DHS Review of Existing Regulations - MTSA 2002

On May 18, 2011, DHS issued the Preliminary Plan for Retrospective Review of Existing Regulations. http://www.whitehouse.gov/files/documents/2011-regulatory-action-plans/DepartmentofHomelandSecurityPreliminaryRegulatoryReformPlan.pdf

This plan is executed in accordance with “Executive Order 13563 (which) requires each Executive Branch agency to develop a preliminary plan to periodically review its existing regulations to determine whether any regulations should be modified, streamlined, expanded, or repealed so as to make the agency’s regulatory program more effective or less burdensome in achieving its regulatory objectives.”

Review of MTSA 2002 (MTSA II) is briefly addressed in this plan. The reason for review of MTSA 2002 is to “clarify MTSA requirements in response to requests for interpretation and guidance.”

“DHS received a comment regarding application of the Maritime Security Act of 2002 (MTSA) to the Great Lakes area that recommended the creation of exemptions from MTSA requirements for certain facilities and vessels. The Coast Guard has already initiated a rulemaking to review the Coast Guard regulations implementing MTSA in 33 CFR chapter 1, subchapter H. One of the reasons the Coast Guard initiated this rulemaking is to address requests for interpretation and guidance in complying with subchapter H. The Coast Guard is working on a notice of proposed rulemaking (NPRM) and will address this comment when considering all comments received in response to the NPRM.”

There is no timetable given for the issuance of the NPRM.

FY 2011 PSGP Solicitation Issued

Yesterday DHS/FEMA issued the solicitations for the FY 2011 Preparedness Grants. The port security grant guidelines can be found at http://www.fema.gov/pdf/government/grant/2011/fy11_psgp_kit.pdf.The total amount of funds distributed under the FY 2011 PSGP will be $235,029,000.Because FEMA will need to conduct an initial review of the application prior to the submission deadline of June 20, 2011, grantees are encouraged to initiate and complete the Standard Form 424 submission within Grants.gov by no later than June 13, 2011. There is once again no cost match for this grant, it is deemed waived. Priorities for this grant are:

· Enhancing Maritime Domain Awareness (MDA)

· Enhancing Improvised Explosive Device (IED) and Chemical, Biological, Radiological, Nuclear, Explosive (CBRNE) prevention, protection, response and supporting recovery capabilities

· Port Resilience and Recovery Capabilities

· Training and Exercises

· Efforts supporting implementation of the Transportation Worker Identification Credential (TWIC)

Regarding training and exercises, it is noted that MARAD-approved training is not eligible to be funded under this grant. Regarding using PSGP funds for TWIC issues, applicants need to read the fine print in the FEMA guidance documents cited in the solicitation. Fees associated with the application for and issuance of the TWIC cards themselves are ineligible for award consideration. Allowable costs under this section include those projects that will ensure the safe and secure transit of foreign seafarers and shore staff/support [who are not eligible for TWIC] to and from the vessel while at MTSA regulated facilities. PSGP TWIC funding recipients may be required to provide data and lessons learned from the application of card readers and associated systems. Systems implemented with grant funding may be used by recipients to comply with all TWIC rulemaking requirements once established.

MUST READ: Houston/Galveston AMSC Facility Security Work Group TWIC Reader Task Group (TRTG) Meeting Minutes for March 31.

I was contacted by Don Bruce of the Houston/Galveston AMSC. He sent me the transcript of the AMSC Facility Security Work Group TWIC Reader Task Group (TRTG) meeting minutes for March 31. The subject of the meeting was a TSA TWIC Program Office presentation. The Facility Security Work Group is a subgroup of the AMSC, tasked with focusing on all aspects of facility security, monitoring pending regulatory requirements; identifying security-related issues; identifying best practices and mutually agreeable solutions; communicating lessons learned and/or recommendations, and implementing outreach.

In his email to me, Mr. Bruce describes the meeting minutes as the most forthcoming explanation of the current status of the TWIC Pilot Test, TWIC Reader Rule, TWIC ICE List, TWIC Lessons Learned, TWIC Alternate Biometric Process, etc. that exists. I agree wholeheartedly. The text is available at http://www.fswg.org/files/DDF/4%20TRTG%20Meeting%20Minutes%20%203-31-11%20%20%28TSA-Transcript%29.pdf

Major contributors to this meeting were Don Bruce, Chairman of two AMSC Facility Security Work Group (FSWG) Subcommittees, the Access and Regulatory Subcommittees; Walter Hamilton, senior consultant for Identification Technology Partners out of Gaithersburg, Maryland. This company is the TWIC contractor for TSA TWIC program office. He is also chairman and president of the International Biometrics and Identification Association (IBIA) which is a nonprofit trade organization based in Washington, DC; John Martin of JTAC Consulting, who was employed by BearingPoint as Operations Manager of the TWIC program and was responsible for all of the initial TWIC pilot deployments and the Independent Verification & Validation (IV &V) testing; John Schwartz, Program Manager for the TWIC program for TSA; Michael Plostock, TWIC Pilot and ICE (Initial Capability Evaluation) List Project Manager; and Don Bruce

If you are affected by the TWIC program, or affected by MTSA regulations, you need to read these meeting minutes. The transcript has been annotated/highlighted by topics, which is very helpful. Among the many, many useful bits of information in these notes is a reinforcement of the news on PIN usage: neither TSA nor the USCG will be requiring PIN usage. p. 12.

