes this final rule has allowed adequate time for airports to comply. The agency notes that the complexities involved in compliance, as well as anticipated costs, are carefully weighed when deadlines are established. Where difficulties are encountered, airport operators are encouraged to contact their local FAA security field office. The FAA has attempted to ensure a realistic approach to compliance timeframes but recognizes that such timeframes are sometimes not met for good cause. The agency is prepared to extend reasonable consideration when the merits of a situation warrant.

The final rule has far fewer required changes than the NPRM. For instance, the boundaries and names of the secured area, AOA, and SIDA will change little, if at all. Also, some new requirements have intended compliance dates such as for AOA training under § 107.213(c) and (f).

Security Requirements Based on Size of Aircraft Served

Comments:

One commenter states that increased airport security thresholds should not be based on the size of the aircraft serving an airport, but on the number of passengers screened annually. One commenter agrees with the statement that experience shows airports served by smaller aircraft need not comply with all of the requirements imposed on larger airports. However, security should be a function of the nature of the service resident at an airport; that is, medium and large hub airports are of more concern, so operations to and from them should be of more concern. The commenter suggests that perhaps the analysis should focus on city pairs instead; and further still, to more highly threatened city pairs. Aircraft sizes and their variations do not, in themselves, create security issues.

FAA response:

The agency understands the commenters' concerns about appropriate measures as determined by the size and threat level of particular airports. But, contrary to the comments, the FAA believes that aircraft size and capabilities affect their desirability as targets of terrorism or other criminal acts. Such criteria have historically proven good indicators of where and how to focus limited security resources. There are some requirements that may vary based on the amount of activity at the airport and other factors, which are set out in the individual airport's security programs.

Supplemental Notice of Proposed Rulemaking (SNPRM)

Comments:

The ACI-NA and AAAE strongly urge the FAA not to implement the proposed rule until the FAA publishes an SNPRM and reviews the comments. It would be appropriate within this timeframe to examine ways that the ASAC, or a new working group within the ASAC, could be appointed to clarify and streamline this proposal.

Twenty-four airports, an air carrier, a local government, five local departments, and commissions recommend that the FAA publish an SNPRM.

Many commenters state that the FAA states throughout the NPRM that it is an incomplete proposal, and notes that additional language will be supplied at a later, unspecified date.

FAA response:

Having received a vast amount of public and industry input to this proposal, and in view of the many changes reflected in the final rule, the FAA is confident that the rule can go forward without the issuance of an SNPRM that covers the entire part 107. This decision is based partly on the fact that the FAA has agreed with many of the issues the commenters felt most strongly about, such as renaming the airport areas. As to another issue of common concern, compliance programs in proposed § 107.103(a)(2) as mentioned under General Discussion of the Rule, the agency reopened the comment period.

The proposal and the final rule, as well as extensive historical experience, make it clear that many specifics of the design and implementation of security programs are not appropriate for the public rulemaking process. The FAA has carefully and diligently indicated the difference between public requirements of the regulation, and specific information that can only appear in the security program. The specific details of security measures, in order to be effective, must often be held closely by those with a “need to know.”

Since many of the requirements of this final rule have been in place at airports in one form or another for many years, the FAA does not anticipate any regulated parties would be unduly or unnecessarily inconvenienced in complying with them.

Section-by-Section Analysis

The following is a discussion of comments and FAA responses for each proposed section.

Section 107.1 Applicability

The NPRM proposed to extend airport security requirements to airports regularly serving any aircraft operator required to have a security program under parts 108 or 129. This would be a change from the current rule, which covers airport operators regularly serving scheduled operations of aircraft operators required to have a security program. The increase would be those airports that only regularly serve certain public charter operations. The NPRM also proposed to extend the applicability of existing § 107.1 to individuals entering or in critical security areas, restricted operations areas, and sterile areas.

Under proposed § 107.1(b), the term “Assistant Administrator for Civil Aviation Security” would be used, rather than the existing “Director of Civil Aviation Security.” This position would be defined as the official who oversees civil aviation security operations and approves security programs. In addition, § 107.1(b) would clarify that the Deputy Assistant Administrator for Civil Aviation Security, or any individual formally designated, could act in the capacity of the Assistant Administrator and the duties of this position could be further delegated.

Comments:

A commenter states that smaller regional airports do not have staff to perform all requirements in the proposed rule. The FAA would have to fund the salaries of additional personnel so that the facility could comply with the rule.

Another commenter recommends removing the reference to “sterile area” in § 107.1(a)(3), as it is controlled by part 108 rules.

Finally, Air Transport Association (ATA) comments that the delegation of the Administrator's authority should be narrowly circumscribed due to the potential for conflicting and overlapping authority.

FAA response:

In the past, the FAA generally chose to hold only the airport operator accountable for the actions of persons under its control, with the expectation that corrective actions taken by airport operators would discourage employees and others from repeated non-compliance. The FAA continues to believe that corporate accountability is key to achieving and maintaining compliance. However, the agency also believes that the concept of holding individuals accountable for security violations, in a timely fashion, is a worthy one. The agency remains committed to broadening accountability and the final rule reflects that under new § 107.11.

In response to the comment regarding the lack of staff at smaller regional airports, the FAA refers to the Regulatory Evaluation. Economic analyses are based on estimates which anticipate costs associated with all sizes of airports, and recognizing the costs of the different levels of security measures associated with each.

Regarding removal of the term “sterile area” from § 107.1(a)(3), that term originated in part 108, and is used in part 107 to define locations at which a person is subject to individual responsibility for their conduct under this part. The FAA, therefore, has decided to leave the proposed language unchanged while the definition of “sterile area” is retained in part 108.

In response to ATA's comment about the delegation of the Administrator's authority, the FAA notes that the proposal reflects the manner in which the FAA's internal chain of command carries out its statutory responsibilities. The FAA agrees that delegations must be carefully evaluated to avoid unnecessary conflicts of authority.

Section 107.3 Definitions

The FAA proposed a new definitions section (§ 107.3) which would include revised definitions from the current part 107. Section 107.3 also would add several new definitions. Existing § 107.3, Security Program, would be incorporated under proposed Subpart B, Airport Security Program. The FAA proposed that the terms defined in part 108, e.g., “sterile area,” would apply to this part.

The proposals regarding the secured area, AOA, SIDA, CSA, and ROA are discussed under the General Discussion above. In addition, the FAA proposed the following in § 107.3. The definition of “exclusive area” in existing § 107.1 would be revised and grouped with a newly defined “exclusive area agreement.” Under the proposal, the definition of “escort” was revised to include a reference to the proposed critical security area and restricted operations area. The definition “sterile area” was revised in the proposal to clarify the responsibility to conduct inspections of persons and property.

The FAA also proposed adding the following definitions: “airport security program,” “airport tenant,” “airport tenant security program,” “Assistant Administrator,” “exclusive area agreement, “and “unescorted access authority.”

Comments on definitions in general:

The Regional Airline Association (RAA), Federal Express (FedEx), eight airports, an air carrier, and a local department of aviation request that the FAA define terms more clearly, or continue using the current terms. The commenters also provide detailed suggestions on how to more clearly define some of the terms.

United Parcel Service (UPS), Alaska Airlines, Trans World Airways (TWA), Port Authority of NY and NJ, and Phoenix Aviation Department suggest incorporating the same definitions in parts 107 and 108.

FAA response:

Clarity of definitions is a fundamental goal of this rulemaking. In response to RAA, FedEx, and the many other commenters who offered comments on exactly how to go about that task, the FAA wishes to assure them that every effort has been made for clarity and distinctness. The challenge was to develop clarity, while at the same time providing flexibility to allow for local applications and unique circumstances.

As to the requests to repeat the definition of terms used in both parts 107 and 108, the FAA has decided to retain the definitions in the most applicable part. Cross references will indicate that the terms apply to the other part as well. Although it might be more convenient for some users to have the definitions repeated in each part, there is a risk that the definitions would become inconsistent as parts are individually amended from time to time.

Comments on “escort”:

The ATA states that the term “escort” should not apply to employees temporarily without aircraft operator identification media.

The UPS and three airports state that the proposed definition of “escort” leaves too much room for interpretation. Airport commenters state that the phrase “sufficient to take action” is unclear. The FAA should add language that holds individuals accountable for being in direct physical control of persons under escort.

FAA response:

In consideration of the comments, the FAA has revised the definition of escort. The term “escort” now means “to accompany or monitor the activities of an individual who does not have unescorted access authority

into or within a secured area or SIDA.” This emphasizes the primary function of the escorter—to determine whether the escortee is limiting his or her activities to those authorized. If the escortee departs from authorized activities, the escorter would take action in accordance with the security program. This could include verbally challenging the individual, summoning a supervisor, or summoning law enforcement. The minimum requirements for the local design and implementation of escort procedures are set forth in new § § 107.201 and 107.205. Specifics as to where and how this method is to be applied will appear in individual airport security programs. As to the escorter being in “direct physical control” of the escortee, this phrase might imply a level of physical control that generally is not needed, such as the level of control a law enforcement officer exerts over a person they have arrested.

Comments on “exclusive area”:

Denver International Airport suggests that the definition of “exclusive area” include the concept that now individual access points can be designated as “exclusive areas.” The commenter also recommends adding “located anywhere on the airport” after the phrase “access points.”

FAA response:

The definition of “exclusive area” as proposed was intended to provide the regulated parties with the opportunity to transfer the accountability and responsibilities under part 107 from the airport operator to aircraft operators under parts 108 or 129. The definition as proposed expands the scope of the former definition, which allowed exclusive area agreements only for portions of the AOA. The new definition permits inclusion of portions of an AOA, secured area, and SIDA, which may include access points. For example, a part 108 regulated aircraft operator may now assume specific security responsibilities under part 107 for that portion of the secured area within its leasehold. The aircraft operator may also accept an exclusive area agreement with the airport for part 107 responsibility for any access point (for persons or vehicles) which leads directly into that portion of the secured area. Individual access points may be included in exclusive area agreements in the final rule. Further discussion of exclusive areas appears in response to comments relating to proposed § 107.111.

Comments on “sterile area”:

Several commenters, including three airports, requested that the FAA put the definition of “sterile area” in § 107.3 instead of referring the reader to part 108.

FAA response:

The definition of sterile area will remain in § 108.3, and will not be repeated in this part. As explained earlier, the FAA has decided to keep the definitions in the most applicable part, with cross-references showing that the terms apply to other parts as well. Section 108.3 states that the term “sterile area” means a portion of an airport defined in the security program that provides passengers access to boarding aircraft and to which the access generally is controlled by an aircraft operator or foreign air carrier through the screening of persons and property in accordance with the security program. The use of the term “sterile area” in part 107 is for descriptive purposes only.

Comments on “unescorted access authority”:

The Air Line Pilots Association (ALPA) and Juneau International Airport request a definition of “unescorted access authority.”

Another commenter says that the airport operator should be the only person authorized to grant unescorted access authority.

FAA response:

The FAA defines unescorted access authority as the authority granted to individuals to gain entry to, and be present without an escort in secured areas and SIDA's. The FAA disagrees with the comment that only the airport operator should grant unescorted access authority. It has been a longstanding practice for aircraft operators holding security programs under parts 108 or 129 to join with the airport operator in “exclusive area agreements.” The intent of such agreements is to transfer certain part 107 requirements to the aircraft operator, as specified in the agreement.

