# Transportation Worker Identification Credential (TWIC)-Reader Requirements > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2016-19383 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** August 23, 2016 - **Citation:** 81 FR 57652 ## Text DEPARTMENT OF HOMELAND SECURITY Coast Guard 33 CFR Parts 101, 103, 104, 105 and 106 [Docket No. USCG-2007-28915] RIN 1625-AB21 Transportation Worker Identification Credential (TWIC)—Reader Requirements AGENCY: Coast Guard, DHS. ACTION: Final rule. SUMMARY: The Coast Guard is issuing a final rule to require owners and operators of certain vessels and facilities regulated by the Coast Guard to conduct electronic inspections of Transportation Worker Identification Credentials (TWICs) as an access control measure. This final rule also implements recordkeeping requirements and security plan amendments that would incorporate these TWIC requirements. The TWIC program, including the electronic inspection requirements in this final rule, is an important component of the Coast Guard's multi-layered system of access control requirements designed to enhance maritime security. This rulemaking action builds upon existing regulations designed to ensure that only individuals who hold a valid TWIC are granted unescorted access to secure areas of Coast Guard-regulated vessels and facilities. The Coast Guard and the Transportation Security Administration have already promulgated regulations pursuant to the Maritime Transportation Security Act that require mariners and other individuals to hold a TWIC prior to gaining unescorted access to a secure area. By requiring certain high-risk vessels and facilities to perform electronic TWIC inspections, this rule enhances security at those locations. This rule also implements the Security and Accountability For Every Port Act of 2006 electronic reader requirements. DATES: This final rule is effective August 23, 2018. ADDRESSES: Comments and materials received from the public, as well as documents mentioned in this preamble as being available in the docket, are part of docket USCG-2007-28915 and are available using the Federal eRulemaking Portal. You can find this docket on the Internet by going to http://www.regulations.gov, entering “USCG-2007-28915” and then clicking “Search.” FOR FURTHER INFORMATION CONTACT: For information about this document, call or email LCDR Kevin McDonald, Coast Guard; telephone 202-372-1168, email Kevin.J.Mcdonald2@uscg.mil. SUPPLEMENTARY INFORMATION: Table of Contents for Preamble I. Abbreviations II. Regulatory History and Information III. Executive Summary A. Basis and Purpose B. Summary of Costs and Benefits IV. Background V. Discussion of Comments and Changes to the Final Rule A. General Matters Relating to TWIC 1. Purpose and Efficacy of the TWIC Program 2. Risk Analysis Methodology B. Electronic TWIC Inspection 1. Electronic TWIC Inspection Does Not Necessarily Require a TWIC Reader 2. Integrating Electronic TWIC Inspection Into a PACS a. List of Acceptable TWIC Readers b. PIN Pads and Biometric Input Methods 3. Comments Related to Troubleshooting TWIC a. Lost, Stolen, or Damaged TWIC i. Vessels and Facilities Using a PACS ii. Vessels and Facilities Using TWIC Readers b. Transportation Worker Forgets to Bring TWIC to Work Site c. Inaccessible Biometrics d. Malfunctioning Access Control Systems e. Requirements for Varying MARSEC Levels 4. Recordkeeping Requirements C. When to Conduct Electronic TWIC Inspection 1. Secure, Restricted, Public Access, Passenger Access, and Employee Access Areas a. “Prior to Each Entry” for Risk Group A Facilities b. Recurring Unescorted Access 2. Risk Group A Vessels 3. Risk Groups B and C 4. Miscellaneous Questions Regarding the Locations of Electronic TWIC Inspection D. Determination of Risk Groups 1. Risk Group A Facilities a. Alternative Security Programs b. Determining Risk Group A Facilities 2. The Crewmember Exemption Does Not Apply to Facilities 3. The Low Number of Crewmembers Exemption 4. Calculating the Total Number of TWIC-holding Crewmembers 5. Threshold for the Crewmember Exemption of Vessels 6. Outer Continental Shelf Facilities 7. Vessels and Facilities Not in Risk Group A 8. Barge Fleeting Facilities 9. Switching Risk Groups E. Responses to Economic Comments 1. Costs of TWIC Readers 2. Number of TWIC Readers at Vessels and Facilities 3. Transaction Times 4. Security Personnel 5. Other Cost Comments 6. Costs Exceeding Benefits, Cost-effectiveness, and Risk Reduction 7. Cumulative Costs of Security-related Rulemakings 8. Small Business Impact F. Other Issues 1. The GAO Report and the TWIC Pilot Program 2. Additional Comments a. General Comments on the TWIC Program b. Clarification of Specific Items c. Comments Outside the Scope of this Rulemaking VI. Regulatory Analyses A. Regulatory Planning and Review B. Small Entities C. Assistance for Small Entities D. Collection of Information E. Federalism F. Unfunded Mandates Reform Act G. Taking of Private Property H. Civil Justice Reform I. Protection of Children J. Indian Tribal Governments K. Energy Effects L. Technical Standards M. Environment I. Abbreviations AHP—Analytical Hierarchy Process ANPRM—Advanced Notice of Proposed Rulemaking ASP—Alternative Security Program CCA—Certificate for Card Authentication CCL—Canceled Card List CCTV—Closed-Circuit Television CDC—Certain Dangerous Cargoes CFR—Code of Federal Regulations CHUID—Card Holder Unique Identifier COI—Certificate of Inspection DHS—Department of Homeland Security DRAA—Designated Recurring Access Area E.O.—Executive Order FASC—N Federal Agency Smart Credential—Number FR—Federal Register FSP—Facility Security Plan ICE—Initial Capability Evaluation MARSEC—Maritime Security MISLE—Marine Information for Safety and Law Enforcement MSRAM—Maritime Security Risk Analysis Model MTSA—Maritime Transportation Security Act of 2002 NIST—National Institute of Standards and Technology NPRM—Notice of Proposed Rulemaking NTTAA—National Technology Transfer and Advancement Act NVIC—Navigation and Vessel Inspection Circular OCS—Outer Continental Shelf OMB—Office of Management and Budget PAC—Policy Advisory Council PACS—Physical Access Control System PVA—Passenger Vessel Association PII—Personal Identifying Information PIN—Personal Identification Number Pub. L.—Public Law QTL—Qualified Technology List RA—Regulatory Analysis RUA—Recurring Unescorted Access SAFE—Port Act Security and Accountability For Every Port Act of 2006 SBA—Small Business Administration SSI—Sensitive Security Information TSA—Transportation Security Administration TSAC—Towing Safety Advisory Committee TSI—Transportation Security Incident TWIC—Transportation Worker Identification Credential U.S.C.—United States Code VSP—Vessel Security Plan II. Regulatory History and Information On May 22, 2006, the Coast Guard and the Transportation Security Administration (TSA) jointly published a Notice of Proposed Rulemaking (NPRM) entitled “Transportation Worker Identification Credential (TWIC) Implementation in the Maritime Sector; Hazardous Materials Endorsement for a Commercial Driver's License.” 1 On January 25, 2007, the Coast Guard and TSA published the final rule, also entitled “Transportation Worker Identification Credential (TWIC) Implementation in the Maritime Sector; Hazardous Materials Endorsement for a Commercial Driver's License.” 2 1 71 FR 29396. 2 72 FR 3492. Although the May 22, 2006 NPRM proposed certain TWIC reader requirements, after reviewing the public comments, the Coast Guard decided to remove the proposed TWIC reader requirements from the January 25, 2007 final rule, address them in a separate rulemaking, and conducted a pilot program to address the feasibility of reader requirements before issuing a final rule. 3 For a detailed discussion of those public comments and Coast Guard responses, please refer to the January 25, 2007 final rule. 4 3 The TWIC Reader Pilot was established pursuant to Section 104 of the Security and Accountability For Every Port Act of 2006 (SAFE Port Act) (P.L. 109-347), which was codified at 46 U.S.C. 70105 (k)(4). 4 72 FR 3511. On March 27, 2009, the Coast Guard published an Advanced Notice of Proposed Rulemaking (ANPRM) for this rulemaking. 5 On March 22, 2013, the Coast Guard published the NPRM for this rulemaking. 6 Additionally, we held four public meetings across the country in 2013. 5 74 FR 13360. 6 78 FR 17782. III. Executive Summary A. Basis and Purpose In accordance with the Maritime Transportation Security Act of 2002 (MTSA) and the Security and Accountability For Every Port Act of 2006 (SAFE Port Act), the Coast Guard is establishing rules requiring electronic readers for use at high-risk vessels and at facilities. These rules will ensure that prior to being granted unescorted access to a designated secure area, an individual will have his or her TWIC authenticated, the status of that credential validated against an up-to-date list maintained by the TSA, and the individual's identity confirmed by comparing his or her biometric ( i.e. fingerprint) with a biometric template stored on the credential. By promulgating these rules, the Coast Guard is complying with the statutory requirement in the SAFE Port Act, improving security at the highest risk maritime transportation-related vessels and facilities, and making full use of the electronic and biometric security features integrated into the TWIC and mandated by Congress in MTSA. The TWIC is currently being used as a visual identity badge on many vessels and facilities. Essentially, DHS requires that a security guard examines the security features (hologram and watermark) embedded on the surface of the credential, checks the expiration date listed on the card, and compares the photograph to the person presenting the credential. While this system of “visual TWIC inspection” provides some benefits, it does not address all security concerns, nor does it make full use of the security features contained in the TWIC. For example, if a TWIC is stolen or lost, an unauthorized individual could make use of the credential, and provided that individual resembles the picture on the TWIC, could gain access to a secure area. Additionally, if a TWIC is revoked because the individual has committed a disqualifying offense, such as the theft of explosives, there is no way for security officers on a vessel or at a facility to determine that fact from the face of the TWIC. Finally, a sophisticated adversary could forge a realistic replica of a credential. It is also worth noting that since a TWIC-holder is required to renew his or her credential every 5 years, the TWIC-holder's resemblance to the picture on the TWIC may decrease over time, rendering visual inspection a somewhat less accurate means to confirm identity. Through the process of “electronic TWIC inspection,” by which TWICs are authenticated, validated, and the individual's identity confirmed biometrically, all of these scenarios would be thwarted or mitigated. In this rulemaking process, the Coast Guard published an ANPRM, published an NPRM, hosted a series of public meetings around the country to solicit public input, and worked with the Transportation Security Administration to conduct a pilot program. As a result of this input, the Coast Guard made a number of changes and clarifications in this final rule that we believe provide a robust system that improves security, addresses industry, labor, and Congressional concerns, and clarifies numerous issues relating to the operational nature of the electronic TWIC inspection program. Primarily, this rule allows for an even more flexible implementation of the electronic TWIC inspection requirements than the proposed rule that will allow new systems to be integrated into existing security and access control systems. We believe that this flexibility will provide robust security without causing unnecessary costs or significantly disrupting business operations. A brief summary of the main changes from the proposed rule to the final rule follows. • This final rule provides additional flexibility with regard to the purchase, installation, and use of electronic readers. Instead of requiring the use of a TWIC reader on the TSA's Qualified Technology List (QTL), owners and operators can choose to fully integrate electronic TWIC inspection and biometric matching into a new or existing Physical Access Control System (PACS). • We clarify that this final rule only affects Risk Group A vessels and facilities, and that no changes to the existing business practices of other MTSA-regulated vessels and facilities are required. • This final rule eliminates the distinction between Risk Groups B and C for both vessels and facilities. If and when a requirement for electronic TWIC inspection may be considered for MTSA-regulated vessels and facilities not currently in Risk Group A, we will provide an updated analysis of the costs and benefits of such an action and define new Risk Groups accordingly. • This final rule clarifies that for Risk Group A facilities, electronic TWIC inspection is required each time a person is granted unescorted access to a secure area (a limited exception is permitted for Recurring Unescorted Access, or RUA). For Risk Group A vessels, electronic TWIC inspection is only required when boarding the vessel, even if only parts of the vessel are considered secure areas. • This final rule eliminates the special requirement that barge fleeting facilities that handle or receive barges carrying Certain Dangerous Cargoes (CDC) in bulk be classified as Risk Group A. Barge fleeting facilities are instead classified the same as all other facilities. This change will effectively eliminate most isolated barge facilities from the electronic TWIC inspection requirements due to a lack of a secure area. • This final rule increases the exemption from electronic TWIC inspection requirements to vessels with 20 or fewer TWIC-holding crewmembers and defines that number as the minimum manning requirement specified on a vessel's Certificate of Inspection. • This final rule provides additional flexibility for ferries and other vessels that use dedicated terminals in Risk Group A to integrate their electronic TWIC inspection programs with their terminals' programs. B. Summary of Costs and Benefits Of the approximately 13,825 vessels, 3,270 facilities, and 56 Outer Continental Shelf (OCS) facilities regulated by MTSA, this final rule impacts only certain “Risk Group A” vessels and facilities, which currently number 1 vessel 7 and 525 facilities under the revised applicability definitions for the final rule. No OCS facilities are affected by this final rule. We estimate the annualized cost of this final rule to be approximately $22.5 million, while the 10-year cost is $157.9 million, discounted at 7 percent. The main cost drivers of this rule are the acquisition, installation, and integration of TWIC readers into access control systems. Annual costs will be driven by costs associated with updates of the list of cancelled TWICs, recordkeeping, training, system maintenance, and opportunity costs associated with failed TWIC reader transactions. The estimated annualized cost of this final rule discounted at 7 percent is approximately $5.1 million less than the estimated cost of the NPRM. 7 We note that the number of vessels affected by the provision is low, as most “Risk Group A” vessels are exempt from the electronic TWIC inspection requirements due to a low crewmember count. The benefits of this final rule include the enhancement of the security of vessels, ports, and other facilities by ensuring that only individuals who hold TWICs are granted unescorted access to secure areas at those locations. The main benefit of this regulation, decreased risk of a Transportation Security Incident (TSI), cannot be quantified given current data limitations. We used a risk-based approach to apply these regulatory requirements to less than 5 percent of the MTSA-regulated population, which represents approximately 80 percent of the potential consequences of a TSI. The provisions in this final rule target the highest risk entities while maximizing the net benefits of the rule. Table 1 provides the estimated costs and functional benefits associated with the requirements of the TWIC reader. Table 1—Estimated Costs and Functional Benefits of TWIC Reader Requirements Category Final Rule Applicability High-risk MTSA-regulated facilities and high risk MTSA-regulated vessels with greater than 20 TWIC-holding crewmembers. Affected Population 1 vessel. 