This working group has also developed a TWIC Access Control Questionnaire. From this questionnaire, they are developing a Lessons Learned report that should be published shortly. p. 15. Concerning alternate technologies to fingerprints for verifying identity, “The FIPS 201 standard is being modified to incorporate Iris technology as an alternative biometric to fingerprint which can also be stored on the chip in addition to fingerprint templates or in lieu of fingerprint templates in the event that an individual can’t present a high enough quality fingerprint image. “ Walter Hamilton, p. 15.

Congratulations to this active AMSC working group, for furnishing this high-quality information in an extremely readable format. These meeting minutes are just one example of the excellent work product of this committee. The site at http://www.fswg.org is a wealth of information for the MTSA community in general.

GAO-11-657, Transportation Worker Identification Credential: Internal Control Weaknesses Need to Be Corrected to Help Achieve Security Objectives.

On May 10, 2011, the Government Accountability Office issued GAO-11-657, Transportation Worker Identification Credential: Internal Control Weaknesses Need to Be Corrected to Help Achieve Security Objectives. This is an important report for owners and operators of regulated facilities and vessels to consider.

To boil it down to essentials, the report addresses the vexing question, does the TWIC program do what it is supposed to do, does it produce reasonable assurance that unescorted access to secure areas of MTSA-regulated facilities and vessels is limited to qualified individuals? To come to an answer, GAO studies the TWIC program from from November 2009 through March 2011 and used the following data and procedures to come to their conclusions:

• · reviewed applicable laws, regulations, and policies.

• · reviewed documentation provided by TSA on the TWIC program systems and processes, such as the TWIC User Manual for Trusted Agents, Statement of Objectives, and Concept of Operations.

• · reviewed the processes and data sources with TWIC program management from TSA and Lockheed Martin (the contractor responsible for implementing the program).

• ·met with (1) the Director of Vetting Operations at TSA’s Colorado Springs Operations Center (CSOC), where background checks for links to terrorism and continual vetting of TWIC holders is to take place;

• met with the Operations Manager for the Adjudication Center, where secondary background checks are to be conducted for applicants with identified criminal or immigration issues;

• met with the Director at DHS’s Screening Coordination Office responsible for overseeing credentialing programs across DHS.

• met with the Criminal Justice Information Services Division at the Federal Bureau of Investigation (FBI) to discuss criminal vetting processes and policies

• evaluated the processes against the TWIC program’s mission needs and Standards for Internal Control in the Federal Government.

• visited four TWIC enrollment and activation centers located in areas with high population density and near ports participating in the TWIC pilot to observe how TWIC enrollments are conducted.

• had GAO investigators conduct covert testing at enrollment center(s) operating at the time to identify whether individuals providing fraudulent information could acquire an authentic TWIC.

• visited or met with officials at each of the seven original pilot sites being used to test TWIC card readers, interviewed port security officials at two additional ports responsible for implementing TWIC at their port, and met with nine maritime or transportation industry associations to obtain information on (1) the use of TWIC as a flashpass and with biometric readers where they are in use, (2) experiences with TWIC card performance, and (3) any suspected or reported cases of TWIC card fraud.

• met with TWIC program officials from TSA and the Coast Guard, as well as Coast Guard officials responsible for assessing maritime security risk, and reviewed related documents, to identify how TWIC is to enhance maritime security.

• met with Coast Guard TWIC program officials, data management staff, and Coast Guard officials stationed at four port areas across the United States with enforcement responsibilities to assess the agency’s approach to enforcing compliance with TWIC regulations and measuring program effectiveness.

• reviewed the type and substance of management information available to the Coast Guard for assessing compliance with TWIC.

• evaluated the Coast Guard’s practices against TWIC program mission needs and Standards for Internal Control in the Federal Government. (pp. 4-7.)

GAO notes that the information they gained at the port visits cannot be generalized across the system as a whole but that “the ports we visited accounted for 56 percent of maritime container trade in the United States, and the ports our investigators visited as part of our covert testing efforts accounted for 54 percent of maritime container trade in the United States in 2009.” p.6.

Within the broad regulatory requirement of the provision of a common credential for all transportation workers across the United States who require unescorted access to secure areas at MTSA-regulated maritime facilities and vessels, the TWIC program also seeks to:

1. Positively identify authorized individuals who require unescorted access to secure areas of the nation’s transportation system.