Additionally, it is a common practice for the airport operator to extend or broaden authorization for unescorted access to a class of persons. For example, the acceptance of a particular company's employee identification card, as airport-approved media, effectively extends to such companies the authority to determine who may have such privileges on a case-by-case basis. In each of these cases the airport operator has agreed to extend the privilege to the other party. The FAA believes that as long as a responsible party is empowered to extend that privilege under specific terms, the safety of the flying public can be ensured. Therefore, absent any compelling reasons to the contrary, the FAA will permit parties other than the airport operator to grant unescorted access authority within the constraints of this part.

Comments on clarification of definitions and new definitions:

Many commenters request clarification of the following terms: “media,” “vehicle,” “person,” “physical barriers,” and “law enforcement personnel.” Atlanta Hartsfield International Airport requests clarification of the term “person.” A commenter requests a definition of “physical barriers,” and recommends including time, distance, or signage in the definition.

The Monterey Peninsula Airport District comments that the FAA should define “law enforcement personnel” to consist of state certified police officers. Security guards should supplement, not replace police officers.

FAA response:

In response to comments regarding clarification of definitions or the use of new definitions, the FAA notes that it usually does not define terms that are used within their common, everyday meaning. For example, the terms “media,” “ground vehicle,” and “physical barriers” are not used in this rule in unique ways. There is no need to include definitions in the rule.

The term “media,” for instance, is used in a conventional sense to identify any means, materials, or techniques that identify an individual or vehicle or convey an individual's access or personnel identification authorization. In common usage, access media can include keys, magnetic cards, or other means to gain entry. In the case of identification media, § 107.211 provides additional standards for such media. The FAA used the term “physical barriers” in a conventional sense to include, for example, fences, walls, and buildings. The FAA has not used that term in the final rule, as discussed under Secured Area, AOA, and SIDA, above.

The word “person” is already defined in 14 CFR § 1.1. That definition is controlling with regard to part 107 so that there is no reason to repeat that definition in part 107.

Section 107.5 Airport Security Coordinator

The FAA proposed that existing § 107.5, “Approval of security program,” would be incorporated into proposed § 107.105, “Approval and amendments,” under proposed Subpart B, Airport Security Program. Existing § 107.29, “Airport Security Coordinator” would be revised and renumbered as new § 107.5 under new Subpart A, General.

The FAA proposed to further define the functions and responsibilities of the

ASC. The functions of the ASC were discussed in the Employment Standards Rulemaking (56 FR 41412 at 41417-8; August 20, 1991). The FAA also proposed that this section would clarify that an individual serving as an ASC may perform other duties in addition to those required by the FAA, and this need not be the ASC's only duties. It was the FAA's intent to clarify that the ASC requirements did not mandate that airport operators establish additional positions, the duties of which are exclusively security-related. Further, the proposed language was intended to clarify the relationship between the FAA and the ASC.

The FAA also proposed to require training for the ASC every 2 years to ensure that ASC's remain updated on both airport and aircraft operator security regulatory and operational requirements. The FAA requested comments on methods airport operators would use to meet this training requirement.

Lastly, the FAA proposed moving to this section certain provisions of existing § 107.31, recently effective (60 FR 51854; October 3, 1995), regarding the ASC responsibility to review and control results of employment and criminal history checks and to serve as the contact for individuals appealing their results.

Comments on ASC Functions:

(Proposed § 107.5(a) and (b)): Cheyenne Airport disagrees with incorporating specific functions and duties of the ASC into the rule. A detailed job description is redundant and unnecessary. Several commenters questioned whether there could be more than one ASC.

FAA response:

The FAA's general description of the functions of the ASC reflects the expectation that similar tasks are to be conducted at hundreds of individual airports across the nation. The regulatory framework is considered essential to ensure consistent and reliable understanding of the ASC's duties.

In response to the comments, the final rule clarifies that the airport must have one or more ASC's. This would allow different people to be on call at different times. The FAA anticipates the airport generally will designate a lead ASC, and others who will assist.

Comments on § 107.5(b):

One airline commenter says that proposed § 107.5(b)(2) should state that ASC's have contact with Federal Security Managers (FSM), who are FAA special agents, located at certain larger or more complex airports. Another commenter says that the ASC should have contact with the Aircraft Operator Security Coordinator (AOSC) and notes that AOSC's are to be designated at the corporate level.

Atlanta Hartsfield International Airport, Minneapolis Airport, the Port Authority of NY and NJ, Lincoln Airport Authority, and the Phoenix Aviation Department state that the requirement in proposed § 107.5(b)(3) to “review with sufficient frequency all security related functions” is vague and leaves a considerable amount of room for interpretation. Denver International Airport states that the phrase “airport tenant activities” in this paragraph needs to be defined.

The ACI-NA, AAAE, Atlanta Hartsfield International Airport, Miami International Airport, Tucson Airport, Metropolitan Washington Airports Authority, Capital Region Airport Authority, Lincoln Airport Authority, and Phoenix Aviation Department are under the perception that the ASC would “perform any duties deemed necessary” (proposed § 107.5(b)(7)). The commenters believe that this situation would be like leaving a “blank check” for the FAA to impose new duties and requirements on the airports; some commenters believe that this paragraph should be deleted and that any additional FAA directed changes should be coordinated and implemented under proposed § 107.107.

FAA response:

Regarding the airline comment related to § 107.5(b)(2) that the proposal should state that ASC's should have contact with the FSM, the FAA notes that FSM's are senior FAA civil aviation security specialists whose duties apply specifically to particular airports. Such airports are generally larger and more complex facilities. A FSM is the FAA's designated point of contact for the ASC's at such airports. If there is no FSM for that airport, another contact point from a FAA field office is given to the ASC. Hence, the FAA does not see a need to add or to modify proposed language in this regard.

As to requiring the ASC to contact the AOSC, the AOSC for the aircraft operator is designated at the corporate level, while the ASC is designated at the local airport level. It is not the FAA's intent to require that the ASC communicate with corporate aircraft operator personnel. Generally, the ASC can carry out his or her duties by dealing with their aircraft operator counterpart who is a local Ground Security Coordinator (GSC), as required under part 108. The FAA would prefer to leave the option to contact corporate offices to the airport operator, as it deems necessary.

Regarding § 107.5(b)(3), the FAA disagrees that the proposed language is unduly vague. However, the FAA also recognizes that the scope of airports' security-related functions vary greatly based upon the size and complexity of the markets served by the airport. The proposed language clearly directed the airport operator, through the ASC, to review security functions specified in such documents as the security program, tenant security programs, and applicable Security Directives. These documents are written to a high degree of specificity, and therein lie the details the ASC is expected to review. Hence, the language of the regulation is seen by the FAA to be at the appropriate level of specificity. Consequently, the FAA has chosen to retain in the regulation the broader language with an expectation that more specific requirements will be reflected in or flow from the individual security programs.

In response to Denver International Airport, the FAA notes it has removed the general phrase “airport tenant activities” from § 107.5(b)(3). This section has been rewritten to reflect the more specific mandate. The airport operator, through the ASC, must review with sufficient frequency all security-related functions to ensure that all are effective and in compliance with this part and the security program. The agency notes, however, that the security program may include tenant security programs, exclusive area agreements, and other implementing documents. The FAA believes a frequent review of the activities specified in and required by such documents will yield an appropriate level of airport operator oversight and local communications regarding security measures.

The FAA agrees with the many comments about proposed § 107.5(b)(7) that may have implied an unlimited ability of the FAA to add to the duties of the ASC through changes to the security program. Consequently, proposed § 107.5(b)(7) does not appear in this final rule.

Comments on § 107.5(c) Training Schedule and Hours:

Anchorage International Airport and Phoenix Aviation Department say that the FAA should host and pay for any ASC training. Port Authority of NY and NJ and Anchorage International Airport say that the FAA should provide initial ASC training and recommends that the AAAE perform recurrent training every 2 years.

The ACI-NA, AAAE, Cheyenne Airport, and Lincoln Airport Authority suggest that biannual training for ASC's at smaller airports is economically burdensome. These commenters add that attendance at training seminars for ASC's at smaller airports is difficult due to tight budgets and limited staff.

Two airports suggest that 180 days after publication of final rule is not sufficient time to be in compliance with such extensive training and recordkeeping and instead recommend a longer compliance date.

FAA response:

While the FAA disagrees that it should fund ASC training, it notes that such basic training on the civil aviation security program is available from several sources. For example, the FAA jointly sponsors basic training courses with several industry associations that could provide the ASC with requisite information. Such training, when supplemented with additional information necessary to understand local concerns, would prepare the ASC to carry out the locally defined duties.

The FAA believes that the amount of time necessary for an ASC to receive instruction on the security provisions relevant to their own location would be minimal. Consequently, the FAA does not believe that ASC training comprises an undue burden for any airport.

In response to the last comment above, the FAA accepts that 180 days may be insufficient time for airports to complete training for ASC's. Since training has not been required in the past, it must be developed and budgeted for. The final rule allows for 2 years following the publication date of the rule to achieve compliance with this requirement.

The FAA recognizes the many and valued services currently provided by the nation's ASC's. However, the FAA is also aware that there are inconsistencies in the level of knowledge and experience among ASC's. This variance stems from many factors, such as, tenure in the position, initial training (if any), the individual's current primary duties, and the individual's experience in the performance of ASC duties as well as the individual's background prior to assuming the position. Consequently, the FAA is convinced that baseline training is essential to ensure an adequate level of knowledge of the ASCs.

Therefore, this final rule does not allow for the grandfathering of ASCs as a means to avoid initial training. However, recurrent training is required for only those who have a break in service of 2 years or more during which time the person did not actively perform the duties of a designated ASC. Such persons would have to again take the training to resume ASC duties.

Comments on § 107.5(c) Training Guidance:

One airport states that the FAA should formulate guidance materials to clarify airport security issues, and make them available as part of the ASC training. Atlanta International Airport states that ASC training standards should be outlined in an advisory circular (AC) or proposed FAA rule. Lincoln Airport Authority and Port Authority of NY and NJ state that the ASC training curriculum, proficiency standards, and training materials should be developed by the FAA in cooperation with the industry.

Three airports state that the FAA should explain what the ASC training entails.

Two airports suggest that anyone performing in the capacity of the ASC 90 days prior to the effective date of the final rule should be “grandfathered” in and not be subject to the basic ASC portions of training. Furthermore, Tucson Airport states that the ASC is the most knowledgeable person at any airport and of the airport's security program and the FAA requirements and, therefore, the retraining of the ASC's basic job skills would be inefficient.

FAA response:

The FAA recognizes that the role of the ASC has been expanded. In that context, it is the agency's view that the ASC should be trained to a level of functional familiarity with parts 107, 108, 129, and 191, the airport's relevant operational manuals, the local emergency services support, the process which results in issuances of Security Directives, the security programs (to include contingency plans), and the respective rules and the means to communicate with all airport tenants, the FAA, Federal and local LEO's, and other emergency services.

Section 107.5 of the final rule outlines the duties and functions that the FAA expects the ASC to conduct in this regard. As the performance of those basic duties may vary in detail from airport to airport, the FAA does not anticipate issuance of an AC on this topic. However, the FAA will develop a suggested training curriculum, in coordination with the airport industry. The FAA expects that the training itself would not exceed 24 classroom hours, in most cases, and would average approximately 16 hours.

The FAA would expect the specifics of the training curriculum to be developed locally, in accordance with FAA guidance and local needs. The curriculum should and would be reflected in the security program.

Comments on § 107.5(c) Maintenance of Training Records:

A commenter states that where ASC's training records are maintained is a matter of legal guidance and operational preference. As long as those records are available for FAA inspection upon request, there is no need for the FAA to micromanage record maintenance. The Port Authority of NY and NJ recommends removal of language specifying that records are to be maintained in the principal operations office.