525 facilities. Costs ($ millions, 7% discount rate) $22.5 (annualized). $157.9 (10-year). Costs (Qualitative) Time to retrieve or replace lost PINs for use with TWICs. Benefits (Qualitative) Enhanced access control and security at U.S. maritime facilities and on board U.S.-flagged vessels. Reduction of human error when checking identification and manning access points. For a more detailed discussion of costs and benefits, see the full Final Regulatory Analysis and Final Regulatory Flexibility Analysis available in the online docket for this rulemaking. Appendix G of that document outlines the costs by provision and also discusses the complementary nature of the provisions. IV. Background The MTSA provides a multi-layered approach to maritime security which includes measures to consider broader security issues at U.S. ports and waterways, the coastal zone, the open ocean, and foreign ports. Under this multi-layered system, the Coast Guard is authorized to regulate vessels and facilities, and owners and operators of MTSA-regulated vessels or facilities are required to submit for Coast Guard approval a comprehensive security plan detailing the access control and other security policies and procedures implemented on each vessel and facility. Security plans must identify and mitigate vulnerabilities by detailing the following items: (1) Security organization of the vessel or facility; (2) personnel training; (3) drills and exercises; (4) records and documentation; (5) response to changes in Maritime Security (MARSEC) Level; (6) procedures for interfacing with other facilities and/or vessels; (7) Declarations of Security; (8) communications; (9) security systems and equipment maintenance; (10) security measures for access control; (11) security measures for restricted areas; (12) security measures for handling cargo; (13) security measures regarding vessel stores and bunkers; (14) security measures for monitoring; (15) security incident procedures; (16) audits and security plan amendments; (17) Security Assessment Reports and other security reports; and (18) TWIC procedures. 8 8 See 33 CFR 104.405 and 33 CFR 105.405. For the purposes of MTSA, the term “facility” means “any structure or facility of any kind located in, on, under, or adjacent to any waters subject to the jurisdiction of the United States.” 9 For the purposes of MTSA, the term “vessel” includes “every description of watercraft or other artificial contrivance used, or capable of being used, as a means of transportation on water.” 10 Coast Guard regulations implementing MTSA with respect to vessels 11 apply to: Mobile Offshore Drilling Units, cargo vessels, or passenger vessels subject to the International Convention for Safety of Life at Sea, 1974 (SOLAS), chapter XI-1 or Chapter XI-2; foreign cargo vessels greater than 100 gross register tons; generally, self-propelled U.S. cargo vessels greater than 100 gross tons; offshore supply vessels; vessels subject to the Coast Guard's regulations regarding passenger vessels; passenger vessels certificated to carry more than 150 passengers; passenger vessels carrying more than 12 passengers engaged on an international voyage; barges carrying, in bulk, cargoes regulated under the Coast Guard's regulations regarding tank vessels or CDC; 12 barges carrying CDC or cargo and miscellaneous vessels engaged on an international voyage; tank ships; and generally, towing vessels greater than 8 meters in register length engaged in towing barges. 9 46 U.S.C. 70101(2). 10 46 U.S.C. 115; 1 U.S.C. 3. 11 See 33 CFR 104.105(a). 12 The term “Certain Dangerous Cargoes” is defined in 33 CFR 101.105 by reference to 33 CFR 160.204, which lists all of the covered substances. TWIC requirements in those regulations do not apply to: Foreign vessels; mariners employed aboard vessels moored at U.S. facilities only when they are working immediately adjacent to their vessels in the conduct of vessel activities; except pursuant to international treaty, convention, or agreement to which the U.S. is a party, to any foreign vessel that is not destined for, or departing from, a port or place subject to the jurisdiction of the U.S. and that is either (a) in innocent passage through the territorial sea of the U.S., or (b) in transit through the navigable waters of the U.S. that form a part of an international strait. 13 13 See 33 CFR 104.105(d)-(f). Coast Guard regulations implementing MTSA with respect to facilities 14 apply to: waterfront facilities handling dangerous cargoes (as generally defined in 49 CFR parts 170 through 179); waterfront facilities handling liquefied natural gas and liquefied hazardous gas; facilities transferring oil or hazardous materials in bulk; facilities that receive vessels certificated to carry more than 150 passengers; facilities that receive vessels subject to SOLAS, Chapter XI; facilities that receive foreign cargo vessels greater than 100 gross register tons; generally, facilities that receive U.S. cargo and miscellaneous vessels greater than 100 gross register tons; barge fleeting facilities that receive barges carrying, in bulk, cargoes regulated under the Coast Guard's regulations regarding tank vessels or CDC; and fixed or floating facilities operating on the OCS for the purposes of engaging in the exploration, development, or production of oil, natural gas, or mineral resources. 14 See 33 CFR 105.105 and 106.105. Those regulations do not apply to: A facility owned or operated by the U.S. that is used primarily for military purposes; an oil and natural gas production, exploration, or development facility regulated by 33 CFR parts 126 or 154 if (a) the facility is engaged solely in the exploration, development, or production of oil and natural gas, and (b) the facility does not meet or exceed the operating conditions in 33 CFR 106.105; a facility that supports the production, exploration, or development of oil and natural gas regulated by 33 CFR parts 126 or 154 if (a) the facility is engaged solely in the support of exploration, development, or production of oil and natural gas and transports or stores quantities of hazardous materials that do not meet or exceed those specified in 49 CFR 172.800(b)(1) through (b)(6), or (b) the facility stores less than 42,000 gallons of cargo regulated by 33 CFR part 154; a mobile facility regulated by 33 CFR part 154; or an isolated facility that receives materials regulated by 33 CFR parts 126 or 154 by vessel due to the lack of road access to the facility and does not distribute the material through secondary marine transfers. 15 Additionally, the TWIC requirements in those regulations do not apply to mariners employed aboard vessels moored at U.S. facilities only when they are working immediately adjacent to their vessels in the conduct of vessel activities. 16 15 See 33 CFR 105.105(c). 16 See 33 CFR 105.105(d) and 106.105(b). This rulemaking applies to the above-described vessels and facilities regulated by the Coast Guard pursuant to the authority granted in MTSA, and will further increase the security value of TWIC to the nation by making use of the statutorily-mandated biometric identification function and other security features. A complete statutory and regulatory history of this rulemaking can be found in Section III.B of the NPRM published on March 22, 2013. 17 17 78 FR 17789. The TWIC program falls under the access control requirements as one component of MTSA. Since April 15, 2009, the TWIC has been used throughout the maritime sector for access to secure areas of MTSA-regulated facilities and vessels. Its purpose is to ensure a vetted maritime workforce by establishing security-related eligibility criteria, and by requiring each TWIC-holder to undergo a security threat assessment from the TSA as part of the process of applying for and obtaining a TWIC. In addition to its visible security features, the TWIC stores two electronically readable reference biometric templates ( i.e., fingerprint templates), a PIN, a digital facial image, authentication certificates, and a Federal Agency Smart Credential-Number (FASC-N). These features enable the TWIC to be used in different ways for (1) card authentication, (2) card validation, and (3) identity verification. Card authentication ensures that the TWIC is not counterfeit. Security personnel can authenticate a TWIC by visually inspecting the security features on the card. An electronic reader provides enhanced authentication by performing a challenge/response protocol using the Certificate for Card Authentication (CCA) and the associated card authentication private key stored in the TWIC. The electronic reader will read the CCA from the TWIC and send a command to the TWIC requesting the card authentication private key be used to sign a random block of data (created and known to the electronic reader). The electronic reader software will use the public key embedded in the CCA to verify that the signature of the random data block returned by the TWIC is valid. If the signature is valid, the electronic reader will trust the TWIC submitted and will then pull the FASC-N and other information from the card for further processing. The CCA contains the FASC-N and a certificate expiration date harmonized to the TWIC expiration date. This minimizes the need for the electronic reader to pull more information from the TWIC (unless required for additional checking). The card validity check ensures that the TWIC has not expired or been cancelled by TSA, or reported as lost, stolen, or damaged. Security personnel can validate whether a TWIC has expired by visually checking the TWIC's expiration date. Currently, a TSA-canceled TWIC is placed on TSA's official CCL, which is updated daily. TSA's CCL is available online at: https://universalenroll.dhs.gov/. Currently, the process of TWIC visual inspection does not require the security guard to compare the cardholder's name to the CCL and therefore facilities do not know when specific card holders have had their credentials cancelled and may continue to grant access unknowingly. Using an electronic reader, card validity is further confirmed by finding no match on the CCL and electronically checking the expiration date on the TWIC. Checks against the CCL may be performed electronically by downloading the list onto a TWIC reader or integrated PACS. Identity verification entails comparing the individual presenting the TWIC to the same person to whom the TWIC was issued. Identity can be verified by visually comparing the photo on the TWIC to the TWIC-holder. Using an electronic reader, identity can be verified by matching one of the biometric templates stored in the TWIC to the TWIC-holder's live sample biometric, matching to the PACS enrolled reference biometrics linked to the FASC-N of the TWIC, or requiring the TWIC-holder to place the TWIC into a TWIC reader (currently a PIN can only be accessed using a TWIC reader with a contact interface) and entering their PIN to release the digital facial image from the TWIC. This avoids the vulnerabilities of visual inspection by using the biometric capabilities mandated by Congress. V. Discussion of Comments and Changes to the Final Rule In response to publication of the March 22, 2013 NPRM, the Coast Guard received over 100 comment letters, consisting of over 1,200 unique comments. Commenters provided numerous opinions, arguments, questions, and recommendations regarding the proposed TWIC reader requirements. In this section, we describe the comments received, as well as how they influenced the decisions made in this final rule. Overall, we have grouped our discussion into five sections, as discussed below. In Section A, we address comments relating to the TWIC program generally, and electronic TWIC inspection specifically. This section includes comments relating to what the program's purpose is, how it affects security, and how it is tailored to achieve these goals in the most cost-effective and least-burdensome manner. We also discuss the risk analysis methodology in this section, in order to address comments relating to the specific types of threats the electronic TWIC inspection program is designed to combat. Sections B through D of this discussion respond to comments relating to the operational aspects of the electronic TWIC inspection program. Most comments received were of a practical nature, especially those asking for clarifications on exactly how the regulations would apply in a large variety of specific situations. Section B addresses the specific nature of what an “electronic TWIC inspection” is, including what must be carried out, how such an inspection can be carried out using a PACS, recordkeeping requirements arising from electronic TWIC inspections, and how specific problems, such as a misplaced TWIC, would be addressed in the regulations. Section C addresses when an electronic TWIC inspection must take place, including the specific locations on a facility or vessel where electronic readers must be located, and the parameters of an RUA configuration. Section D responds to comments relating to the classification of vessels and facilities into Risk Groups, including questions relating to barge fleeting facilities, shifting Risk Groups, and the exemption from electronic TWIC inspection requirements for vessels with a low number of crewmembers. Items relating to the economic issues of electronic TWIC inspection are addressed in Section E. Comments on these issues related to the costs of TWIC readers, throughput times for TWIC transactions, and potential changes in security staffing needs. Finally, Section F addresses several miscellaneous issues. Primary among these issues are comments relating to the TWIC Pilot Program and the Government Accountability Office (GAO) report on TWIC readers, issued in 2013 shortly before publication of the NPRM and accompanying analysis. 