Atlanta International Airport says that training records and other documentation requirements will create unnecessary recordkeeping burdens.

FAA response:

The FAA has modified the rule so as to permit the airport operator to maintain the ASC training records in a location and manner of its choosing. Further, the FAA believes that the recordkeeping burdens would amount to no more than 30 minutes a year to document the training of each ASC. The FAA anticipates that a simple statement to the record that the ASC has completed training, as specified in the security program, with date and location, is acceptable. The FAA does not believe that this requirement is excessive.

Section 107.7 Inspection Authority

The FAA proposed to move existing § 107.7, “Changed conditions affecting security” to proposed Subpart B, § 107.107. In its place, the FAA proposed to insert § 107.7, “Inspection authority,” which included current § 107.27, “Evidence of compliance.” The proposed section would include the evidence of compliance requirements of existing § 107.27 and additional requirements based on the FAA's statutory authority to conduct inspections, investigations, and tests.

The FAA proposed that § 107.7(a) state the Administrator's authority to conduct inspections and investigations necessary to determine compliance with part 107 and the security program.

The FAA proposed that § 107.7(b) restate the language of existing § 107.27. Also, it was proposed that § 107.7(c) clarify the airport operator's obligation to provide FAA special agents the necessary access and identification media to conduct inspections. Significantly, this proposed requirement did not propose to require airport operators to provide access or identification media to any FAA employee other than special agents.

Comments on § 107.7(a):

Miami International Airport suggests referring to special agents as FAA “Security” Special Agents.

Atlanta International Airport, Alaska Airlines, and Missoula International Airport state that § 107.7(a)(3) should be removed and placed in part 108 as it relates to carriage of hazardous materials by aircraft operators. Another commenter believes part 139 adequately addresses hazardous materials on airports.

The RAA, UPS, ACI-NA, AAAE, the Port Authority of NY and NJ, Detroit Metropolitan Airport, Lincoln Airport Authority, Federal Express, Phoenix Aviation Department, Tampa International Airport, and Denver International Airport had concerns regarding the FAA's inspection authority. These commenters state that the phrase “at any time and place” is too broad and could subject aircraft operators to unreasonable and frequent intrusions into all aspects of operations by untrained FAA personnel. These commenters, including Atlanta International Airport, recommend adding the word “reasonable” at the beginning of the phrase. One commenter states that this section should be amended to limit access by FAA special agents to only those portions related to their duties. Another commenter says that FAA special agents should be allowed to access airport operational areas only after they have received appropriate local training to ensure that safety is not compromised (such as, local rules, vehicle markings, driver's training). The ATA suggests that the FAA modify § 107.7(a) and (c) to state that the FAA provide written notice of an inspection to the airport operator 24 hours prior to commencing it. Atlanta International Airport requests that the FAA inspector be required to inform the airport operator or ASC of the inspection results.

FAA response:

In response to the suggestion that the FAA refer to special agents as FAA “security” special agents, the agency notes that “special agent” is the correct term, and that “security special agent” is not a job title used in FAA service.

By statute, the Administrator is empowered to conduct inspections, investigations, tests, and other such duties as may be necessary to ensure the safety and security of the civil aviation system. Since performance of such inspections is not limited to special agents, it is conceivable that other FAA employees, from time to time, may be called upon to assist special agents in the performance of their duties on behalf of the Administrator. Therefore, to avoid confusion, the reference to special agents has been removed from § 107.7(a).

The FAA agrees with the commenters that hazardous materials inspections should be removed from part 107, however, it should not be placed in part 108. The FAA continues to have authority to inspect for violations of hazardous materials regulations, but its authority is based on different statute provisions than those for civil aviation security. Proposed § 107.7(a)(3) referred to determining compliance with 49 CFR part 172, which provides requirements under the Hazardous Materials Transportation Act. This reference has been removed from the final rule. Part 107 is devoted to civil aviation security issues. To avoid misunderstanding, reference to hazardous materials inspections is deleted.

With respect to concerns about the FAA's inspection authority, the Administrator is empowered to conduct such investigations and inspections as necessary to ensure the safety of civil aviation, under the statute. The statute, Title 49 USC Section 40113, does not restrict such activities by time and place, nor should they be restricted if the mission of the FAA is to be accomplished as effectively and efficiently as possible, and in the best interest of the public. Therefore, the FAA will not restrict its security-related activities through the regulation as suggested.

The FAA agrees with the commenters that the FAA is required to conduct its investigations and tests in a reasonable manner, but does not believe that the words “reasonable” should be added to the regulation. The wording used is similar to that used in a number of other FAA rules that have existed for years, including § § 119.59 (air carriers and commercial operators), 141.21 (pilot schools), 145.23 (repair stations), and 147.43 (aviation maintenance technician schools). The wording of these rules has not caused significant problems in the past. The FAA does not anticipate any change in its inspection procedures based on this new rule.

The FAA does not agree with the commenters who suggest that the access by special agents be limited in any way. The FAA has authority to conduct inspections and investigations throughout the airport property, wherever regulated activity is conducted. Any limitations placed upon FAA personnel acting on behalf of the Administrator could potentially hinder their ability to most effectively perform their assigned duties. Therefore, the final rule will not impose such limits.

As to the suggestion that the FAA provide advance notice of inspections, the FAA routinely notifies airport operators of scheduled inspections. This notice gives the parties to be inspected the opportunity to gather evidence of compliance and to arrange to have appropriate personnel available to assist the FAA. However, inspections related to a particular incident, or which are intended to be made without notice are necessary. Some inspections can only be effective if they are unannounced. Such considerations fall within the purview of the FAA's internal guidance and will not be addressed in this final rule.

Section 107.7(a) only provides for inspection by the FAA. Unlike the Notice, it does not refer to inspection by other Federal government entities. The FAA has no authority to grant or to deny inspection authority to another agency. The section was changed to avoid any appearance that the FAA was purporting to grant such authority.

Comments on § 107.7(b):

Tucson Airport requests guidance to foster consistency when providing “evidence of compliance with this part and its security program” as described in § 107.7(b).

FAA response:

Since its adoption, this provision has been intended to require airport operators to provide the FAA access to existing records.

See

56 FR 41412 at 41416 (August 20, 1991). Such records may vary from airport to airport, and are not the subject of standard guidance.

Proposed § 107.5(a) referred to the Administrator making inspections and tests, and § 107.5(b) referred to the airport operator providing evidence of compliance to the Administrator. The final rule adds the clarification that these include the FAA making copies of records or the airport operator providing copies. Obtaining copies of records is an inherent part of the FAA inspecting compliance with safety and security requirements. It is necessary to preserve the records for further review by the FAA. This is true for all FAA inspections, including those by FAA aviation safety inspectors (who look at compliance with operational and airworthiness rules) and FAA special agents. Often, the copying is done at the aircraft operator's or airport operator's office with their permission. Sometimes other arrangements are made, such as the FAA temporarily removing the records to copy them at a FAA office or a commercial service. The FAA has rarely encountered difficulty on this point, but includes these explicit statements in the final rule to avoid misunderstanding in the future.

This section refers to copying of records, not just documents. Records may be kept in a number of forms, such as paper, microfilm, and electronic. The special agent may request copies of any of these forms, usually by having paper copies made of the records. If another form is easily used by the special agent, he/she may accept records in that form.

New § 107.7(c) states that FAA personnel may gain access to the SIDA and other controlled areas without holding access or personnel identification media issued by the airport or aircraft operator, when

necessary to conduct an inspection or investigation. The FAA agrees that in most circumstances FAA personnel should comply with the access and identification requirements in place at the airport, and it has been FAA practice to require that, when practicable, FAA personnel first obtain local media before conducting inspections. However, there are times when the FAA cannot adequately inspect and test compliance if its employees first obtain access and ID media from the airport or aircraft operator. The act of obtaining such media may provide an opportunity for the FAA representative to be recognized by personnel at the airport, thereby reducing or negating the value of the inspection. The FAA sometimes must make unannounced tests by entering the SIDA or other areas without first having obtained such media. The FAA authorizes such tests only under very controlled conditions, using personnel who are trained to avoid creating a safety hazard or an undue security response. For instance, they carry their FAA credentials to display if they are challenged, to immediately establish their authority to conduct such inspections. This technique is intended to be used only when it is not practicable to obtain local media before the inspection, such as when making unannounced tests of the access and identification systems in place. Otherwise, the FAA representatives have the appropriate access and ID media.

Comments on § 107.7(d):

Atlanta International Airport states that proposed § 107.7(c) should be amended to delete the reference to “any FAA special agent.” The FAA should be required to designate a local point of contact to verify the need for local airport identification media. Commenters suggest it is difficult to maintain control and accountability of media issued to the FAA.

Juneau International Airport requests a description of valid FAA special agent credentials, as this information is currently not available.

The Port Authority of NY and NJ states that the display and wearing of an FAA special agent identification should be sufficient identification for unescorted access to any area of an airport which the agent has an operational inspection need.

The Sacramento County Department of Airports suggests that FAA special agents should have to go through the same identification media requests as an airport tenant. Ft. Wayne Airport suggests the FAA special agents should have to go through SIDA training to become familiar with the security program for which they are inspecting. Further, a commenter suggests the airports should charge reasonable fees associated with issuing airport identification media and providing SIDA training to FAA special agents.

Tucson Airport says that the Administrator should develop part 107 testing protocols that meet the FAA's needs without needlessly diverting resources to a “cry of wolf.” In a related comment, ALEAN states that it is unsafe for armed law enforcement officers (LEO's) to be running through airport terminals, believing that they are responding to an actual threat at the checkpoint when it is just a test. Such tests should be administered in the same manner that part 139 timed response drills are run.

FAA response:

In response to the comment about deleting reference to “any FAA special agent,” the FAA agrees, in part, with Atlanta International Airport, and others that the proposed language was broad. Any FAA special agent seeking local access and identification media, should have an operational need for the media, and the concurrence of the designated local FAA point of contact. The proposed rule stated that the media would be issued on request of the FAA special agent and presentation of credentials. As some commenters note, not all FAA special agents have duties and training to conduct inspections at the airport, and those agents do not need local media. The Administrator (usually through the local FAA field office) will provide to the airport or aircraft operator the names of special agents who require media.

In response to the request of Juneau International Airport, the commenter is welcome to request and to view the FAA special agent credentials in the possession of any special agent. They may contact the local FAA security office to view those credentials.

In response to the comment by the Port Authority of New York and New Jersey about the display and wearing of special agent identification, the FAA has addressed that under the new § 107.7(c). When exercising such privileges it is anticipated that the FAA employee acting on behalf of the Administrator will be in the possession of, but not necessarily displaying such credentials, as the situation may warrant. The circumstances under which this authority could be exercised include surveillance and unannounced testing or inspections.

Regarding the comment by the Sacramento County Department of Airports, the FAA acknowledges that appropriate safety and security-related training should be provided to FAA special agents before they exercise full access privileges to the secured areas and AOA's of the airport under normal circumstances. The aspects of such training that have common application can be provided at the agent's primary duty location and can be supplemented with local training at other airports requiring such training. This approach is in common use today, throughout the industry for those persons requiring similar access privileges. The revised § 107.7(d) addresses these concerns. However, in emergency situations or other initiatives, the responding agents may not have been provided the training or access media for that particular airport. The exigencies of their duties may require this access media, therefore, the language of the final rule has been modified accordingly. Where appropriate, coordination through the ASC or other local authorities would take place.

In response to the comment about allowing the airport to charge reasonable fees for issuing airport identification media, the FAA notes that nothing in the regulations would preclude the airport operator from imposing reasonable charges for its services. In fact, many already charge for initial identification media and issuance of replacements. Consequently, language permitting the airport to do so is not necessary in the final rule.

Regarding the comment about developing part 107 testing protocols, the FAA appreciates the complexity and sensitivities of the regulated parties' ongoing operations. The agency also understands both the importance and the impacts of its own operations, especially while conducting essential testing. These testing efforts will continue under the FAA's internal guidance. The agency will continue to be mindful of actual safety and security concerns during testing operations and will maintain dialog on this subject with the industry at the local and national levels.

The final rule states that the media must be issued “promptly.” The FAA expects that the media will be issued without undue delay, generally within a similar time frame that media are issued to airport, aircraft operator, and contractor employees who need the media. The particular procedures will be worked out at each airport with its FAA field office.

In response to ALEAN's comment, the FAA understands and concurs with the proposition that safety in testing is essential. The FAA also believes that testing of a law enforcement response differs in some aspects from testing

firefighting and other emergency responses. For example, the latter services tend to be more focused on a more specific range of duties and generally operate from a fixed position. Law enforcement response is a resource with numerous missions unrelated to civil aviation security as addressed in this rule, and which can take it away from the immediate vicinity of the passenger screening facilities. As such, the law enforcement response can originate from anywhere, but must arrive at a designated location within a given timeframe. The FAA recognizes that testing of the law enforcement response must be conducted as judiciously and as safely as possible. Often, that can be accomplished with full disclosure in advance to the law enforcement agency. The FAA will continue to share ALEAN's concerns with its special agents but does not believe it appropriate to modify any portion of part 107 in this regard. Instead, such concerns will be addressed through the FAA's internal guidance and in keeping with the missions of both the law enforcement entities involved, the airport operators, and the FAA.

Section 107.9 Falsification

The FAA proposed a new § 107.9, entitled “Falsification.” This section is the same as the current § 107.2 adopted on November 27, 1996 (61 FR 64242, December 3, 1996).

Comments:

The UPS and Atlanta International Airport request an outline of the enforcement procedures and guidance to the airport operators for falsification findings. The commenters say that the airport operator should be informed of all investigations and be provided a copy of the report of findings.

The UPS, Port Authority of NY and NJ, Detroit Metropolitan Airport, and Lincoln Airport Authority say that it should be stated that persons are directly accountable to the FAA for compliance with this regulation, including federal enforcement procedures and fines.

FAA response:

Enforcement procedures are contained in 14 CFR part 13 and in FAA order 2150.3A. There is no need to repeat the procedures in part 107.

Section 107.11 Security Responsibilities of Employees and Other Persons

In this section, the FAA proposed to prohibit persons, as defined in part 1, from tampering or interfering with, compromising, or modifying any security system, or attempting to do so. It also proposed to prohibit carrying a deadly or dangerous weapon, explosive, or destructive substance into sterile areas, critical security areas, or restricted operations areas.

This section proposed the use of civil penalty actions to penalize persons, those employed by the airport operator and those not under the direct authority of the airport operator (such as trespassers), who fail to comply with this section.

The FAA proposed in § 107.11(c), that individuals authorized by the Federal government, airport operator, and aircraft operators would be allowed to conduct tests and inspections of security systems.

The FAA proposed in § 107.11(d) that provisions of this section that apply to firearms and weapons would not be applicable to law enforcement personnel, Federal Air Marshals, and certain individuals authorized in a security program to carry a weapon.

Comments on § 107.11(a):

Atlanta International Airport and Roanoke Regional Airport request an outline of the enforcement procedures and guidance to the airport operators for noncompliance by individuals. The enforcement concept requires more explanation. The airport operator should be informed of all investigations and be provided a copy of the report of findings.

Port Authority of NY and NJ is concerned that the majority of enforcement of Federal responsibilities are placed on the airport. The Port Authority holds that the FAA should not be unique among Federal enforcement and oversight agencies in abdicating its enforcement responsibilities.

Burbank Airport Authority suggests that civil penalties should be up to $10,000 on a case by case basis, rather than $1,000 as stated in the preamble.

The UPS, RAA, Federal Express, a local department of aviation, Miami International Airport, and many other commenters support the adoption of proposed regulations which would require individual accountability to the FAA and use of civil penalties and enforcement actions against employees, contractors, and other individuals.

The ACI-NA, AAAE, and an airport suggest language stating that failure to comply by an individual will result in revocation of privileges, application of fines, or other punitive action by the Administrator. They also suggest language stating that this rule would not prohibit State or local governments from adopting similar or more stringent regulations for local enforcement. On the other hand, ALEAN suggests that the NPRM is a superficial and impractical attempt to solve a lack of personal accountability and responsibility.

FAA response:

The enforcement procedures are found in part 13, Investigative and Enforcement Procedures, and FAA Order 2150.3, Compliance and Enforcement Program.

In further response to ACI-NA and AAAE, the FAA does not believe there is a need for the agency to insert language stating that the rule would not prohibit State or local governments from adopting similar or more stringent regulations. Many State and local governments are currently permitted to adopt similar or more stringent security rules within the context of their respective jurisdictions. Many have already done so. Airport operators are primarily responsible for the security and safety of their airports, both for civil aviation security and other security issues they encounter. As part of this effort, they adopt rules and procedures to gain compliance of their employees, contractors, tenants, and others with safety and security rules. Absent very unusual circumstances, State or local governments are free to adopt penalty provisions to promote compliance.

In response to UPS and other supporting comments on individual accountability, the agency wishes to emphasize an increased reliance on individual accountability, particularly with regard to a person's interaction with security measures. But, at the same time, the agency also emphasizes that the airport operator and aircraft operator are responsible for ensuring that their employees, contractors, and others comply with security duties. The FAA agrees with ALEAN that this section is not, standing alone, adequate to address all issues of individual compliance with security rules. It is intended to serve as another tool to assist the airport operators, aircraft operators, and others to emphasize the responsibility of individuals and other persons to do their part.

Proposed § 107.11 outlined provisions of the regulation for which individual accountability would attach. However, aside from the merits of this proposal, much attention, as reflected by the comments, seemed to focus not on § 107.11, so much as on the related impact of proposed § 107.103(a)(2). This language would have required the airport operators to establish and carry out an enforcement program to hold persons in violation of the program accountable at the local level. As discussed above, the comment period was reopened for that provision.

Burbank Airport Authority sought an increase in the amount of civil

penalties. The maximum civil penalty is set by statute, however, as to individuals in these circumstances, the amount is $1,100 (adjusted for inflation since Notice 97-13 was issued).

The FAA notes that the circumstances surrounding a single security violation may involve more than one responsible party. For example, if an employee circumvents an access control to a secured area, and gains unauthorized access to an aircraft, that person can be held individually responsible for his/her actions under new § 107.11(a). At the same time, the airport operator may be responsible for failure to control access to the secured area under new § 107.201(b), and the aircraft operator may be responsible under part 108.

This rule will also have the effect of prohibiting some unauthorized testing if it violates § 107.11. The unauthorized testing of security systems may be a form of compromise, circumvention, or interference. An example is a person who is not authorized to be in the secured area without escort, but who deliberately enters the secured area without escort. Many of these actions may serve to distract unnecessarily security or law enforcement resources from their duties, increasing the risks from actual threats. Such unauthorized “testing” of security systems can prove dangerous to the “tester” (such as if they are not aware of the safety issues in the AOA, with taxiing aircraft and other hazards). The final rule language is consistent with this position, and can be cited in holding accountable persons who conduct such unauthorized activities.

Comments on proposed § 107.11(b):

Anchorage International Airport states that § 107.11(b) seems appropriate for what is now known as the “sterile area” or “secured areas” of the airport, not for areas that are currently known as the “restricted areas.”

Miami International Airport and TWA state that § 107.11(b) should clarify that compliance with this section rests on the individual and not the airport.

Roanoke Regional Airport states that § 107.11(b) does not recognize that construction contractors may need to bring explosives into secure areas of the airport.

The Port Authority of NY and NJ, Northwest Airlines, and Detroit Metropolitan Airport question the means by which the airport can ensure that no person will have “any deadly or dangerous weapon, etc.” without screening all employees. Several commenters request clarification of “deadly or dangerous weapon” and “other destructive substances.”

The ATA, UPS, and Federal Express strongly object to the imposition of screening procedures for employees at access points controlled by proposed § 107.205, and to rescreening of employees who have access clearance from the airport to enter secured areas.

FAA response:

In the proposal, the agency sought to provide a means by which unauthorized persons carrying deadly or dangerous weapons, explosives, or incendiaries into the secured area could be held liable under the agency's compliance and enforcement program. The proposed language provided for persons who would have to carry such items into the secured area in the course of their authorized duties. After careful review, the agency has determined that local airport operators, through their local rules and laws, and law enforcement personnel, have the responsibility, authority and the capability to control the presence of weapons and other deadly items on airport property. Hence, there does not appear to be a need to introduce any new rulemaking regarding this issue at this time. The FAA has decided not to adopt proposed § 107.11(b), as well as the related language under § 107.11(c). Over time, the agency will monitor any incidents relating to persons carrying unauthorized weapons or deadly or dangerous items that may be detrimental to the flying public and if warranted, will develop comprehensive security measures.

Section 107.101 General Requirements

The FAA proposed this new section to incorporate related provisions of the existing regulation that require the security program to be current and in writing, and that a copy be kept at the principal operations office. The program's objective was proposed to be modified to include protection against the introduction of a deadly or dangerous weapon, explosive, or incendiary onto aircraft.

In the preamble, the FAA noted its intention to develop a standard airport security program, similar to the air carrier standard security program.

Comments:

The ATA and Tucson Airport request that if the use of a standard airport security program is to be a mandatory requirement, then the airports should be given an opportunity to review and comment on its contents and application effects, prior to implementation. The additional time would provide consistency of airport and aircraft operator security programs and benefit the passengers, baggage, and cargo processing. Any policy directives for the model program should also be made available for review and comment.

FAA response:

Upon review, the FAA has determined that it will be easier, less disruptive, less expensive, and equally effective to not develop a standard security program, but to modify the language of § 107.101(a)(4) to require that airport security programs include an index, arranged according to the order of subject areas cited in § 107.103. This requirement will preclude the need for major security program modifications. The FAA is also convinced that an index in each security program, arranged in accordance with this standard format, will moderate significantly the FAA's difficulties associated with overseeing the hundreds of vastly different security programs across the nation. The final language has been modified to that end.

Comments on § 107.101(a):

Atlanta International Airport states that proposed § 107.101(a) should be written to reflect that airports are responsible for the safety and security of persons and property while at the airport. Roanoke Regional Airport states that the aircraft operator must be responsible for the security of persons and property onboard the aircraft.

Continental Airlines requests that § 107.101(a)(1) be clarified to exempt passenger checkpoint screening responsibilities from the security programs.

FAA response:

The FAA believes that the delineation of authorities, for example the screening of passengers or the provision of law enforcement response, are properly assigned based on statute, regulation, reasonable attachment of liability, and the authority possessing the appropriate resources. The term “on an aircraft operating in air transportation in air commerce” reflects that the mandated measures in the statute at airports are ultimately in support of the security of person on board aircraft, and are not designed to address other security concerns. The proposed language was included because some of the airport's tasks do include support of the screening function, which prevents the introduction of weapons, explosives, and incendiaries on an aircraft.

Federal law assigns solely to aircraft operators the responsibility for passenger screening. That law cannot be overcome by regulation. Rather the intent of § 107.101(a)(1) is to emphasize the airport operator's role in supporting the screening system in cooperation with aircraft operators.