18 Additionally, this section addresses all other comments and questions that were not included in other sections. 18 “Transportation Worker Identification Credential: Card Reader Pilot Results Are Unreliable; Security Benefits Need to Be Reassessed” (GAO-13-198). A. General Matters Relating to TWIC In response to the NPRM, the Coast Guard received a large variety of comments relating to the TWIC program. In this section, we begin with those comments that address the TWIC program as a whole. Multiple commenters expressed dissatisfaction with the TWIC program as a whole and suggested that it be dismantled. Many of these commenters noted that specific facilities or vessels had not been targeted by terrorists, and argued that the costs of the program were unnecessary. For a variety of reasons described extensively throughout this document, we believe that the targeted measures established in this final rule provide a cost-effective mitigation of various threats that could result in a TSI. For example, in the Regulatory Analysis (RA), we describe three hypothetical yet plausible scenarios in which an individual could gain access to a vessel or facility using a forged or stolen TWIC, 19 threats that could specifically be reduced by electronic TWIC inspection. Congress has mandated, and we agree, that preventing unauthorized individuals from accessing secure areas of the nation's transportation infrastructure is part of a necessary security program. While we also agree with many commenters who suggested that it does not prevent every possible security threat, that is not the purpose of this final rule. The purpose of this final rule is to improve security at the highest risk maritime transportation-related vessels and facilities through the use of an electronic reader. 19 RA, p. 88. One commenter criticized the Maritime Security Risk Analysis Model (MSRAM) threat analysis methodology, because it did not address the security issues raised by cargo containers, which include the potential for concealed threats within the containers. While we note that MSRAM does include scenarios associated with threats from cargo containers, for the purposes of the current analysis of electronic TWIC inspection, we limited our consideration to attack scenarios that require physical proximity to the intended target and for which access control would affect the ability to conduct an attack. Controlling access to a target is an essential component of security from such attacks because access control helps to detect and perhaps interdict or at least delay the attackers before they reach the target. TWIC readers enhance the reliability of access control measures, thereby increasing the likelihood of identifying and denying/delaying access to an individual or group attempting nefarious acts. For this reason, our analysis in this final rule focuses on threats that could be prevented or mitigated through use of electronic TWIC inspection. Concealed items or persons smuggled inside cargo containers are not attack scenarios that transportation worker identity verification (and electronic TWIC inspection in particular) addresses. Therefore, analyzing those scenarios would not be useful for this rule. Coast Guard regulations address security measures for those attack scenarios in other ways. Vessel and facility security plans must describe in detail how they meet all relevant security requirements, including the security measures in place for handling cargo. 20 20 See 33 CFR 104.405; 33 CFR 105.405; 33 CFR part 104, subpart B; and 33 CFR part 105, subpart B. Multiple commenters expressed concern over the application process for obtaining a new or renewal TWIC, stating that delays have saddled workers with an undue burden. The Coast Guard understands the challenges encountered during the initial implementation of TWIC, and during the more recent surge of renewals. We note the progress that has been made in the TWIC application process since publication of the NPRM. Furthermore, we note that comments relating to the card application process are outside the scope of this rulemaking, which pertains to electronic TWIC inspection requirements only. One commenter sought clarification as to why the TWIC was not an acceptable form of identification for entry to U.S. Navy or Coast Guard bases, and stated that the TWIC should be recognized by the agency that is requiring its use within the maritime sector. This comment is also outside the scope of this rulemaking as it does not address TWIC readers or their application to maritime rather than Federal facilities ( e.g., Coast Guard or Navy military bases). One commenter expressed concern with requiring electronic readers on vessels, stating that anyone boarding a vessel would need to first pass through a facility. The same commenter stated that seafarers should not be prevented from taking shore leave, and suggested that additional regulations be put in place to avoid unlawful charges to seafarers to transit facilities for shore leave. The Coast Guard understands these concerns and has applied this rulemaking to those vessels presenting the highest risk and to those vessels which, in most cases, will regularly visit international ports not regulated under MTSA. Additionally, Congress mandated seafarers' access in section 811 of the Coast Guard Authorization Act of 2010. This mandate requires each Facility Security Plan to “provide a system for seamen assigned to a vessel at that facility, pilots, and representatives of seamen's welfare and labor organizations to board and depart the vessel through the facility in a timely manner at no cost to the individual.” 21 The Coast Guard is currently conducting a separate rulemaking to implement section 811. 22 21 See the Seafarers' Access to Maritime Facilities Notice of Proposed Rulemaking (79 FR 77981, 77985 (Dec. 29, 2014)). 22 The docket for the Seafarers' Access rulemaking is available online at www.regulations.gov by entering “USCG-2013-1087” in the Search box. Several commenters requested more flexibility within this final rule rather than a “one size fits all” approach. This final rule incorporates additional flexibility for vessel and facility operators in direct response to comments in which specific requests for flexibility were made. The Coast Guard wholly agrees that there is no “one size fits all” approach for maritime security given the vast range of facility and vessel operations which, in many cases, overlap or occur in close proximity to each other. This final rule moves to a more performance-based approach by defining the criteria for electronic inspection requirements that meet the TWIC access control measures. Additionally, this rule sets flexible baseline requirements for electronic reader implementation for those vessels and facilities. We believe that the increased flexibility will decrease the burden on industry by allowing the use of existing systems with minor modifications, increasing the pool of available electronic reader technology, and allowing the individual operators to determine the approach to meet the regulatory requirement that best facilitates their business needs. Some commenters suggested that the TWIC should be a standardized credential that can be used at multiple facilities, and that having this Federal credential should be a standard credential, rather than requiring truck drivers and others who need access to secure areas to obtain individual site-specific badges. The commenters argued that the use of the credential could alleviate redundant and overlapping background checks for workers, such as drivers, that access multiple facilities. We partially agree with this argument, but believe we should elaborate more closely on the role that TWIC and other identification credentials play in ensuring security at maritime facilities. We disagree with the suggestion that the TWIC should be used as an “all-access” credential that would override the property rights and security responsibilities of vessel and facility owners. We believe (like many other commenters), that possession of TWIC should not automatically grant an individual access to secure areas because the mere possession of a TWIC does not entitle the holder to access another person's property. The decision to grant access to a secure area of a vessel or facility appropriately lies with the owner or operator of that vessel or facility. We expect vessel and facility operators to limit access to their secure spaces to those who need such access, and to ensure that only those with a valid TWIC are granted unescorted access. However, we note that controlling access to facilities can be carried out in several ways. For example, a facility may grant unescorted access to employees who enter the facility multiple times per day on a regular basis, and also grant access to truck or bus drivers who may only enter the facility on an occasional basis. Such a facility may use different ways to control access, and ensure that all individuals granted unescorted access possess a valid TWIC. The facility may vary how it does this depending on the operator's business needs and on the reasons why different individuals are requesting unescorted access. In this example, the facility might have one entrance for employees who use a PACS card to enter secure areas of the facility, and have another entrance for truck or bus drivers, who would present a TWIC for inspection. A single access point could also contain both a PACS reader and a TWIC reader, the latter for use by contractors or visitors who may not have been issued a facility-specific access card. In this final rule we have granted flexibility that allows operators to use a variety of means to grant unescorted access, including the use of the TWIC as a means of identification. However, this final rule does not require operators to grant unescorted access to any TWIC-holder. As is currently the case, access to any vessel or facility is granted by the owner or operator, who has the authority and responsibility to determine if the individual requesting access has a legitimate business purpose. 1. Purpose and Efficacy of the TWIC Program Several commenters questioned the overall efficacy of the TWIC program, questioning whether the program, with or without electronic readers, does anything to improve security. The Coast Guard understands that there have been many challenges with the implementation of the TWIC program, but does believe that TWIC has improved access control at vessels and at maritime facilities across the country. The TWIC program's single standard and nationwide recognition is intended to ensure a secure, consistent biometrically enabled credential, and facilitate an efficient, resilient, mobile transportation workforce during routine and emergency situations. However, an individual successfully obtaining a TWIC is only the first half of a two-part process. First, vessel and facility security personnel must determine that an individual possesses a valid TWIC, meaning that they have been vetted. Second, they must verify the individual's authorization for entering a vessel or facility before granting the person unescorted access. As mentioned above, the mere possession of a valid TWIC alone is not sufficient to gain the holder of that credential access to secure areas on vessels or facilities across the country. The TWIC provides a means by which a vessel or facility security officer can determine that an individual has been vetted to an established and accepted standard. This determination helps inform the vessel or facility security officer's decision to grant unescorted access to an individual. Vessel and facility personnel may then evaluate a TWIC-holder's authorization and determine whether the TWIC-holder should be granted unescorted access. One commenter took issue with a statement in the NPRM that read “TWIC readers will not help identify valid cards that were obtained via fraudulent means, e.g., through unreported theft or the use of fraudulent IDs.” 23 The commenter stated that TWIC readers can identify cards that were obtained through unreported theft of the TWIC card by performing biometric identification of the TWIC-holder. We believe the commenter misunderstood the statement in the NPRM, which referred to the use of fake or stolen (but unreported) identification documents, such as drivers licences and birth certificates, to fraudulently obtain an authentic TWIC from the TSA. The use of such fraudulently acquired, but genuine TWICs was one issue highlighted by the GAO and by several commenters as a shortcoming in the TWIC program, and we acknowledge that the use of electronic TWIC inspection will not address that particular scenario. However, we agree with the commenter that if a valid TWIC was stolen after it was produced, electronic TWIC inspection would help to identify such a card if an unauthorized person attempted to use it. Although visual TWIC inspection could also detect such unauthorized use, electronic TWIC inspection would do so more effectively by using the TWIC's biometric and other security features. 23 78 FR 17787. Some commenters argued that visual TWIC inspection does not provide “adequate security,” and that electronic TWIC inspection should be the standard procedure for all TWIC inspections, rather than used only for high-risk vessels and facilities. The commenter made several arguments as to why visual TWIC inspection should not be used. The commenter quoted guidance from the National Institute of Standards and Technology (NIST), issued with regard to identification for Federal employees when entering Federal facilities, which stated that visual inspection of an identification card offers little to no assurance that the claimed identity of the individual matches the identification. The commenter stated that visual inspection is a weak authentication mechanism and does not provide the level of assurance that an electronic inspection can provide. Another commenter cited the 2011 GAO report on the TWIC program, which stated that visual TWIC inspection was not a particularly effective means of identity verification. 