Comments on § 107.101(b):

Atlanta International Airport, Tucson Airport, Minneapolis Airport, Port Authority of

NY and NJ, Detroit Metropolitan Airport, and Lincoln Airport Authority state that the “principal operations office” may not be the appropriate area to store the security program. Denver International Airport believes that specifying the storage location of the security program is not necessary and that making the security program available to the FAA for review upon request should be sufficient. However, requests from the FAA to review the security program should be made through the ASC.

FAA response:

Upon reflection, the FAA agrees with the commenters. The rule language has been modified to delete reference to the “principal operations office.” Instead, the airport operator is required to maintain at least one current and complete copy at the airport and to provide a copy of the security program to the Administrator upon request. In most cases, the ASC required under new § 107.5 would be the primary contact for such requests.

Section 107.103 Content

The FAA proposed this new section to describe the required content of the security program. The proposed rule specifies three different levels of security programs varying in complexity. The most comprehensive security program would continue to be applicable to airports serviced by scheduled passenger operations on aircraft with more than 60 seats.

The type of passenger operations that trigger the two remaining types of security programs have been expanded somewhat, as the result of changes to part 108. The intent is to ensure complete protection of the sterile area and to ensure security of passengers.

Comments on proposed § 107.103(a)(1):

Atlanta International Airport, Missoula International Airport, and Phoenix Aviation Department request removal of the requirement to outline the ASC's training. Training requirements should be provided in an advisory circular (AC), not the security program.

Juneau International Airport requested the FAA explain what the training requirements for ASC's and alternates are under § 107.103(a)(1).

FAA response:

While ASC training has been addressed in the discussion of § 107.5, it seems appropriate to address the administrative aspect of the ASC training program requirements here. The FAA disagrees with comments submitted by the Atlanta, Missoula, and Phoenix airport authorities that the ASC training requirements should appear in AC's. Rather, the agency believes general training mandates appearing in the regulation must be clearly defined and required under specific language appearing in nonpublic security programs. The agency notes that the guidance in AC's is not mandatory. The proposed language is adopted without change.

Comments on § 107.103(a)(2):

Numerous comments were received on the proposal to require each airport to have a security compliance program.

FAA response:

As explained above under General Discussion of the Rule, the comment period on this section was reopened. The FAA will respond to all comments in a later action. The comments recounted here are only a representative sampling of the many comments received in response to proposed § 107.103(a)(2). Yet, since the close of the comment period, the FAA has become aware of shifting views by many of the same parties with regard to this and related issues. Therefore, the FAA has reserved decision on proposed § 107.103(a)(2), and reopened the docket for comments on August 10, 1999. The new comment period closed on September 24, 1999. The FAA will consider the comments received and consider what action, if any should be taken on this proposal.

Comments on § 107.103(a)(3)-(20):

Five airports suggest that the FAA replace the word “dimensions” in § 107.103(a)(3)(i) with “general description.” A general description or a map would provide sufficient details of the areas. Information about the dimensions of the map should be delegated to appendices and not subject to FAA approval. Ft. Wayne Airport says that a scale map or diagram has been and should be sufficient to delineate these areas. If the FAA needs more detailed information, it should state the reason behind the requirement and include costs associated with calculating the dimensions of these areas into a cost benefit scenario. Quad City International Airport states that detailed map-making is a costly undertaking.

Denver International Airport and Port Authority of NY and NJ recommend modifying § 107.103(a)(5) to state “sterile areas with direct access to the critical security area.” Only those activities with direct access to secured areas in the NPRM from the sterile areas should be listed.

Another commenter recommends deleting any references to “sterile areas” in proposed § 107.103(a)(5) and throughout part 107 since the term is not defined.

Tucson Airport states that the following information should be outlined in an appendix, not included in the body of the security program: The system for maintaining records and the schedule for reporting them required by proposed § 107.103(a)(12), the contingency plan required by proposed § 107.103(a)(14), the exclusive area agreements required by proposed 107.103(a)(19) and the tenant security agreements required by proposed § 107.103(a)(20).

One commenter states that the incident and emergency management procedures, required by § 107.103(a)(17) are adequately covered for airports complying with part 139 programs. A reiteration of these procedures would be redundant and a cross-reference to the part 139 emergency plan should be sufficient.

FAA response:

The FAA disagrees with the commenters that a “general description” rather than “dimensions” would suffice in describing various aspects of the airport in the security program. The FAA believes that the exact dimensions and boundaries, as required in the security program, are necessary to clearly establish where various security measures are required at different locations on the airport. With the advent of the tenant security program (new § 107.113), and the possible increased reliance upon exclusive area agreements (new § 107.111), this requirement becomes increasingly important. The detailed descriptions are necessary so that all parties are aware of what security procedures apply in what areas, and which party is responsible for carrying out those procedures. At the same time, the FAA does not expect the airport operators to generate detailed maps drawn specifically for this purpose. Rather, existing maps used for engineering and maintenance at most airports are usually acceptable and are in common use today. The wording remains the same. If an airport has a method of clearly identifying the boundaries of the areas without using dimensions, it may request to use that method.

In considering the comments that stated that only sterile areas leading to critical security areas (now secured area) should be detailed, the FAA notes that while most sterile areas have access points leading directly to secured areas, that condition may not be the case universally. Further, there are other considerations besides access to secured areas that forces the FAA to require that such details appear in the security program. Lastly, the FAA does not accept the suggestion to delete the term “sterile area,” since it is not defined in this part. It is defined in the final rule

to part 108, in § 108.3, and is a commonly used and understood term.

A security program may be structured in the manner suggested by the Tucson Airport by incorporating information appearing in program appendices. New § 107.103(d) (and current § 107.3(c)) provides for including information in an appendix.

As to the comments regarding proposed § 107.103(a)(17) regarding incident management (new § 107.103(a)(18)), the FAA wishes to emphasize that the requirement speaks to the evaluation of a threat, rather than to a response to an actual incident as referenced in § 139.325. The level of response to a threat is tied to the evaluation of that threat, which is a different process than responding to an actual highjacking or other event in progress. Evaluating which threats call for what type of response is a security issue, best handled under part 107. It may involve evaluation of non-public security information.

Comments on § 107.103(b) and (c):

Minneapolis Metropolitan Airport states that the procedures for public advisories required by § § 107.103(b)(7) and 107.103(c)(6) (i.e., that a foreign airport has, in the judgment of the Secretary of Transportation, failed to maintain and administer effective security measures (new § 107.305)) should rest with the aircraft operators, that should be responsible for informing their passengers. This should not be an airport operator responsibility.

FAA response:

The requirement to provide public notification that a foreign airport has been determined to have failed to maintain or carryout effective security measures, is found in the Section 44907(d)(ii), Title 49, United States Code. The FAA believes the requirement to prominently post the identity of such foreign airports at all U.S. airports having regularly scheduled aircraft operator operations is best accomplished at each U.S. airport by a single entity at each location. For consistency's sake, the FAA has determined that the airport operator should be responsible for the posting of this information. The law also requires aircraft operators serving the subject airports to notify their passengers of the foreign airport's status. With this dual requirement, the FAA believes all persons using the airport, and those using the specified carriers, will have ample warning before risking travel to a location that the Secretary of Transportation has determined lacks effective security measures.

Comments on § 107.103(d):

Tucson Airport asks whether the FAA would allow inclusion of an airport's part 139 emergency plan in the appendix as sufficient compliance with this rule.

FAA response: Regarding placement of the part 139 emergency plan in the security plan as an appendix, the FAA notes its previous comments, above. It has no objections to this method where the plans are mutually supportive and meet the requirements of the respective parts. However, the FAA's civil aviation security organization's review and approval process of the security plan may employ different criteria than the reviews under part 139, for the review of the emergency plan. Simple inclusion in the security plan without the opportunity for the FAA's civil aviation security organization's review and approval on a case-by-case basis would not be acceptable. Additionally, only those limited portions of the emergency plan with direct relevance to security concerns should be incorporated into the airport security plan.

Section 107.105 Approval and Amendments

The FAA proposed to combine existing § § 107.5, 107.9, and 107.11 into a new section, proposed § 107.105. Several changes were proposed to the amendment process itself. Proposed § 108.105 prescribed the same approval and amendment procedures for aircraft operators.

Throughout this proposed section, any references to the “Director of Civil Aviation Security” were replaced with “Assistant Administrator.” Also, time restraints on filing petitions for reconsideration of the FAA's decision were included for airport operators. Specifically, § 107.105(a)(2) proposed that airport operators submit to the Administrator a petition for reconsideration within 30 days after receiving the notice to modify. Proposed § 107.105(a)(2) included the provision in current § 107.11(c) that the filing of a petition would stay the notice to modify pending a decision by the Administrator. Section 107.105(a)(3) proposed that the Administrator disposes of any petition within 30 days of receipt.

Section 107.105(b) prescribed procedures for an airport operator to request an amendment to its security program currently covered under existing § 107.9. The FAA proposed to increase the number of days prior to the effective date that the airport must submit its proposed amendment from 30 to 45 days. The proposed rule also noted that the amendment process may take longer than 45 days if the proposed amendment was modified or denied.

Existing § 107.9(b) states that the FAA will respond to an amendment proposed by the airport operator within 15 days. The proposal extended this time period to give the FAA 30 days after receipt for approval or denial of the proposed amendment.

In proposed § 107.105(b)(4), the FAA proposed to modify existing § 107.9(d) to limit the time that an airport operator may petition the Administrator to reconsider the denial to 30 days.

Retention of the FAA's existing procedures to amend a security program was proposed in § 107.105(c) and (d). Two significant changes, however, were proposed to the existing procedures of § 107.11: (1) A new requirement for airport operators to submit petitions for reconsideration no later than 15 days before the effective date of the amendment, and (2) a clarification that a petition for reconsideration stays the effective date of the amendment, unless the emergency procedures are used.

Comments:

Miami Airport states that there must be procedures in place to ensure that amendments are not sent into an abyss which is created by returning the amendments to airports repeatedly for rewrites, or with general disapproval language that does nothing to aid the airport to satisfy the FAA's objective. Another commenter states that as written, this section leaves the airport with the feeling that there will be even longer delays to requests from airport for items that are essential to airport operations.

FAA response:

The FAA agrees with the proposition that amendments, when submitted by airport operators, must be handled in a timely manner and in good faith. They must be submitted in the same manner. In practice, the complexity of any given amendment and the differences between the respective positions of the FAA and the airport operator will determine how often the amendment is handled and how long the process will take. The regulatory language appearing in the final rule attempts to place good faith constraints upon the parties, but recognizes that the exigencies of business as well as other factors often preclude strict adherence to deadlines. It is, therefore, in the mutual interest of both the operator and the FAA to work closely to agree upon amendment language that has been submitted as completely and in the most timely manner possible.

Comments on § 107.105(b):

Several commenters suggest that this section should be amended to require the FAA to acknowledge receipt of an airport's proposed amendment within 5 business days. Within 30 days of receipt, the FAA should either approve or deny, in writing, the proposed amendment. One

commenter had submitted a proposed amendment to the FAA with no action for 11 months.

One commenter states that the submission of amendments to the Administrator presents problems, since airports dissatisfied with local FAA replies, could submit their requests to Washington.

Another commenter suggests that the FAA's civil aviation security field units (CASFU) should be required to review and return comments to airports within 120 days after receipt of an airport-submitted security program amendment. The FAA personnel should be required to approve and return the final security program to the airport for initiation and distribution to the necessary parties, within 60 days after any required resubmission by the airport of the final version of the security program.

The ATA and Anchorage International Airport oppose increasing the time for the FAA to approve an amendment request for either an airport operator or an aircraft operator and recommend that the FAA expedite the amendment process.

The ACI-NA and AAAE oppose the changes to the amendment procedures that impose more stringent deadlines on the regulated parties and relax the time burden on the FAA. These commenters recommend a modification to the rule that would require the airport to submit the amendment 30 days prior to the proposed effective date. Then, the FAA would have 15 days after receipt to approve, deny, or question the amendment, after which the airport operator would have 15 days to respond to the FAA's request.

FAA response:

The FAA agrees that the airport operator is entitled to an acknowledgement of receipt of a proposed amendment. The FAA does not believe that this issue needs to be resolved through the regulation, since the airport operator can have the amendments hand-delivered, or sent via return receipt mail.

Also, the agency has noted elsewhere that references to the Administrator are to be interpreted as referring not only to that office, but to a subordinate level of the civil aviation security chain-of-command. This level would include the Assistant Administrator and the subordinates to whom he has delegated program authority, as noted in § 107.1(b).

As noted above, the FAA concurs that the expeditious handling of amendments is essential, and that every effort is made to ensure their timeliness. The agency will strive to meet that commitment.

The agency has carefully considered the time constraints the regulation will place upon all parties to the amendment and the approval process. The FAA has decided to implement a timeframe that it believes is fair and equitable when approached by all parties in good faith. It should also be noted that, in practice, the regulated parties have often requested amendments for activities that were to take place much sooner than the regular amendment process call for. The FAA often handles these on an expedited basis.

The FAA also notes that exclusive area agreements under § 107.111(b) and tenant security programs under § 107.113(a) may be terminated at any time by the FAA if it is determined to be in the interest of security and safety.

Comments on § 107.105(d):

Miami International Airport, Lincoln Airport Authority, Federal Express, and Denver International Airport support the ASAC recommendations that Emergency Amendments be issued to the airport program with expiration dates.

Tucson Airport and Port Authority of NY and NJ state that FAA Emergency Amendments should be “sunsetted” 180 days from date of issuance if not canceled sooner. The 180-day constraint would not preclude reissuing of the Emergency Amendment, but would build in a review of the propriety and effectiveness of measures to be implemented.

One commenter states that there should be some provision to allow for local modifications to the FAA amendments.

Sacramento Department of Airports states that the current practice of policy memoranda should be discontinued. While there are instances where changes must be issued immediately, in memoranda, these memoranda should be followed up by the FAA within 30 days from the official regulatory change.

FAA response:

The comments received in response to this section dealing with “Emergency Amendments” illustrate the different practices that have developed. In its original context, “Emergency Amendment” was used for exigent and permanent change to the basic individual airport's security program. It also has been used much like the Security Directive process available for several years to aircraft operators under § 108.18, that is, an amendment issued to address time critical threats that are expected to have a limited duration. Depending on the nature of the threat upon which the Emergency Amendment was based and the measures imposed, an expiration date was either set or left “indefinite.” But, in either case, the directive nature of the Emergency Amendment was focused on a specific threat, ostensibly with a finite period of applicability.

The final language of this section is intended to return this process to one in which permanent changes to the actual security program are made based upon such emergencies as may arise. Response to certain threats of finite duration, that were formerly handled by Emergency Amendments, now may be addressed in the new § 107.303, Security Directives and Information Circulars. The agency now intends for Emergency Amendments to security programs to be used for exigent changes made to the individual security program, on what is expected to be a permanent basis.

The FAA wishes to assure the regulated parties that it does not issue security program changes through policy memoranda. While memoranda are used for the FAA's internal guidance regarding ongoing programs and enforcement policies for existing requirements, the Emergency Amendment process under § 107.105(d) will only transmit Emergency Amendments to airport operators under cover memoranda. In many cases, where temporary emergency measures subsequently have become part of the baseline, those changes have been proposed through the normal process, with comments invited and considered before any final determination had been made. The FAA has become increasingly sensitive to the airport operators' concerns in this regard, and will continue to follow that practice under the new § 107.105, and as will be noted later, § 107.303.

Section 107.107 Changed Conditions Affecting Security

Proposed § 107.107 would expand the types of changed conditions that would require operators to take corrective actions. It would expand the scope of the requirement to encompass all the elements of the security program to ensure that any changes that may impact security would be reported to and addressed by the FAA as soon as possible.

As proposed, the airport operator would be required to report any changes in the physical layout of the airport, both areas relating to airport operations and aircraft operator operations. The proposal would augment the existing procedures for the airport operators to follow when a changed condition occurs by requiring the airport operator to initially notify the FAA within 2 hours, or within an approved timeframe, of the discovery of any changed condition that

could affect how an airport complies with regulatory requirements.

The proposal would require the airport operator during this initial notification to obtain verbal approval of any interim measures to be taken to maintain adequate security. The proposal would continue to allow the FAA to issue emergency security program amendments under proposed § 107.105(d) if an agreement on adequate interim measures could not be reached. However, the proposal provided relief in responding to short-term changes.

Proposed § 107.107(c) and (d) would require the airport operator to follow certain procedures to amend its security program to reflect the change. For changed conditions under 60 days' duration, § 107.107(c) proposed that the airport operator be relieved from the amendment process required under proposed § 107.105 and only be required to provide written notification within 72 hours for FAA approval. Recognizing that many changed conditions affecting security can be readily resolved in less time than it would take to complete the formal amendment process, the FAA sought this change to provide some relief in reporting short-term or temporary changes while ensuring that the FAA retains oversight of temporary or short-term changed conditions to security.

Proposed § 107.107(d) would provide procedures for the disposition of changed conditions anticipated to be over 60 days in duration.

Comments on § 107.107(a):

Atlanta International Airport, among others, stated that the airport operator cannot be held accountable to notify the FAA of changes of aircraft operator operations, level of services, and aircraft. Miami International Airport and Ft. Wayne Airport state that this requirement would be more appropriate in parts 108 and 129.

The CALA states that changes should only include things as airport perimeter and structural redesigns, relocation of screening checkpoints, and redefining of airport secured areas. Miami International Airport, Port Authority of NY and NJ, and Lincoln Airport Authority state that the layout and physical structure (§ 107.107(a)(3)) can change frequently during construction. An overall construction plan should be submitted to the FAA, but not a constant series of notifications about the changes.

The ATA requests very clear criteria as to what “changed conditions” are, to satisfy the notification requirement. Denver International Airport suggests that “changed conditions” should be limited to conditions that have a serious and continuing impact on security. Furthermore, it was stated, the FAA did not consider the cost associated with personnel staff changes and equipment requirements for scheduling notification to comply with the newly revised notification requirements.

FAA response:

In response to these comments, the FAA would like to clarify that its intent is that the only changes which need to be reported are those that cause the airports to be out of compliance with the provisions of part 107 or the FAA-approved security program, at the time the changed condition occurs. Furthermore, this section is not intended to include all construction projects, only those that impact its security program, such as access, movement control functions, and its support of passenger screening checkpoints. The language of the final rule has been modified to more accurately reflect that position, and to provide greater latitude to the airport operator insofar as the required timeframes for reporting changes that impact its compliance posture.

Comments on proposed § 107.107(b):

Thirty-four airports, two local governments, a State government, six local departments and commissions of aviation, two airlines, and UPS suggest that a 2 hour initial notification of changed conditions is unnecessary and an arbitrary timeframe. These commenters state that the FAA does not seem prepared to handle the information overload for after-hours, weekend, and holiday occurrences when it is anticipated that FAA field reps would not be available to receive such information. These commenters recommend that the requirement to verbally contact the FAA should apply only to changes that seriously impact security and only as soon as practicable (such as within 24 hours of discovery by the airport operator). The option to provide this information electronically should be considered (such as e-mail and fax). On the other hand, ACI-NA and AAAE recommend that notification should occur within 48 hours. ATA suggests deleting this section because it lacks clear definition.

FAA response:

The FAA agrees that a 2-hour initial notification of changed conditions may not be an acceptable timeframe. To provide some flexibility to the operators, this section has been modified to provide that notification be made within 6 hours of discovery or other timeframe for notification to be established in the individual security program. Further, while FAA field offices are not open 24 hours a day, telephone notification can be made to alternate contact numbers for field office staff.

Section 107.109 Alternate Means of Compliance

The FAA proposed this new section to provide relief for small airports located in communities that are only served by seasonal air carrier operator or foreign aircraft operator traffic (such as ski resorts), remotely located, subject to extreme environmental conditions, or have limited facilities and few employees. Often these airports serve aircraft larger than 60 seats for only a portion of the year, or on an infrequent but regular basis. This section would permit the FAA to approve airport operators of such airports to use alternative means to comply with the requirements of the rule. To petition for relief from part 107 requirements, larger airport operators would still have to use the exemption process under existing § 11.25, Petitions for rule making or exemptions.

Comments:

The FAA received some comments regarding unique alternate measures at specific airports.

FAA response:

Alternate measures at specific airports must be considered case-by-case and questions regarding them cannot be resolved in this rulemaking.

Section 107.111 Exclusive Area Agreements

Proposal:

The notice proposed that the Administrator may approve an amendment to an airport security program that permits an air carrier or foreign air carrier that has an approved security program under part 108 or part 129 to assume responsibility for specified security measures for all or portions of the critical security areas or restricted operations areas. The exclusive area agreement must be in writing and must include all of the necessary information, as indicated in the NPRM, to be considered complete.

Comments:

A commenter recommends that regulated entities be held responsible for the activities of their unregulated contractors, permitees, invitees, etc. The ALPA and RAA comment that the FAA should allow exclusive area agreements to be developed, which create joint liability and responsibility for the airlines involved. The RAA notes that this requirement could take the form of a consortium to share responsibilities.

Roanoke Regional Airport states that if the airport is conducting the “monitoring and auditing” to ensure compliance, then no “responsibility” transfer has occurred and such an

“exclusive lease” for that purpose would be meaningless.

The ACI-NA and AAAE propose new language stating that the FAA may unilaterally revoke the agreement and descriptions of punitive actions that may be imposed on the aircraft operator or its employees by the FAA for violations of security regulations.

The ATA believes that no security requirements other than those agreed to by the parties to the agreement should be mandated.

One airport asks if the carrier's leasehold agreement could serve as the binding document for exclusive areas. If not, specific guidance for exclusive area agreements should be provided in an AC.

The Port Authority of New York and New Jersey and the city of Phoenix request that the words “or one entity” be added to § 107.111(a) after the phrase “foreign air carrier,” to allow air carriers to form a consortium or a corporation, like fuel farms and other enterprises operating international terminals. Shared responsibility should be allowed, but only when there is a legal entity established as the responsible party to ensure that the FAA has the ability to enforce the regulations.

FAA response:

The FAA agrees that regulated entities are responsible for the actions of their unregulated contractors. The regulation provides for this concern by not excluding the regulated entities from such responsibilities. Hence, the FAA does not believe it is necessary to modify the proposed language in order to respond to the comment. The fundamental responsibilities for compliance with this part rest with the airport operator or on an aircraft operator or foreign air carrier under an exclusive area agreement.

Under the existing exclusive area provisions of § 107.13, and new § 107.111, the FAA's intent is for the airport operator to maintain an awareness of the security posture of the area covered under the agreement. To avoid misunderstanding, we have not adopted proposed § 107.111(b)(4) and (5) regarding the airport monitoring and auditing the aircraft operator, or terminating the exclusive area agreement. The FAA expects the ASC to maintain a general awareness of all security functions, and raise with the aircraft operator and/or the FAA any apparent deficiencies.

The FAA will continue to be responsible for inspection duties in exclusive areas, and for ensuring compliance, and will initiate enforcement actions when necessary.