24 While we agree that electronic TWIC inspection provides a more reliable means of identity verification than visual TWIC inspection, we disagree with the assertion that the visual inspection provides no security benefit. Many industries rely on photographic identification cards to verify a card-holder's identity before granting access to accounts or locations. Some situations may require, and justify the cost of, additional layers of security. For example, the heightened risk at Risk Group A vessels and facilities warrant the greater security afforded by electronic TWIC inspection, along with the attendant costs. As explained in this preamble and the accompanying RA, we do not believe such costs are justified for vessels and facilities outside of Risk Group A at this time. 24 GAO-11-657, “Transportation Worker Identification Credential: Internal Control Weaknesses Need to Be Corrected to Help Achieve Security Objectives” The commenter made several other arguments relating to visual TWIC inspection. First, the commenter noted that there is no way for visual TWIC inspection to determine if a TWIC has been cancelled. While we agree that visual TWIC inspection will not perform an electronic check against the TSA's list of cancelled TWICs, we disagree with the suggestion that visual inspection has no value in performing the card validity check. Security personnel perform the basic card validity check to ensure that a TWIC has not expired by checking the card's expiration date. A TWIC reader does the same validity check electronically, but will further confirm card validity by finding no match on the list of cancelled TWICs. We explain in the RA that the costs associated with this added layer of security are warranted only for Risk Group A vessels and facilities. The commenter also stated visual TWIC inspection creates vulnerability because it relies on a “repetitive human process,” where the staff may become distracted or less attentive. While we agree generally that electronic TWIC inspection is more reliable than visual TWIC inspection, we disagree with the suggestion that visual TWIC inspection is unreliable. We are requiring TWIC readers for Risk Group A, in part, due to the potentially reduced human error that TWIC readers afford. As explained in the RA, that added benefit does not outweigh the costs associated with requiring TWIC readers outside of Risk Group A at this time. One commenter stated that the background check does not ensure that facilities are protected from crime. The Coast Guard agrees that crimes can still be committed despite background checks, although we note that MTSA specifically prohibits certain persons with extensive criminal histories from receiving TWICs. 25 However, the purpose of requiring electronic TWIC inspection is not to prevent all crime, but to prevent TSIs at high-risk vessels and maritime facilities. In that regard, we believe that TWIC is a critical part of the layered approach to port security because it establishes a minimum, uniform vetting and threat assessment process for mariners and port workers across the country aimed at preventing a TSI. The existing TWIC Program ensures that workers needing routine, unescorted access to secure areas of facilities and vessels undergo lawful status checks (for non-U.S. citizens) and that they are vetted against a specific list in statute of terrorism associations and criminal convictions. 26 It provides a standard baseline for determining an individual's suitability to enter the secure area of a vessel or facility regulated under the MTSA. We note that the program does not exclude everyone with a criminal record and that most, but not all, of the permanent disqualifying crimes for a TWIC can be waived in extraordinary circumstances. 27 However, there are aggressive procedures to remove a TWIC from any TWIC-holder found to have committed one of these crimes after receiving their TWIC, or to remove a TWIC from a TWIC-holder who is later added to any of the terrorism associated databases. 25 See 46 U.S.C. 70105(c) for the list of disqualifying criminal offenses. 26 46 U.S.C. 70105 and 49 CFR 1572.103. 27 46 U.S.C. 70105 and 49 CFR part 1515. Multiple commenters suggested that the risk analysis for the NPRM did not adequately address cargo containers and the related cargo container facilities. One commenter suggested that container terminals were the primary focus of the enactment of the MTSA and SAFE Port Act, yet they are not subject to the highest level of TWIC scrutiny. The Coast Guard disagrees that container terminals were the primary focus of the Acts, noting that there was substantial discretion permitted by the statutory language to implement electronic TWIC inspection requirements. We reiterate that with regard to threats carried within cargo containers, electronic TWIC inspection is not particularly effective for threat mitigation since scenarios involving container contents ( e.g., weapons, personnel) in an attack in the United States do not require access to the container inside the secure area. The risk analysis evaluated the consequence of an attack on the maritime facilities themselves, deeming it reasonable to confine attack scenarios to the facility because offsite scenarios ( e.g., transfer of container contents) are not mitigated by TWIC, but are instead the focus of additional layers of protections in the larger MTSA regulatory regime. Based on the MSRAM calculations relating to the effect of an attack on a cargo container facility, the efficacy of electronic TWIC inspections in disrupting such attacks, and considering the costs of requiring electronic TWIC inspections, we arrived at the conclusion that it would not be the most cost-effective approach to improving public safety to require electronic TWIC inspection at these facilities at this time. We would refer interested parties to the accompanying RA for a detailed discussion of alternative regulatory approaches considered in this rulemaking. Furthermore, we note that under existing guidance, any facility not covered by this final rule may implement electronic TWIC inspection on a voluntary basis for any reason. One commenter stated that the classification for large general cargo container terminals was counterintuitive, because disruption to any one of these facilities could have significant negative consequences for the nation's economy. We understand the commenter's perspective. However, for this rule, as part of the MSRAM analysis, we evaluated the risk of a TSI that (1) occurs at cargo container facilities and (2) would be less likely to occur through TWIC reader implementation, and for these scenarios, the likelihood of long-term disruptions to the nation's economy is assessed to be minimal. One commenter suggested that not placing container terminals in Risk Group A, and thus not requiring electronic TWIC inspection, would threaten the supply chain by allowing TWIC-holders, who have subsequently been determined by the TSA to be a security threat to the United States, to have unescorted access to the nation's critical infrastructure with impunity. We disagree that not placing container facilities in Risk Group A is tantamount to exposing those facilities to security threats. We note that the general TWIC requirements located in § 101.515, which prohibit those who do not hold a valid TWIC from receiving unescorted access to a secure area, is still effective for these facilities. Container facilities may voluntarily institute requirements for electronic verification, for example, for business reasons. Furthermore, such facilities are subject to spot checks by the U.S. Coast Guard where such invalidated TWIC-holders could be discovered through the use of portable TWIC readers by Coast Guard personnel. One commenter suggested that terrorists might use a small facility to transport a weapon, thus bypassing electronic TWIC inspection programs. Pursuant to existing requirements, unescorted access to a secure area of any MTSA-regulated maritime facility requires a TWIC, so all workers seeking unescorted access, not just those at high-risk facilities, are subject to background checks. However, we note that electronic TWIC inspection is not designed to directly protect against smuggling, including the smuggling of terrorist weapons. Electronic TWIC inspection is designed to ensure that unauthorized persons, who have not been provided a TWIC, are not provided unescorted access to high-risk vessels and facilities. Many, if not most, smuggling scenarios do not require adversary access to secure areas for success, and thus the enhanced access control afforded by electronic TWIC inspection does little to reduce the risk for these scenarios. One commenter added that facilities are poor targets for terrorist attacks and thus, screening workers on those facilities adds little value. We disagree, and note that we have tailored this rule to specifically encompass only those maritime facilities where the dangers of a TSI are heightened, such as those that handle or receive vessels carrying CDC in bulk. We have determined that the facilities in Risk Group A could be attractive targets for terrorist attacks due to the substantial loss of life and environmental effects that could result from a TSI. Furthermore, we tailored the requirements to only require electronic TWIC inspection when such inspection would have a substantial effect on reducing the likelihood of such an attack (the “TWIC utility” prong of the risk analysis, described in detail in the NPRM). See 78 FR 17791. 2. Risk Analysis Methodology Multiple commenters expressed concern with the risk analysis for this rulemaking. While we have considered the commenters' concerns, our risk analysis model remains unchanged from that proposed in the NPRM. We believe that the existing risk analysis model, which considered a wide range of targets, attacks, and consequences, remains the most comprehensive and logical means available to implement the electronic TWIC inspection program. In this process, the Coast Guard analyzed 68 distinct types of vessels and facilities using the MSRAM database based on their purposes or operational descriptions. The Coast Guard initially separated this list of vessels and facilities into proposed Risk Groups A, B, and C in the ANPRM and have ultimately used this baseline to inform the classification of Risk Group A vessels and facilities in this final rule. We identify these vessels and facilities as those that can best be protected by electronic TWIC inspection. The risk analysis methodology used in this rulemaking consists of three distinct analytical factors. The first factor, which we described in the NPRM as the “maximum consequences to [a] vessel or facility resulting from a terrorist attack,” is the direct consequence of a type of attack that could be prevented or mitigated by use of electronic TWIC inspection. This factor was assessed for each class of vessel and facility. The second factor, which we described as the “criticality to the nation's health, economy, and national security,” considered the impact of the loss of a vessel or facility beyond the direct consequences, taking into consideration regional or national impact on health and security. Finally, we considered TWIC utility, which we describe as the effectiveness of the TWIC program in reducing a vessel or facility's vulnerability to a terrorist attack.” It is important to note that the electronic TWIC inspection program is not the only security measure protecting vessels and maritime facilities, and is not designed to counter every conceivable threat to them. In the preliminary RA, we explained that there were three specific attack scenarios most likely to be mitigated by electronic TWIC inspection, and thus used in our analysis. These scenarios were: (1) A truck bomb, (2) a terrorist assault team, and (3) an explosive attack carried out by a passenger or passerby (with the specific caveat that the terrorist is not an “insider”). 28 While several commenters criticized certain aspects of the TWIC program for not countering additional threats, we note that benefits outside the scope of the above threats were not considered to be likely successes of the TWIC program and were not considered in our analysis. One commenter suggested that the truck bomb scenario was unrealistic, as it would be easier to place a bomb in a container itself. We note that these are two distinct scenarios, and that the risk identified in the latter scenario is one that is not mitigated by electronic TWIC inspection. 28 Preliminary RA, p.72. The first factor of the analysis was the most comprehensive, which was to determine the direct primary and secondary consequences of the total loss of a vessel or facility. To conduct this stage of the analysis, we used MSRAM data. MSRAM collects data from a wide variety of vessels and facilities and includes calculations of damages for each individual vessel or facility. The damages incorporated into the MSRAM analysis include: (1) Death and serious injuries; (2) direct property damage and the costs of business interruptions; (3) environmental consequences; (4) national security consequences; and (5) secondary economic consequences, such as damage done to the supply chain. 29 To finish the first stage of analysis, we aggregated the MSRAM data from the individual vessels and facilities into averages for each of the 68 identified classes. 