The FAA agrees with the suggestion made by ACI-NA and AAAE that the regulation permits the agency, in extraordinary circumstances, to unilaterally and immediately terminate exclusive area agreements. In most cases the FAA will work directly with the aircraft operator to correct the problems. However, since poorly implemented agreements represent a vulnerability in the system, and thereby compromise the safety of the larger community, the FAA sees a clear connection between such circumstances and the need for immediate termination, and the return of the responsibility to the airport operator. For that reason, the procedures set forth in § 107.105(d), Emergency Amendments, would be employed for that purpose. The FAA sees no need for additional language toward that end in this section.

On the issue of joint liability and responsibility, the FAA has chosen not to provide such latitude. The agency believes that when more than one party holds joint responsibility for such matters, the responsibilities often are overlooked under the presumption that the “other” party will act. In that same view, a shared agreement might tend to fragment responsibility. Not that this would not prevent several aircraft operators from using the same portion of the secured area. Only one of them, however, could have an exclusive area agreement for a given part of the secured area.

The proposed rule stated that the exclusive area agreement could cover security measures in the critical security area or restricted operations area. The final rule clarifies that these measures include §§ 107.201, 107.203, and 107.205, and would include other sections cited in those, such as § 107.207. Other responsibilities held by the airport operator cannot be assumed by the aircraft operator. An example is the provision of law enforcement support (

see

§ 107.215), which can only fall to the airport operator.

In response to the question as to whether a leasehold agreement could substitute for an exclusive area agreement, the FAA believes that it is permissible if the leasehold agreement meets the criteria established in § 107.111. Such an agreement, in appropriate part, could be approved by the FAA as a part of the approved security program. Often, however, a leasehold agreement includes material not relevant to the security program, such as financial arrangements. Such information likely would have to be removed.

Comments on § 107.111(a):

The RAA stated that they were very concerned about the provision that responsibility for the security of an exclusive area cannot be shared. The nature of regional airline operations often mandates that they share facilities with their major airline partners, some of which have exclusive area agreements with airports.

Atlanta Hartsfield International Airport asks if this provision will allow the assignment of access points, leading from the public area to the sterile or critical security areas, to the air carriers. They would like to have the flexibility to assign doors and portals leading to baggage make-up areas, directly to the affected air carrier.

FAA response:

Like the proposal, this new section assembles all of the provisions relating to exclusive area agreements that previously appeared in §§ 107.3(b)(3), (b)(5) and 107.13. Section 107.111(a) expands the existing exclusive area responsibilities for air carriers and foreign aircraft operators to include individual access points (e.g., doors and gates). The security responsibilities for these points may be assumed by a part 108 aircraft operator, or part 129 foreign air carriers, based on a local agreement with the airport operator when approved by the FAA as a part of the airport security program.

Comments on § 107.111(b):

A commenter states that nothing in this section specifically notes that the aircraft operator is directly accountable to the FAA as a regulated party for any responsibilities assumed in the agreement. This should be stated in the rule and the ACSSP.

Two airports suggest changing the word “dimensions” to “general description.”

Port Authority of NY and NJ would like the flexibility to assign doors and portals leading from the baggage make-up areas directly to the affected aircraft operator.

FAA response:

Complementary language in the newly rewritten part 108 (

see

§ 108.227) provides that the aircraft operator is required to comply with the responsibilities in the exclusive area agreement. A failure to comply could result in enforcement action against the aircraft operator.

Section 107.111(a) exclusive area agreements, states that in an approved amended security program, an aircraft operator or foreign air carriers (one that has a security program under parts 108 or 129) would be permitted to assume responsibility for specified security measures for all or portions of the secured area, AOA or SIDA. This may include doors between baggage make-up areas and secured areas.

With regard to comments about the term “dimensions” in paragraph (b)(1), the agency's position remains as previously stated. In performing its

regulatory responsibility, the airport operator, aircraft operator, foreign air carriers, and the FAA must be able to distinguish clearly the boundaries of the exclusive area. This distinction is necessary in determining what security measures must be applied, and by whom.

The FAA removed proposed paragraphs (b)(4) and (5) from the final rule language of § 107.111. These sections had required that the airport operators monitor and audit the carrier with whom it had an exclusive area agreement.

Furthermore, in response to the Port Authority of NY and NJ, the language of the proposed regulation clearly allows for the airport operator as well as the aircraft operator to be responsible for doors and portals leading from the baggage make-up areas (

see

§ 107.111(b)(1)).

New § 107.111(c) provides a compliance date one year after the effective date of the rule for existing exclusive area agreements to meet new § 107.111. This will give aircraft operators and airport operators time to change existing agreements to conform to the new rules. Any new agreements, however, will have to meet the new rules.

Section 107.113 Airport Tenant Security Programs

As noted in the NPRM, this new section was proposed to permit the use of airport tenant security programs. These programs allow airport tenants, other than aircraft operators regulated under part 108, or foreign air carriers regulated under part 129, to assume some of an airport operator's security responsibilities, as specified in 49 U.S.C. § 44903(c)(2). That statute also clarifies that when an airport operator chooses to implement this program, it accepts the responsibility to inspect the tenant for compliance with the tenant security program, and to take enforcement action as appropriate.

Comments:

Detroit Metropolitan Airport disagrees with the notion that tenants would be responsible to the airport operator and not the FAA on security matters.

Ft. Wayne Airport states that this section should include a blanket exemption for any and all military and other Federal facilities co-located on the airport property. If they are not exempted, then close coordination between the FAA and the Department of Defense must occur prior to initiation of the new part 107 regulation.

The LSG/Sky Chefs and Lincoln Airport Authority urge the FAA to either mandate the tenant security program everywhere or eliminate this option altogether. The FAA should provide clear guidance as to what a tenant program consists of, instead of addressing the issues for the first time by each airport during the development of the program or through enforcement actions.

The ACI-NA and AAAE state that nothing in proposed § 107.113 specifically identifies tenants as the regulated party with direct accountability to the FAA for security responsibilities assumed in the agreement.

The NATA strongly opposes any attempt to regulate directly airport tenants and believes that this Congressionally-approved approach of airport tenant security programs will address the concerns of the airport operator community that were raised previously over security violations of its tenants. The penalties posed by the airport operator should not be permitted to go beyond those provided by the FAA. The tenant should not be required to enter into such an agreement with the airport, and it should be emphasized that it is voluntary in nature. There must be an allowance for the airport tenant to cancel the agreement with the airport operator.

FAA response:

While Detroit Metropolitan Airport objects that tenants would be responsible to the airport operator rather than to the FAA on security matters, the statute that enacted this program provides no latitude in this regard, and was enacted largely through the efforts of an industry association.

In response to the suggestion by the Fort Wayne Airport that military and other Federal facilities at the airport be exempted, the FAA notes that Federal civilian entities are merely tenants within the context of civil aviation security. The FAA does not regulate military facilities, in that the agency's jurisdiction does not extend to military reservations. The military's cooperation in ensuring a secure airport environment is always sought. As an integral part of the host airport, the military facility, and relevant security issues, must be reflected in the airport security program.

In response to the suggestions made by LSG/Sky Chef and the Lincoln Airport Authority, there does not appear to be any reason to either require tenant security programs for all tenants or to forbid them. Each airport and tenant has different circumstances, and the use of these programs will be based on the needs and wishes of concerned parties at each airport. Within the latitude of the statute, the FAA believes such decisions are best made at the local level. However, in further response, the FAA has provided more information in the rule as to what must be in the tenant security program.

As with exclusive area agreements, airport tenant security programs would only provide for the tenant to assume responsibility for measures under § § 107.201, 107.203, and 107.205, and sections cited in those provisions. If appropriate in a given situation the airport might simply copy provisions from its own program into the tenant program. The airport operator may not transfer responsibility to provide law enforcement support. Further, the tenant may only take on employment verification responsibilities as provided in § 107.209. The tenant may not conduct the criminal history records checks, which under title 49, United States Code, section 44936, may only be done by the airport operator or aircraft operator.

Section 44903(c)(2) provides that the tenant may assume responsibility in an area that it leases or is designated for its exclusive use. The FAA interprets this to foreclose the use of an airport tenant security program for companies that contract with the airport operator to manage a terminal building. The terminal is used by one or more aircraft operators and numerous passengers, visitors, and businesses. Further, it remains the fundamental responsibility of the airport operator to provide security under the statute and the regulations for areas that directly serve the flying public. This has been made more clear in § 107.113(a). The FAA views the airport tenant security program to permit a tenant to take on security duties for areas that are not directly handling passengers for whom part 108 measures apply. It is not a means for the airport to transfer duties that are directly dealing with passengers, which is the fundamental mission of part 107. Thus, a fixed base operator at a remote site may be an acceptable candidate for an airport tenant security program. Its duties, while important to the overall security of the airport, are not as directly involved with passengers. Security at the terminal building is directly involved with passengers and should not be transferred from the airport operator.

At some airports an aircraft operator with a part 108 security program is the major or only aircraft operator at a terminal, and may lease and manage the terminal building. The aircraft operator may assume security responsibilities for that terminal under an exclusive area agreement under § 107.111.

The final rule also has been clarified to provide that only one tenant can be responsible for each area covered by a tenant security program. This is consistent with the statutory provision that the area be leased to or used exclusively by the tenant. Further, as with aircraft operators, it is evident that when responsibility is unduly diluted, it is more difficult to promote compliance with the security requirements. It should be noted that the FAA will carefully consider whether security is served before approving an airport tenant security program. Before approving the program, the FAA must find that the tenant realistically is capable of carrying out the security measures it is assuming and is willing to do so.

In response to ACI-NA and AAAE, the FAA notes that the statute does not provide for the tenant to be directly accountable to the FAA for violations. Rather, the airport operator is responsible for taking action against the tenant if it fails to comply with its security program. The term “regulated party” is a vague one. The tenant is regulated in that it becomes responsible for carrying out its FAA-approved security program, with consequences from the airport operator if it fails to do so.

In response to the NATA comment, the statute on which airport tenant security programs are based states that the tenant will be required to pay financial penalties to the airport operator in the event that the tenant fails to carry out any such security requirement. The statute does not address the amount to be assessed by the airport operator. The FAA's interest in this process will be served when the agency is satisfied that the program includes provisions for the imposition of fines or other penalties adequate to promote or ensure compliance by the tenant participating in the agreement.

As to NATA's comment that the tenant's agreement to an airport tenant security program should be voluntary, Section 44903(c)(2) is silent as to whether airport operators can require their tenants to enter such an agreement. The FAA generally is not involved in such tenant-landlord issues unless there are violations of Federal law, regulations, or grant assurances. As to whether the tenant will be able to cancel the agreement, if the tenant is not able or willing to carry out the tenant security program the FAA will amend the airport security program to remove the tenant security program and provide that the airport operator is directly responsible for the security measures. Any issues between the airport operator and tenant as to possible breach of contract generally will not be resolved by the FAA.

Comments on § 107.113(b):

One airport suggests removal of the reference to “monetary and other penalties.” The airport operator must have the flexibility to resolve tenant security program infractions on a case-by-case basis.

Two airports comment that under proposed § 107.113(b)(4) tenants should be directly accountable to the FAA, if a “person” can be accountable.

FAA response:

The tenant security program must outline the terms of the agreement, including monetary and other penalties. The reference to “money penalties” comes from the statute, Section 44903(c)(2)(A)(ii). The term “other penalties” allows flexibility on the part of the airport operator; however, the nature of that phrase must be outlined in the program by the airport operator. By the same token, the FAA will not approve a tenant security program for which the airport operator has not established a meaningful system of monetary penalties and other penalties applicable in cases of noncompliance. Further, the agency recognizes that token penalties may yield only token compliance or may be willingly incurred by some tenants as a cost of doing business. Such factors will be considered by the FAA in evaluating each tenant security program.

As to responsibility of the tenant under § 107.11, routine use of enforcement action by the FAA against the tenant would dilute the airport operator's responsibility under Section 444903(c) to make sure its security program is carried out. However, in appropriate cases, the FAA will consider action, particularly against individuals.

Section 107.201 Security of the Secured Area

The FAA proposed in § 107.201 to require the airport operator to establish a critical security area and implement certain security measures. The proposed critical security area essentially replaced the secured area that originated with existing § 107.14.

Proposed § 107.201(b) would require an identification system that incorporates the standards of proposed § 107.209 (now § 107.211), including implementation of a challenge program and escort procedures.

It was proposed that, under this section, individuals with unescorted access to the critical security area continue to be required to submit an employment verification as specified in proposed § 107.207 (now § 107.209.)

The FAA proposed that § 107.201(b)(6) require the airport operator to train individuals in a manner prescribed in proposed § 107.211 (now § 107.213) prior to authorizing such individuals unescorted access to the critical security area.

This section also proposed in § 107.201(b)(7) to require signs at access points to and along the perimeter of critical security areas. The NPRM's preamble discussion of the sign requirements referred readers to the FAA's AC 107-1 (May 19, 1972). This AC recommends that airport operators appropriately post signs warning of the entry restrictions to certain areas at the airport and any penalties associated with unauthorized entry. The FAA proposed that the airport operator be permitted 2 years to implement the new sign requirements.

Comments on § 107.201(a):

One commenter states that § 107.201 should be deleted, as the systems called for in § 107.209 (Identification Systems) are unnecessary and systems identified by proposed § 107.205 (Access Control Systems) are sufficient.

The Airport Consultants Council (ACC) states that the FAA should not have different training and identification requirements for the critical security area and restricted operations area.

Another commenter asks if it is the intention of the FAA to have the critical security area replace the present SIDA. If so, the requirement for display of identification media should be completely spelled out.

FAA response:

The secured area is discussed above under General Discussion of the Final Rule. As noted in the earlier General Discussion, the FAA has decided to retain the term “AOA” and “secured area.” Therefore, these terms will be used in place of “critical security area” and “restricted operations area,” respectively, for the remainder of this discussion.

Contrary to the views of the first commenter, the FAA does not believe that this section should be deleted. Proposed § 107.205, Access Control Systems (§ 107.207 in the final rule), specifies the requirements for the system, measures, or procedures for controlling entry into the secured area. An important element of strong security is redundancy. If an unauthorized person were to enter the secured area, the airport operator must have a means to determine that the person who is present is not authorized to be there; hence, the need for an identification system as provided for in proposed § 107.209 (new § 107.211). Section 107.201 establishes the secured area as

a place on the airport that incorporates these two critical security systems, as well as others, to protect the most critical operations of part 108 and part 129 aircraft operators.

In response to ACC, the FAA notes the different burdens of providing training in the secured area versus the more general requirement attached to the AOA, as noted by ACC. The agency believes that a strict training and ID standard should attach to unescorted access privileges to the secured area, where the most critical operations are performed. In other areas, there is not the same need at each airport for the most intense security requirements.

As to the commenter who asked if it is the FAA's intention to have the critical security area replace the current secured area, the FAA notes this was the intention in the NPRM. Again, however, the term “critical security area” has not been adopted, in favor of the current term “secured area.”

In response to the commenters question regarding replacing the SIDA, the FAA notes that a secured area is a SIDA, and incorporates other security measures as well.

Comments on § 107.201(b):

Federal Express, eight airports and one air carrier recommend changing the word “prevent” to “deter and/or detect.” These commenters believe that the program must be able to detect and remove unauthorized personnel from these areas.

One commenter states that this section implies that full badging may be required everywhere inside the fence at an airport. Such determinations should be made on an airport-specific basis in concert with local FAA officials. Badging should be based on need, not by definition of an area.

The ACI-NA and AAAE expressed several concerns regarding the proposed vehicle identification requirements.

The CALA and an airport state that § 107.201(b)(5) should be more clear and be expanded to exempt airports from having to review background investigations completed by airport tenants on persons requiring SIDA access, received from aircraft operators, that are directly regulated by the FAA.

Several airports state that this proposal should allow general terms on the signs and variations in interpretation depending upon how the airport is divided. Adding sign requirements for all doors would increase the cost significantly. Furthermore, posting signs meeting the additional criteria discussed in the NPRM would pose additional costs without any accompanying increase in security. One airport states that a minimum distance between the warning signs on the perimeter should be provided to ensure uniformity at airports. The ACC states that the proposal lacks reference to sign requirements relevant to the Americans with Disabilities Act.

FAA response:

Several commenters questioned the use of the word “prevent” as it appears in §§ 107.201 and 107.205. The FAA disagrees with the arguments put forth by commenters. The word “prevent” in this context means to keep unauthorized persons and ground vehicles from the area, and appears in current § 107.13(a)(1). The section goes on to list the methods the airport operator must use to do so. The FAA believes that the high level of security required in the secured area is best completed by first preventing unauthorized access.

Further, the FAA agrees with the commenters, to the extent that a detection capability must also exist should a security system fail to prevent an unauthorized penetration or other potentially dangerous situation from occurring. This philosophy is consistent with the FAA's long held belief that the civil aviation security system is an integrated set of interdependent measures. Consequently, the final regulation also incorporates the requirement for “detection” in § 107.201(b), a carryover from existing § 107.13. As to the commenter who noted that the proposal implies that full badging may be required everywhere at an airport, the FAA notes that the proposal to require identification systems in both the critical security area and the restricted operations area has not been adopted. The final rule requires identification media only in the SIDA, of which the secured area is a part.

As to ACI-NA's and AAAE's questions about vehicle identification systems as proposed in §§ 107.201 and 107.203, for reasons discussed in response to comments in § 107.211, the FAA has decided not to adopt the proposed requirements for vehicle identification systems.

In response to the commenter who suggested that this proposal should allow for general terms on signs, the FAA notes its intent is to allow each local program the latitude to place appropriate signs in a manner that befits the local conditions. Signs remind the person working at the airport that they are entering an area where certain security measures are in place and for which they may be held individually accountable. Also, the signs warn the uninitiated person that access to the area beyond that point is restricted, and that security measures are in effect beyond that point. The FAA believes there is a value to the notification and deterrence effect of such signs. Consequently, the proposed language essentially is unchanged.

Section 107.203 Security of the AOA

The FAA proposed in this new section to require the designation of a restricted operations area and to specify security measures that must be implemented in it.

As in the critical security area, this section proposed that airport operators use a personnel and vehicle identification system to control movement that meets the standards prescribed in proposed § 107.209.

The FAA proposed to require that the airport operator implement the same escort and challenge procedures used in the proposed critical security area; however, access investigation would differ. This section proposed to require the existing 5-year employment history verification standards currently used in the AOA and as they appear in local airport security programs. This section also proposed requirements for signs similar to those of the critical security area.

Comments on § 107.203(a):

One airport states that conducting background investigations, badging, training, and auditing all of these operators and individuals would be extremely costly, while adding no improvement to airfield security. This commenter recommends that the focus remain on security and protecting the SIDA or critical security area.

The ACI-NA and AAAE strongly recommend that the requirements formerly associated with the SIDA be limited in application to the critical security area and that the terminology be changed.

FAA response:

The AOA is discussed above under General Discussion of the Final Rule. As previously noted, the FAA has deleted the proposed change to the use of the term “restricted operations area,” and has retained the term “air operations area” to reflect that area and its requirements under § 107.203. The term AOA will be used from this point on.

After further consideration, the FAA has determined that requiring identification in the AOA is not necessary at all airports, nor are the strict escort and challenge procedures that were proposed. The final rule reflects the emphasis placed on the secured area under § 107.201, as more latitude is permitted for the airport operator under § 107.203 than was proposed. However, while the measures

to be used in the AOA are not strictly prescribed by regulation, the airport operator continues to be responsible for the burden of preventing and detecting unauthorized entry, presence, or movement of persons and ground vehicles in the AOA. Some airports have decided it is necessary, with FAA approval, to require the display of identification throughout their AOA. Also, most airports require a 5-year employment history verification for those with unescorted access to the AOA. This provision, or another check to verify the person's identification, would continue to be part of the airports system to control the AOA.

Under the final rule, security requirements for the AOA remain similar to those in current § 107.13. They are: control of access to and movement on the AOA, the response to unauthorized penetrations, the provision of security information to persons with unescorted access to the AOA, and the posting of signs. The FAA believes this less prescriptive approach in the AOA will provide the greatest flexibility to the airport and its tenants. These measures generally are in effect today. The concerns of many commenters are, therefore, mitigated since part 107 airports currently possess FAA-approved security programs which adequately describe the AOA and no new burden is imposed.

Comments on proposed § 107.203(b):

Two airports recommend deleting the requirement for access media for personnel with equipment within the AOA from § 107.203(b). The practicality is that this requirement will be very burdensome for small airport operators with little or no benefit to the critical security area as a result of the additional expense and manpower requirements.

Continental Airlines and the National Association of Police Officers (NAPO) state that § 107.203(b)(2) should be more thoroughly clarified and expanded to exempt airports from reviewing background investigations by airport tenants or persons requiring SIDA access. These background investigations are received from aircraft operators who are directly regulated by the FAA.

Three airports state that the posting of signs meeting the additional criteria appearing in the discussion of the NPRM would pose repetitive monetary expenditures without any accompanying increase in security. One commenter states that a minimum distance between the warning signs on the perimeter should be provided to ensure uniformity at airports.

FAA response:

To the commenter who suggested deleting the requirement for access media for personnel with equipment within the AOA, the FAA points out that it is possible under the regulation and would be a local decision. For example, the FAA is aware that at some locations individuals working in teams (such as, construction crews) may not each possess individual access or identification media. Instead, such teams may work under escort of someone with the appropriate authority. The latitude for an airport operator to employ this practice continues to be acceptable under this final rule.

As to Continental's and NAPO's suggestion to exempt airports from reviewing background investigations for unescorted access to the AOA, the FAA points out that it has not adopted the specific 5-year employment verification requirement proposed under § 107.203(b)(2). Instead, the FAA chose to retain in that section the less prescriptive approach of current § 107.13 as regards control of the AOA. New § 107.203 fixes the airport operator's responsibility for the AOA to that of control of entry and movement, and the prevention and detection of unauthorized persons and vehicles.

The FAA expects that airport operators seeking to comply with new § 107.203 will need to verify the identification of persons granted unescorted access to the AOA. Since the 5-year employment verification process has provided for that for many years, some airports may choose to retain that approach. The FAA would also consider other methods to accomplish the same end.

As to the comments regarding fencing, the FAA disagrees that the costs do not result in additional security. Fences provide a positive, physical barrier to intrusions. They provide deterrence, as well as notice to well-intentioned persons who recognize that fencing sets an area apart for some purpose. Taken together with the requirements for the posting of signs under the rulemaking, the agency is convinced the two measures will provide a visible and effective means to provide an initial level of protection to the airport.

The FAA does not wish to specify a fixed distance between signs. Local conditions, the character of fence lines, topography, etc., should be more determining of sign placement than a distance set in regulation. At the same time, the FAA would expect signs to be constructed and placed in such a way as to be readily visible and readable from any point along the fence line, with details reflected in the airport security program.

Section 107.205 Security of the Security

This text is long and has been trimmed here. Open the source document for the complete record.