29 Preliminary RA, p.75. The second factor in the analysis considered the impact of the total loss of the vessel or facility beyond the immediate local consequences. This involved examining the regional and national effects of such a loss on the state of human health, the economy, and national security. The third factor in the analysis focused on the effectiveness of the TWIC program in actually reducing the vessel or facility class' vulnerability to a terrorist attack. In instances where electronic TWIC inspection would substantially reduce the effect or likelihood of an attack, this factor was assigned a greater value. Once the three analytical factors were determined, the Coast Guard combined the scores using the Analytic Hierarchy Process (AHP), developing a total score that combined the severity of an attack and the effectiveness of the TWIC program in countering that attack for each of the classes of vessels and facilities. These overall rankings were then used to determine the Risk Groups used in developing this rulemaking. We believe that this approach used in this risk analysis methodology is highly effective, and represents the best method available for assessing the benefits of the electronic TWIC inspection program to the specific vessels and facilities under consideration. One commenter suggested that the Coast Guard should not finalize this rule, and that a panel of private industry representatives should be included in an objective review of where the risks and vulnerabilities are in order to develop the best tool for mitigation. The Coast Guard has taken a collaborative approach toward developing this final rule, and has considered information from numerous stakeholders in this rulemaking, including the large number of comments on both the ANPRM and NPRM. As a result, the Coast Guard has amended this final rule, targeting the affected population to those vessels for which the use of electronic TWIC inspection provides the greatest benefit at minimum cost. This would not have been possible without the extensive public input received. One commenter suggested that previous risk assessments of their operation had never identified a scenario in which rogue employees played a role. We do not agree with the commenter that this weakens the case for the implementation of electronic TWIC inspection requirements. We note that “rogue employees” (no precise definition of this term was supplied, but we assume it means an employee who intends to carry out a TSI) are unlikely to be a threat mitigated by this final rule. This final rule is primarily designed to identify and intercept those adversaries who are not employees, but are attempting to use a stolen or otherwise invalid card to gain access to a secure area. A “rogue employee” with a valid TWIC would not be intercepted by electronic TWIC inspection. The “rogue employee” scenario is partially addressed by the security threat assessment that each employee must undergo before obtaining a TWIC, and is also addressed by other layers of security. For example, 33 CFR 104.285 and 105.275 require owners and operators to have the capability to continuously monitor their vessels and facilities through the use of lighting, security guards, waterborne patrols, automatic intrusion devices, or surveillance equipment. The same commenter asserted that there are no facts, objective risk assessments, or examples provided to support how a TWIC reader would enhance security absent a known risk or vulnerability. Additionally, the commenter broadly suggested that an owner or operator should be allowed to self-assess and determine its own risk group category after taking into account the security measures already in place at their own location. We disagree with both comments. MSRAM is a fact-based, objective tool for assessing TSI risk in the maritime domain. MSRAM incorporates specific examples of vessels and facility types and various attack modes. As explained in great detail in the ANPRM, NPRM, and elsewhere in this preamble, MSRAM is an analysis tool designed to estimate risk for potential terrorist targets. We consider MSRAM to be the best available tool for determining which vessels and facilities should be considered high-risk for the purpose of TWIC reader requirements. Because electronic TWIC inspection is generally more reliable than visual TWIC inspection, TWIC readers enhance access control more than visual inspection, increasing the likelihood of identifying an aggressor and denying access to secure areas. While the above rationale applies generally to Risk Group A, the Coast Guard also recognizes that the nature or operating conditions of certain vessels and facilities may warrant a waiver from certain regulatory requirements. The existing regulations in 33 CFR 104.130 and 105.130 provide that owners and operators may apply for a waiver of any requirement of the security regulations in 33 CFR parts 104 and 105 (including the TWIC reader requirements) in appropriate circumstances and where the waiver will not reduce overall security. Several commenters noted that while the Coast Guard used the MSRAM data to conduct its risk analysis, a number of TWIC Pilot Program participants were not contacted during this assessment. They argued that these participants could have provided local knowledge to produce supportable conclusions relative to risks and risk mitigation strategies in particular locations. We believe that these commenters misunderstand how MSRAM data were used. The Coast Guard carefully reviewed the pilot project in writing this final rule. MSRAM datawere used to help determine the consequences of a TSI. This was one factor used in determining the overall risk to the various classes of facilities analyzed in the Coast Guard's risk analysis. The Coast Guard uses MSRAM in a variety of risk analysis applications and does not engage in discussion with each participant every time the data are utilized. Some commenters also argued that they were the subject of several counterterrorism studies, and that these studies had not identified TWIC as risk mitigation tool, nor had they identified a scenario in which an employee bringing harm to a ferry was an identified vulnerability. These studies were not provided by the commenter but, from their descriptions, seem to have focused on risks other than those posed by persons impersonating employees. We note that while previous studies may not have identified TWIC as a risk mitigation tool, we have considered various scenarios in which electronic TWIC inspection would mitigate risk, and used them as the basis for our risk analysis. Furthermore, we note that electronic TWIC inspection is not designed to prevent a valid and cleared employee from bringing harm to a vessel or facility. Instead, it is specifically designed to prevent access to a secure area by an unauthorized person who is attempting to gain access by using a stolen or counterfeited TWIC. We believe that electronic TWIC inspection is an appropriate and cost-effective tool to mitigate such risks. B. Electronic TWIC Inspection Electronic TWIC inspection is the process by which the TWIC is authenticated, validated, and the individual presenting the TWIC is matched to the stored biometric template. This process consists of three discrete parts: (1) Card authentication, in which the TWIC at issue is identified as an authentic card issued by the TSA; (2) the card validity check, in which the TWIC is compared to the TSA-supplied list of cancelled TWICs 30 to ascertain that it has not been revoked, and is not expired; and (3) identity verification, in which the TWIC is matched to the person presenting identification through use of a biometric template stored on the TWIC. 30 We note that at this time, this list is the Cancelled Card List (CCL). However, there are also several specific Certificate Revocation Lists maintained by TSA, which differ from the CCL. In order to provide a regulation that is flexible in terms of future technology adaptations, in this final rule, we have described the list in the regulatory requirement generically as the “list of cancelled TWICs.” See sections 101.520(b) and 101.525 of the final rule regulatory text. This allows TSA to continue to use the CCL, but will also allow additions from various Certificate Revocation Lists if and when that becomes feasible and efficient. Any such change in the list of cancelled TWICs would be a “back end” change on TSA's part and would not impact the burdens or operations of private parties, who would still only be required to check a TWIC against the list as part of the card validity check. In this document, we generally refer to the “list of cancelled TWICs” when referring to the regulatory requirements in the final rule, while still using the “CCL” terminology when discussing comments on the Cancelled Card List or discussions in the NPRM that used that terminology. The purpose of electronic TWIC inspection is to improve the inspection of TWICs, as compared to visual TWIC inspection. We note that visual TWIC inspection accomplishes the same three tasks as electronic TWIC inspection, but in different ways, and generally not as thoroughly or reliably as electronic TWIC inspection. Visual card authentication is accomplished by visually inspecting the security features on the card (such as the watermark). A visual card validity check is accomplished by checking the expiration date on the face of the card, although there is no way to visually check if the TWIC has been revoked by the TSA since it was issued. Finally, visual identity verification is conducted by comparing the photograph on the TWIC with the individual's face. Electronic TWIC inspection improves upon the visual inspection checks, and adds two additional benefits. In electronic TWIC inspection, the authenticity of the card is verified by issuing a challenge/response to the TWIC's unique electronic identifier, called a Card Holder Unique Identifier (CHUID). The card's validity is determined by checking the TWIC against the most recently updated list of cancelled TWICs. Finally, the identity of the TWIC-holder is verified by matching the biometric template stored on the TWIC to the individual's biometrics. Each of these methods is an improvement upon visual TWIC inspection as the electronic TWIC inspection uses methods of validation that are not easily manipulated through means such as counterfeiting or altering the surface of the TWIC. Additionally, electronic TWIC inspection ensures that the card being presented has not been invalidated by a means other than being expired, such as the card having been reported lost, or the TWIC being revoked due to a criminal conviction. TWIC inspection, either electronic or visual, provides a baseline of information to determine who may be provided unescorted access to secure areas of MTSA-regulated vessels and facilities. While not every TWIC-holder is authorized unescorted access, the TWIC ensures that facility security personnel do not grant unescorted access to individuals that have not been vetted or have been adjudicated unfit for access to secure areas. Several commenters suggested that the sole purpose of TWIC is for a worker to be vetted through security and criminal checks, and that access control is not a purpose of the TWIC program. We disagree with this description of a fundamental principle of the TWIC program. The controlling statute, 46 U.S.C. 70105(a)(1) reads, in part, “[t]he Secretary shall prescribe regulations to prevent an individual from entering an area of a vessel or facility that is designated as a secure area . . . unless the individual holds a transportation security card issued under this section. . .”. This is a clear mandate for an access control program. We have implemented this mandate by requiring maritime workers to obtain a TWIC, and by requiring owners and operators to inspect each individual's TWIC prior to granting access to secure areas. Using the biometric template, TWIC provides a highly secure means for security personnel to verify the identity of an individual seeking access to a secure vessel or facility and implementing this core requirement of the MTSA. In this final rule, we are revising the regulatory text to add flexibility and more accurately reflect the electronic TWIC inspection process. In the NPRM, we did not describe the process as “electronic TWIC inspection,” but stated in proposed § 101.520(a) that “all persons must present their TWICs for inspection using a TWIC reader, with or without a . . . PACS. . .”. 31 In this final rule, we are modifying the process from presentation of a TWIC to a TWIC reader to the concept of electronic TWIC inspection. As stated below, and as defined in section 101.105 of this final rule, “Electronic TWIC inspection” means the process by which the TWIC is authenticated, validated, and the individual presenting the TWIC is matched to the stored biometric template. In doing so, we have laid out the exact requirements for this process in revised § 101.520. 31 78 FR 17829. In this section, we address the comments and concerns submitted in response to the NPRM, and describe in detail how electronic TWIC inspection will work in a wide variety of operational situations. Table 2 provides a summary of the acceptable implementation options for owners and operators to perform electronic TWIC inspection. The owner or operator of a vessel or facility must ensure the options chosen to meet the electronic TWIC inspection requirements perform the required card authentication, card validity, and identity verification required in revised § 101.520. Table 2—Implementation Options Option Description TWIC Reader (QTL) Owner/operator uses a TWIC reader listed on TSA's QTL. To gain entry to a secure area, employee presents TWIC and biometric for electronic inspection. TWIC Reader (non-QTL) Owner/operator uses a TWIC reader that adequately performs the three required electronic checks (card authentication, card validity check, identity verification). To gain entry to a secure area, employee presents TWIC and biometric for electronic inspection. Transparent Reader Similar to non-QTL TWIC reader, except the Transparent Reader does not independently perform card validation, card authentication, and identity verification. Instead, the Transparent Reader transmits information from the employee's TWIC and biometric to a back end system containing software that performs the TWIC check. Once the TWIC check is complete, the back end system shall perform what processes are required to either grant or deny access. PACS (with facility access card) Employee is issued a facility access card after initially registering employee's TWIC and biometric into the facility's access control database. To gain entry to a secure area, employee presents facility access card and biometric for electronic inspection to match against employee's record in the facility's database. PACS (with biometric only) Employee's TWIC and biometric are initially registered into the facility's access control database. To gain entry to a secure area, employee presents biometric (e.g., fingerprint) for electronic inspection to match against employee's record in the facility's database. 1. Electronic TWIC Inspection Does Not Necessarily Require a TWIC Reader Many commenters expressed concerns regarding the costs of purchasing, installing, and using TWIC readers that have been approved by the TSA. They argued that the costs of the TWIC readers were high, and that there were problems with the reliability of TWIC readers and cards. Many commenters requested that the Coast Guard extend guidance issued in Navigation and Vessel Inspection Circular (NVIC) 03-07 and Policy Advisory Council (PAC) Decision 08-09, change 1, in which we outlined how an existing PACS could be used in lieu of a TWIC reader until the TWIC final rule was issued. In NVIC 03-07, we described how TWIC could be incorporated into an access control system even if the person accessing the secure area did not physically use the TWIC as an access control card. We stated that: Example: A facility employee who possesses a valid TWIC is registered into the facility's access control database and is issued a facility access card after the TWIC is verified visually as described in 3.3 a. (7) [of NVIC 03-07]. To gain entry into a secure area, the employee inserts or scans his/her facility access card at a card reader, which verifies the access card as a valid card for the facility. The TWIC does not need to be used as a visual identity badge at each entry once the facility-specific card is issued. The card reader then verifies the individual by matching the facility access card to the individual's record in the facility database and allows access to secure areas as dictated by the permissions established by the owner/operator in the access control system. By virtue of the fact that the employee would not be issued a vessel or facility-specific card without first having a TWIC, the requirement to possess a TWIC for unescorted access to secure areas is met. 32 32 Enclosure (3) to NVIC 03-07, p. 1515 (Available in the docket by following the instructions in the ADDRESSES section of this preamble). Many commenters noted, and we are aware that, the proposed regulatory text in the NPRM was worded in such a way that rendered this method of compliance impossible. The proposed regulatory text in § 101.520(a)(1) stated “Prior to each entry, all persons must present their TWICs for inspection using a TWIC reader, with or without a physical access control system (PACS), before being granted unescorted access to secure areas.” 33 Similarly, proposed §§ 101.525 and 101.530 required visual inspections of TWICs before permitting access. Many commenters took issue with the change in approach from current requirements as described in the NVIC. 33 78 FR 17829. In this final rule, we are revising the regulatory text to allow electronic TWIC inspection to be conducted by either a TWIC reader or a PACS at vessels and facilities. This regulatory language will supersede previous guidance documents such as PAC 08-09, change 1 and NVIC 03-07. Under the new language in revised section 101.520 we are providing greater flexibility on the type of equipment used, as long as the three parts of electronic TWIC inspection are performed satisfactorily. Multiple commenters discussed the scenario where an owner or operator has a PACS which cross-checks successful electronic TWIC inspections against employment records and other internal security systems and records to verify that the cardholder works for the company, holds current certifications, and should be allowed into the facility. As explained in this document in Section V.B., such a system could meet the requirements for electronic TWIC inspection as revised for this final rule. Two commenters at a public meeting suggested that if a facility could prove its PACS is superior to the TWIC requirements, then the facility should be exempt from them. Similarly, other commenters suggested alternatives the Coast Guard could require, including a color-coded system analogous to the former Homeland Security Advisory System. In this final rule, we are not providing a generalized exemption from electronic TWIC inspection requirements as suggested by the commenters. However, as explained, such requirements can be performed by a PACS, thus potentially eliminating the need for these particular commenters to purchase entirely new equipment or the need for an exemption from the electronic TWIC inspection requirements. Multiple commenters stated that it would be more cost effective in some cases to purchase one or two stationary TWIC readers, but also to purchase several portable TWIC readers for multiple temporary gates or entrances. One commenter asked whether the final rule requires fixed card readers at every point of access, even a temporary or infrequently used one. The same commenter asked whether portable TWIC readers would meet the TWIC reader requirements on an OCS facility. We clarify that neither the NPRM nor final rule required stationary TWIC readers. The final rule, as described above, allows for flexibility in terms of equipment. The arrangements the commenters suggested could all be accommodated by this final rule. In this final rule, we are removing prescriptive requirements regarding the permanence, type, and placement of electronic readers. If a vessel or facility has an existing access control system, of any variety, whose electronic readers perform the requirements of the electronic TWIC inspection (including identity verification), and are approved under the relevant security plan, then the PACS is permissible. In response to the many comments we received on this issue, in this final rule, we are substantially altering the TWIC reader requirements to accomplish the goals set out by the TWIC reader program, but in a manner that provides more flexibility in terms of how those goals are met. The requirements in this final rule are designed to allow as much flexibility in design of an access control system as possible while still achieving the goals of the TWIC reader program. We believe that the increased flexibility offered by the revised, performance-based regulations is responsive to the many commenters who described existing access control systems that they believe are better suited for their individual vessels and facilities than those proposed in the NPRM. Under these final regulations, a system that accomplishes the goals of the TWIC program and uses the three electronic checks mandated by the regulation will be considered by the Coast Guard when reviewing the security plans. As long as the Coast Guard agrees that the proposed security plan accomplishes the goals in a robust fashion, we will not limit the choices of the means to do so. 2. Integrating Electronic TWIC Inspection Into a PACS NVIC 03-07 and PAC 08-09 change 1 explain that they are valid guidance until a TWIC reader final rule is issued, but many commenters requested that these documents remain valid even after the final rule becomes effective. Because this final rule significantly changes the TWIC inspection process for Risk Group A vessels and facilities, the TWIC-specific guidance provided in those documents will not continue to apply to Risk Group A. However, because we are not making any changes to the TWIC requirements for those vessels and facilities not in Risk Group A, the guidance documents still retain their validity with regard to those entities. We will update and post these guidance documents online at https://homeport.uscg.mil/ prior to the effective date of this final rule. In this final rule, we no longer require facility and vessel operators to use a TWIC reader listed on the QTL each time a person is granted unescorted access to a secure area. Instead, we are permitting multiple options as previously described, including the use of a PACS approved in the required Facility Security Plan (FSP) or Vessel Security Plan (VSP), if the PACS can perform the electronic TWIC inspection requirements. Example: A facility employee who possesses a valid TWIC is registered into the facility's access control database and is issued a facility access card after the TWIC is verified in accordance with 33 CFR 101.530. After the TWIC and holder of the TWIC are validated to ensure the TWIC is issued by TSA and the holder of the TWIC is bound to the TWIC, a biometric template of the employee is taken and stored on the facility access control system. To gain entry into a secure area, the employee inserts or scans his or her facility access card at a card reader, which verifies the access card as a valid card for the facility. The card reader then matches the facility access card to the employee's record in the facility database. A biometric sample from the employee is taken and matched to the associated biometric template stored on the facility's access control system. The facility's access control system then checks the TWIC's CHUID to assure that the TWIC is still valid (unexpired) as well as checks the list of cancelled TWICs to ensure that it has not been cancelled for any other reason. Upon verification that the TWIC is valid and the employee's biometric matches the associated template, the facility access control system allows access to secure areas as dictated by the permissions established by the owner or operator in the access control system. By virtue of the fact that the employee would not be issued a facility-specific card without first having a TWIC, the requirement to possess a TWIC for unescorted access to secure areas is met. The requirement for a biometric match of the employee is met through the performance of a match to the biometric template stored on the facility access control system. We note that the requirement for electronic TWIC inspection can be met even without the use of any sort of card reader, so long as the three parts of the electronic TWIC inspection are met. Such a system could be designed to use an individual's biometric check as a means of identification, such as described below. Example: A facility employee who possesses a valid TWIC is registered into the facility's access control database and a biometric template of the employee is taken and stored on the facility access system. (We note that this is done after the TWIC and holder of the TWIC are validated to ensure the TWIC is issued by TSA and the holder of the TWIC is bound to the TWIC). To gain entry into a secure area, the employee presents a biometric ( e.g. , fingerprint) to a biometric reader connected to the facility's access control system. The access control system identifies the employee from the fingerprint and then matches it to the biometric template and the employee's TWIC information in the facility database. The facility's access control system then checks the TWIC's CHUID to assure that the TWIC is still valid (unexpired) as well as checks the list of cancelled TWICs to ensure that it has not been revoked for any other reason. Upon verification that that the TWIC is valid and the employee's biometric matches the associated template, the facility access control system allows access to secure areas as dictated by the permissions established by the owner or operator in the access control system. By virtue of the fact that the employee would not be entered into the facility's access control system without first having an authenticated TWIC, the requirement to possess a TWIC for unescorted access to secure areas is met. The requirement for a biometric match of the employee is met through the performance of a match to the biometric template, in this case a fingerprint stored on the facility access control system. Additionally, we note that although a biometric template is the particular biometric measurement used in the TWIC application process, an alternative biometric may be used to perform the identity verification check required by the regulations so long as the method is approved in the security plan. For example, as two commenters suggested, a vascular scan could be stored on a facility's access control system instead of a fingerprint, which could be useful in situations where some employees have difficult-to-read fingerprints. a. List of Acceptable TWIC Readers In the NPRM, the Coast Guard proposed that only certain TWIC readers would be permitted to be used for purposes of electronic TWIC inspection. As stated above, proposed § 101.520(a)(1) read, “[p]rior to each entry, all persons must present their TWICs for inspection using a TWIC reader, . . .”. The term “TWIC reader” was defined in proposed § 101.105 as “an electronic device listed on TSA's Qualified Technology List . . .”. Thus, by operation of the proposed regulatory text, TWIC readers listed on the QTL would be required at access points to secure areas on facilities and at the entrances to vessels requiring electronic TWIC inspection. TSA had not published the QTL at the time of publication of the NPRM. Thus, in its discussion regarding the types of approved TWIC readers, the NPRM reiterated guidance from PAC-D 01-11 regarding the use of TWIC readers to meet the existing regulatory requirements for effective identity verification, card validity, and card authentication. 34 Specifically, in that guidance document, we stated that: 34 78 FR 17805. In accordance with 33 CFR 101.130, the Coast Guard determines that a biometric match using a TWIC reader from the TSA list of readers that have passed the Initial Capability Evaluation (ICE) Test (available at: http://www.tsa.gov/assets/pdf/twic_ice_list.pdf ) to confirm that the biometric template stored on the TWIC matches the fingerprint of the individual presenting the TWIC meets or exceeds the effectiveness of the identity verification check. The NPRM also noted that, in accordance with the guidance, “TWIC readers allowed pursuant to PAC-D 01-11 may no longer be valid after promulgation of a TWIC reader final rule, and DHS will not fund replacement of TWIC readers.” 35 35 78 FR 17805. In recognition of advancing technology and standards, and to provide further flexibility to the end user that may meet business specific needs, this final rule does not require a TWIC reader from the TSA's QTL, accessible online at http://www.tsa.gov/stakeholders/reader-qualified-technology-list-qtl. Instead, the Coast Guard is permitting multiple options for the implementation of electronic TWIC inspection. The first option for meeting these needs within this final rule remains the mechanism proposed in the NPRM, which is the use of TWIC readers listed on the QTL. These TWIC readers are defined as “Qualified Readers.” We believe that this option is most appropriate for vessels or facilities that currently do not conduct electronic TWIC inspection and are seeking a TWIC reader determined to be in conformance with the TWIC Reader Hardware and Card Application Specification, available in the online docket for this rulemaking. The QTL continues to remain useful for this and other purposes. A similar option would be to use a TWIC reader that is not on the QTL. While such electronic readers are not prohibited by this rule, they must still meet the performance requirements of § 101.520. This performance-oriented option is intended to provide more options to users to meet their individual needs while still relying on the TWIC as an access control credential. Another option would be to use an electronic reader or combination of separate devices—such as proximity readers, biometric readers, and PIN pads—that would transmit the information from the TWIC and individual seeking access to software that performs the card authentication, card validity check, and biometric identification functions required in § 101.520. We refer to this arrangement as a “Transparent Reader.” In this case, for example, a Transparent Reader would read the information from the TWIC along with the biometric sample provided by the individual and transmit it to a back end system containing software that performs the TWIC check. Once the TWIC check is complete, the back end system would perform what processes are required to either grant or deny access. This option may be highly popular with facilities that have already invested in electronic reader infrastructure and high tech software systems that may not be on the QTL. In this case, much as a situation with a PACS, the operator may have to add a biometric component, if not already in place, and modify software to include TWIC compatibility, but would not have to replace the entire system. The last option, described in detail above, would be the use of an existing PACS, with the inclusion of biometrics, with a facility-specific access card that uses the TWIC as the baseline credential. This is purely a performance requirement, and would not require the use of government-approved equipment. In this case, the PACS would be required to match the TWIC against the list of cancelled TWICs and, if positively matched, automatically cancel the facility access card so as to not allow unescorted access to secure areas of the facility. Several commenters provided comments that addressed the specific types of approved card readers, but we believe that many of the concerns raised by commenters are resolved by the Coast Guard moving to a more flexible series of options for conducting electronic TWIC inspection. One commenter in a public meeting expressed concern that there was not an approved card reader which he could use for cost estimates. We note that the TSA now has a list of approved TWIC readers, which is available on the Coast Guard's Homeport site. 36 One commenter suggested that this rule was not in alignment with the TSA's Request for Information regarding development of the QTL. We disagree, and note that the Coast Guard and TSA worked closely in developing and implementing the electronic TWIC inspection requirements. Furthermore, we note that with the additional flexibility afforded by this final rule, equipment to conduct electronic TWIC inspections is available at a wide variety of prices, depending on the manner in which electronic TWIC inspection is conducted. Additional information on cost estimates is provided in the final RA accompanying this final rule. 36 We have also included the current version of the list in the docket USCG-2007-28915. Additionally, one commenter requested that software be included on the QTL. We note that the list of TWIC readers on the QTL includes TWIC reader and software pairings. Beyond the physical aspects of TWIC reader testing in terms of environmental or drop testing, a large portion of what is tested in the QTL process is the software. Other commenters suggested that, based on the TWIC Pilot Program, TWIC reader technology is still not ready for requiring TWIC readers at facilities, and requested that this final rule be delayed. Similarly, one commenter recommended that the Coast Guard only proceed with the rule if it was confident in the reliability of existing TWIC readers. We believe that not only has technology continued to improve, but also additional flexibility has been afforded in this final rule, both of which should alleviate problems with specific TWIC readers used in the pilot. Vessels and facilities required to conduct electronic TWIC inspection can choose from a wide variety of means so as to meet their budget and operational needs. Furthermore, the flexibility built into this final rule allows for future advancement of both card and reader technologies in a manner that will provide for further reductions in impact on business operations of the maritime industry. b. PIN Pads and Biometric Input Methods One issue raised in the ANPRM was the use of PINs as part of the identification process. We note that upon getting a TWIC, each TWIC-holder is required to remember a PIN. As proposed in the NPRM, under most circumstances, the TWIC-holder would not be required to provide the PIN when seeking access to secure areas, except as a backup measure when the TWIC-holder's biometric template is unreadable. For this reason, there is no requirement that access control systems have the capability to accept a PIN. Comments relating to the use of PINs were generally negative. Several commenters specifically argued against the use of PINs. Some commenters stated that because the PINs are rarely used, they are seldom remembered by TWIC-holders. We agree that rarely-used PINs will likely be forgotten, and thus the only people who would likely remember their PINs are those who use them regularly, such as those with impaired biometrics. Similarly, one commenter stated that 100 percent of cardholders would need to visit one of the TWIC enrollment centers to reset or establish a new PIN in the event that the Coast Guard required PIN entry, implying that without regular use of PINs, they are quickly forgotten. PINs would not be required or permitted as a substitute for biometric identification of most users. Instead, this rule provides that PINs are available as an alternative only for individuals whose biometrics can not be read. The Coast Guard recognizes that for some people, taking a biometric read can be problematic. For example, people with severely injured fingers are often unable to have their fingerprints read. For such cases, the final rule provides an alternative means to ensure identity verification. As stated in § 101.520(c)(2), the use of a PIN plus a visual TWIC inspection is an acceptable alternative to a biometric match for individuals who are unable to have their biometric template captured at enrollment or who have unreadable biometrics due to injury after enrollment. For that reason, owners and operators may find it expedient to include an electronic reader with a PIN pad in at least some of their access control locations to accommodate people with unreadable biometrics. 3. Comments Related to Troubleshooting TWIC This section elaborates on certain programmatic issues relating to electronic TWIC inspection, specifically, how to address problems arising if either the electronic reader or access card malfunctions. In this section, we elaborate and expand on the provisions described in the NPRM as well as address issues raised by commenters. In the NPRM, the Coast Guard proposed regulations in § 101.535 that laid out requirements for TWIC inspection in special circumstances where a malfunction in the TWIC inspection system has occurred. In paragraph (a), we described how access could be granted in the event of a lost, stolen, or damaged TWIC card. In paragraph (b), we proposed how access could be granted in the event that a person's biometric template could not be read due to either technology malfunction or the inability of an individual to provide a biometric template. In paragraph (c), we proposed that in the event of a TWIC reader malfunction, an individual could still be granted unescorted access to secure areas for a period not to exceed 7 days, provided that individual has been granted such unescorted access in the past and is known to possess a TWIC. We note that the period in paragraph (c) was extended to 37 days in CG-FAC Policy Letter 12-04. Because the final rule, as written, sets forth a requirement for electronic TWIC inspection rather than specifically requiring that a TWIC be read by a TWIC reader, the text of this section needs some alterations to account for the new flexibility. We have integrated these alterations into the final regulatory text as detailed in the sections below. Furthermore, we have considered the requests and arguments of various commenters, and we are integrating many of the ideas presented into the final rule. Finally, we have attempted to modify and clarify the regulations where appropriate. a. Lost, Stolen, or Damaged TWIC The NPRM proposed that if an individual cannot present a TWIC because it has been lost, damaged, or stolen, the individual could be granted unescorted access for a period of up to seven days if various conditions were met. The conditions include the individual previously having been granted unescorted access, being known to have had a TWIC, being able to present alternative identification, and having reported the TWIC as lost, stolen, or damaged to the TSA. This proposed language was derived from existing requirements in 33 CFR parts 104 through 106. Additionally, in CG-FAC Policy Letter 12-04, the Coast Guard allowed an individual to be granted unescorted access for an additional 30 days (for a total of 37 days of unescorted access), if the individual provided proof that a replacement TWIC had been ordered. Policy Letter 12-04 also allowed unescorted access to those individuals with expired TWICs who had applied for a TWIC renewal prior to expiration. i. Vessels and Facilities Using a PACS Because the final rule provides more flexibility for electronic TWIC inspection beyond presenting a TWIC for access control purposes, some of the issues addressed in § 101.535 are significantly different if using a PACS to perform the electronic TWIC inspection. For example, if an employee's TWIC is stolen and the theft is reported to the TSA, the affected TWIC will be placed on the list of cancelled TWICs, but the employee will still be registered in the facility's PACS. However, upon attempting to gain access to a secure area, during the card validity check, the affected TWIC will appear on the list of cancelled TWICs, and thus fail the check. The revised final regulations are designed to allow a procedure where the employee can still be granted unescorted access until he or she can obtain a replacement TWIC and update his or her profile in the facility access control system with the information from the new TWIC. In this final rule, we have added § 101.550(b), which allows unescorted access to secure areas to be granted by a facility operator for a period of up to 30 days if the TWIC appears on the list of cancelled TWICs if the individual is known to have had a TWIC and to have reported it lost, damaged, or stolen. Example: An individual who works at a facility where the PACS has been linked to a TWIC card reports his or her TWIC as lost. When presenting his or her facility access card to the PACS, the card validity check will return a TWIC on the list of cancelled TWICs because the TWIC has been reported lost. The FSO confirms that the TWIC was reported as lost. In that instance, the PACS will recognize the status of the TWIC as cancelled, but can still grant unescorted access to secure areas to the individual for a period of up to 30 days. If, after 30 days, the individual has not linked their facility access card to a valid TWIC, the PACS would have to deny unescorted access to secure areas to that individual. ii. Vessels and Facilities Using TWIC Readers We proposed in § 101.535 that vessel or facility operators using TWIC readers allow for temporary access in the case of a lost, stolen, or damaged TWIC. Specifically, the Coast Guard proposed that if a person is known to have had a TWIC, has previously been granted unescorted access, and can present another form of acceptable identification, and there are no other suspicious circumstances, then the operator may grant that person access for 30 days so that they can be issued a new TWIC. We received a wide variety of comments relating to the issue of lost or stolen TWICs. One commenter argued that any allowance for malfunctioning TWICs undermines the point of having the card at all. We disagree, and note that the procedure is necessary to ensure smooth operation of the TWIC system, and believe it contains enough safeguards so as not to function as a loophole in security. One commenter recommended splitting the CCL into separate categories, including categories of TWICs invalidated for “administrative reasons.” We disagree, because the list of cancelled TWICs is intended to help screen out invalid cards regardless of the reason. Many commenters argued that the 7-day period proposed in § 101.535(a) is too short, and that the period should be extended, with a significant number of these commenters referring to the 30-day extension of the 7-day period permitted by CG-FAC Policy Letter 12-04. Based upon the comments received, which indicated that it can take longer than 7 days to be issued a new TWIC, we have decided to include a 30-day period for this situation in section 101.550(b) of the final rule. We believe that this provides ample time to be issued a new TWIC, without presenting an undue security risk. When effective, this regulation will supersede the current guidance in CG-FAC Policy Letter 12-04, which allowed for a total of 37 days. b. Transportation Worker Forgets To Bring TWIC To Work Site The existing regulations in 33 CFR parts 104 through 106, the policy arrangements in CG-FAC Policy Letter 12-04, as well as the proposed regulations in § 101.535, only grant unescorted access to those individuals whose TWICs have expired or have reported their TWIC as lost, stolen, or damaged to the TSA. For all other individuals who fail to present a TWIC, unescorted access would be denied under proposed § 101.535(d). Thus, under the proposed regulation, an employee who forgot his or her TWIC at home would not be permitted unescorted access to the facility, whereas an employee whose TWIC was stolen would be permitted unescorted access for a limited period of time. We received one comment relating to the issue of forgotten TWICs from a commenter who described such a situation in their submission to the docket for this rulemaking. This commenter suggested that we add an allowance for persons who forgot their TWIC at home. After reviewing comments on the proposed rule, we reiterate our existing position that persons who cannot present a valid TWIC, and have not reported their TWIC as lost, stolen, or damaged to the TSA, may not be granted unescorted access to a vessel or facility. We believe that providing an exemption for forgotten TWICs creates a potential degradation in security and additional risks that outweigh the benefits. Unlike the situation where a TWIC has been reported as stolen or lost to the TSA and is therefore no longer valid which can be verified by checking the list of cancelled TWICs, a claim of a forgotten TWIC cannot be validated. Instead, we reiterate that under current regulation at § 101.514(a), unless exempted from the TWIC requirements by § 101.514(b), (c), or (d), all persons must physically possess a TWIC, or undergo electronic TWIC inspection, prior to being granted unescorted access to a secure area of a vessel or facility. Persons who do not physically present a TWIC or undergo electronic TWIC inspection, and have not reported their TWIC as lost, stolen, or damaged to the TSA, may not be granted unescorted access. c. Inaccessible Biometrics In the NPRM, we proposed two secondary authentication procedures that could be followed in the event that a person's biometric template could not be read by a TWIC reader or PACS due to a technology malfunction or low quality biometric template. These alternatives were listed in proposed § 101.535(b), and allowed either the input of a PIN or the use of an alternative biometric that has been incorporated into the PACS. Given the change from requiring a TWIC reader to requiring electronic TWIC inspection, some changes to this section are needed as well. We discuss changes to this section and comments received below. One commenter suggested that people with unreadable biometric templates should be allowed to use a PACS card in addition to a PIN or alternate biometric. We agree, and note that under the final regulations, given that input of biometric information (including alternatives to fingerprints) into a PACS reader may now be a common manner of completing identification verification, the use of a PACS card in conjunction with an alternative biometric will be an accepted regular way to conduct an electronic TWIC inspection. However, upon consideration, we do not believe that the input of a PIN alone is equivalent to biometric identification. Biometric identification allows the facility to ascertain with a high degree of certainty whether the individual requesting access is the TWIC-holder. On the other hand, commenters noted that other methods of identification verification will not detect counterfeit, stolen, or borrowed TWICs. Similarly, the use of a PIN alone will not detect a borrowed TWIC or PACS card or, potentially, a stolen TWIC or PACS card, if the PIN has been illicitly obtained. Nonetheless, the Coast Guard believes that a method for accommodating persons with unreadable biometrics is important. In such cases, we believe that visual TWIC inspection, when combined with the PIN, provides enough certainty as to be an acceptable alternative to biometric identification. Combining visual identification with the PIN will help to ensure that stolen and borrowed cards are difficult to use. Thus, in this final rule, we are modifying the provision in proposed § 101.535(b), which allowed for PINs to be used in lieu of biometric matching, to include a requirement for visual identification in addition to the PIN. The new provision is located in § 101.550(c) of this final rule. We believe that this provision would present few problems, as people could use their TWICs for visual identification. Alternatively, if a PACS PIN is assigned and stored in the access control system, an employee with unreadable biometrics could enter his or her PIN and present a PACS card or driver's license to conduct a visual identification check. d. Malfunctioning Access Control Systems In the NPRM, we proposed a mechanism by which persons could be granted unescorted access to secure areas if a TWIC reader malfunctioned. Specifically, proposed § 101.535(c) allowed owners and operators to use visual checks for a period of 7 days if a TWIC reader malfunctioned. In light of the change in this final rule from the required use of TWIC readers to the more flexible requirement for electronic TWIC inspection for Risk Group A vessels and facilities, we are making some conforming changes and clarifications to this procedure. We received several comments on the matter, which are addressed below. Upon consideration of this policy, we believe that a clause automatically allowing the use of visual TWIC inspections in lieu of biometric matching presents a serious security concern. As one commenter argued, any allowance for malfunctioning TWICs undermines the point of having the card at all. The Coast Guard agrees, and believes that allowing the use of visual TWIC inspections in lieu of biometric matching degrades security. This final rule represents a concerted effort to significantly upgrade the security at a relatively small group of high-risk vessels and facilities. Given the importance of security, we would not expect vessels or facilities to have only a single TWIC reader, but expect some redundancy in the system, and note that two commenters strongly echoed the view that redundancy is needed in any critical system. We would agree that, as a practical matter, the minimum number of electronic readers (either dedicated TWIC readers or those integrated into a PACS) at a facility or onboard a vessel would be two, in case one malfunctioned. As discussed in the RA, using the TWIC pilot data we estimated the average number of electronic readers required by this final rule by facility and vessel types at a minimum 2 per vessel and 4 per facility (Tables 4.3 and 4.4 of the RA). While the TWIC readers on the QTL have been tested to ensure a degree of reliability, there are many factors external to the testing process that could cause any one individual electronic reader to fail. The immediate availability of a backup electronic reader should one fail (as documented in the relevant security plan) would allow a vessel or facility to maintain the appropriate level of security for access control and continue operating without further burden. Due to the security concerns discussed in this paragraph, we are removing from the final rule the proposed provision in § 101.535 that would have permitted automatic transition to visual TWIC inspections in the event of an electronic reader malfunction. As stated above, based on discussions with industry we expect that owners and operators will have an additional functioning electronic reader to use in those instances in case of equipment failures or malfunctions (§§ 104.260(c) and 105.250(c)). If the owners and operators plan for malfunctions as existing regulations require, there should be no significant disruption of operations. Further, in the unlikely event that both primary and redundant electronic readers malfunction, the owner or operator could obtain permission from the Captain of the Port (COTP) to continue operating. Two commenters suggested changing the language in proposed § 101.535(c) from a “reader malfunction” to “in the event of an access control system failure,” noting that many other systems (such as the software or electricity) could fail, thus rendering an electronic reader inoperable. As we are deleting this exemption in this final rule, the language question is no longer at issue. Commenters also suggested that 7 days is not sufficient to correct all problems that can result in a TWIC malfunction. They noted that it might take longer to procure parts, especially after a major regional disaster or holiday, and that a 15-day period where visual TWIC inspection is permitted would be more reasonable. On the other hand, one commenter suggested that it should take only hours to repair a malfunctioning TWIC reader. In this final rule, we are removing this provision. Thus, restoration of an access control system will be handled in accordance with the procedures for the reporting requirements for non-compliance in §§ 104.125, 105.125, and 106.125, which require the owner or operator to notify the cognizant Captain of the Port and either suspend operations or request and receive permission from the COTP to continue operating. Similarly, in the event of a total system collapse or regional disaster, the COTP will work with the affected organization to restore an access control system as expeditiously as possible. The following examples provide illustrations relating to scenarios involving the failure of an access control system: Example: A facility using TWIC readers at five access points suffers equipment failure of TWIC readers at two of those access points. The facility would still be able to permit unescorted access through the remaining three access points. Unescorted access could also be granted using portable TWIC readers at the two affected access points immediately in accordance with the FSP. The facility would be required to notify the COTP that this equipment failure took place but could continue operations using the remaining TWIC readers. Example: A computer virus causes a facility's PACS to become completely inoperable, but the FSP contains an alternative where access is controlled through the use of portable TWIC readers, compliant with § 101.520, at each access point to secure areas. The facility would be required to notify the COTP that such a failure of the PACS had occurred, but could continue operations uninterrupted by using the portable TWIC readers. Example: A computer virus causes a facility's PACS to become completely inoperable, and the FSP does not contain an alternative means of conducting electronic TWIC inspection. The owner or operator could request permission from the COTP to conduct visual TWIC inspections for a limited time until the PACS is operational. Grants of unescorted access to secure areas would have to be suspended until such permission was granted by the COTP. Multiple commenters suggested that in the event that a TWIC reader malfunctions, a facility should be immediately able to continue to process workers using an alternative means defined in a security plan, rather than requesting approval from the COTP to do so. One commenter also suggested that an after-the-fact review by the Coast Guard could be used in such circumstances. We note that the proposed text of § 101.535(c) in the NPRM did not propose to require COTP authorization to allow continuing operation for a period of 7 days, so we are unsure of the provision to which the commenter may be referring. Nonetheless, the final regulatory text allows a facility to immediately continue to process workers using an alternative means as defined in an approved security plan as required by §§ 104.260(c) and 105.250(c) without additional COTP approval. One commenter suggested that the Facility Security Officer (FSO) should be able to determine if there are mitigating circumstances that need to be implemented for a temporary time frame. In such a case, the commenter suggested that the facility would conduct visual identification verification in lieu of electronic TWIC inspection. We disagree with this suggestion, for the reasons described above. The commenter also requested that the COTP be able to waive TWIC requirements in certain circumstances. We note that the COTP has the power to waive requirements or impose alternative equivalent measures generally. One commenter requested clarification on procedures to be used if TSA's Web site is inaccessible and they are unable to access updates to the CCL. In general, the owner or operator of an access control system is required to download the TSA-supplied list of cancelled TWICs (currently, the CCL) periodically, depending on the MARSEC level, pursuant to § 101.525 of this final rule. However, if the problem with downloading the list is out of the operator's control, such as the TSA Web site being down for an extended period of time, we would consider it acceptable to continue to operate the access control system by using the most recent version of the list available. e. Requirements for Varying MARSEC Levels In the NPRM, we proposed requirements for Risk Group A vessels and facilities that would vary based on the MARSEC level. MARSEC levels are set to reflect the prevailing threat environment of the maritime transportation system, including ports, vessels, facilities, and critical assets and infrastructure located on or adjacent to waters subject to the jurisdiction of the United States. Specifically, we proposed to require that at MARSEC Level 1, during the card validation process, a TWIC must be checked against a version of the list of cancelled TWICs that is no more than 7 days old. However, at higher MARSEC levels, we proposed that the version of the list used to conduct the card validity check be no more than one day old. Several commenters responded to this issue, and offered remarks relating to the use of MARSEC levels overall. One commenter agreed with the Coast Guard's proposal to require, at a minimum, weekly updates of the CCL at MARSEC Level 1 and daily updates of the CCL at higher MARSEC levels. Another commenter stated that we did not adequately clarify how different MARSEC levels would interact with Risk Groups A, B, and C. In response, we note that vessels and facilities that were proposed to be classified as Risk Groups B or C are not affected by this final rule, and that MARSEC interacts with Risk Group A as described in § 101.525. We have moved the MARSEC level requirements to this separate section to improve clarity. Several commenters suggested that electronic TWIC inspection should only consist of card validation and card authentication at MARSEC Level 1, and that the Coast Guard should provide the flexibility for them to use electronic TWIC inspection for biometric matching purposes at higher MARSEC levels, or require it only at those levels. Other commenters recommended that electronic TWIC inspection should only be required once per day at MARSEC Level 1, with additional measures, such as full electronic TWIC inspection or random spot checks, implemented only at higher MARSEC levels. One commenter recommended that electronic TWIC inspection be used only at higher MARSEC levels, with visual TWIC inspections performed the rest of the time. We disagree with these suggestions. We believe that Risk Group A vessels and facilities should be secured at all times, not just at rare moments of heightened alert, and that biometric identification, one of the TWIC's strongest security features, should be used regularly. Based on the experience with the pilot, we also believe that consistency in electronic TWIC inspection processes is important, as varying use of security features can create confusion that can hinder operations. One commenter suggested that the CCL should be updated daily at all MARSEC levels, not just at MARSEC Levels 2 and 3. Similarly, one commenter stated that the CCL should be continually updated at all times. The commenter stated that once an automated method is established to do this, there is no additional cost associated with the increased frequency. While we do agree that, if automated, it is simple to update the list of cancelled TWICs, we note that not all operators use an automated system at this time. While we realize that some larger operations can set up automatic updates of the list, other operations may need to conduct such updates manually. In our RA, we calculated that it takes 30 minutes to update the CCL. For that reason, we have only required in 33 CFR 101.525 that the list of cancelled TWICs be updated daily during periods of heightened risk according to the specified MARSEC level. We note that the required periods to update the list are considered minimum requirements, but operators are free to update more often if desired. One commenter asked if electronic TWIC inspection requirements should be applied to Risk Groups B and C at higher MARSEC levels. We do not believe it should. This would require those vessels and facilities to purchase and install equipment for electronic TWIC inspection for use during those periods of heightened alert, dramatically increasing the costs of the rule for what we believe is, at this time, comparatively little corresponding benefit. Furthermore, changing electronic TWIC inspection procedures at irregular and long-spaced intervals can cause confusion that could impair operations. 4. Recordkeeping Requirements In the NPRM, the Coast Guard proposed specific recordkeepi [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2016-19383. Public record. Not legal advice.