2. Determine the eligibility of individuals to be authorized unescorted access to secure areas of the transportation system by conducting a security threat assessment.

3. Ensure that unauthorized individuals are not able to defeat or otherwise compromise the access system in order to be granted permissions that have been assigned to an authorized individual.

4. Identify individuals who fail to maintain their eligibility requirements subsequent to being permitted unescorted access to secure areas of the nation’s transportation system and immediately revoke the individual’s permissions. (p.9.)

According to the GAO, how well is the program meeting these goals? The agency identified the following major weaknesses:

• Internal controls in the enrollment and background checking processes are not designed to provide reasonable assurance that (1) only qualified individuals can acquire TWICs; (2) adjudicators follow a process with clear criteria for applying discretionary authority when applicants are found to have extensive criminal convictions; or (3) once issued a TWIC, TWIC holders have maintained their eligibility. An example of this weakness is the admission by TSA that if a worker obtains a valid TWIC by fraudulent means, that person is deemed not to be a security threat to the maritime environment because a holder of a valid TWIC is presumed to have met TWIC-related qualifications during a background check. The report contains the following startling statement: “TWIC program officials told us that control weaknesses were not addressed prior to initiating the TWIC program because they had not previously identified them, or because they would be too costly to address. “ p.17. GAO investigators went to TWIC enrollment centers, declared themselves US citizens who needed a TWIC, passed the process, and received their cards. During this enrollment, the GAO investigators provided counterfeit or fraudulently acquired documents, but they were not detected. The trusted agents performing the enrollment are given rudimentary training in detecting fraudulent documents. Proof of citizenship is also an issue. As of December 1, 2010, nearly 86 percent of approved TWIC enrollments were by self-identified United States citizens or nationals asserting that they were born in the United States or a United States territory. p. 19. The TWIC program does not require that applicants claiming to be U.S.-born citizens or nationals provide identity documents that demonstrate proof of citizenship, or lawful status in the United States. p.19 49 CFR require the applicant to disclose the reason that he needs the card, and the locations where it will be used, but this provision is not enforced in the enrollment process. There is no way to tell if persons being issued TWICS really need them.

• “In determining whether an applicant poses a security threat, TSA officials stated that adjudicators have the discretion to consider the totality of an individual’s criminal record, including criminal offenses not defined as a permanent or interim disqualifying criminal offenses, such as theft or larceny…TSA may determine that an applicant poses a security threat if the search conducted reveals extensive foreign or domestic criminal convictions.” p.24-25. TSA has not developed guidance for adjudicators to apply consistently across the system when dealing with the totality of an individual’s criminal record. This is especially important when viewed in the light of the fact, that, at the time of enrollment, approximately 27 percent of individuals approved for a TWIC had a criminal record based on results obtained from the FBI. p.25. Difficult as it is to believe, out of the universe of 460,786 applications with criminal records, 1 application was denied because of an offense not designed as a permanent or interim offense. p.26.

• In order to determine if a cardholder has committed a prohibited offense after obtaining a TWIC, TSA conducts name-based checks against federal wants and warrants. TSA is unable to run a more accurate fingerprint-based FBI check if the prints are more than a year old because the FBI would charge TSA $17.25 per check. p.. 27. GAO states that TSA has not explored other less costly means of verification, such as tapping into means already available to maritime stakeholders.

• If a person obtains a TWIC card on the strength of a visa that is about to expire, TSA does not require that person to show proof that they have legal status in the U. S.

• GAO investigators used counterfeit TWIC’s, valid TWIC’s acquired through fraudulent means, and fraudulent reasons for needing unescorted access to access secure areas of MTSA facilities. In cases where a secondary port identity card was needed, they were not able to obtain unescorted access. P. 30.

• GAO states that “DHS has not demonstrated that TWIC, as currently implemented and planned with readers, is more effective than prior approaches used to limit access to ports and facilities, such as using facility specific identity credentials with business cases.“ p.32. GAO suggests that DHS conduct a risk-informed cost-benefit analysis as part of the regulatory analysis required by the next rulemaking on TWIC. The Coast Guard also needs to revise its MISLE data collection system in order to “identify and assess TWIC-related compliance and enforcement trends, and to obtain management information needed to assess and understand existing vulnerabilities with the use of TWIC.” P.38.

Overall, this is a discouraging review of a program that many good people have worked long and hard to implement. It is worth reading in its entirety, both for the wealth of details about the TWIC program as well as for the bad news bombs delivered on nearly every page.

GAO Testimony on Border Security, GAO-11-58T

On March 30, the Government Accountability Office released GAO-11-508T, Testimony by Richard M. Stana, GAO Director of Homeland Security and Justice Issues Before the Committee on Homeland Security and Governmental Affairs, U.S. Senate. This testimony is based on GAO’s body of work from 2007 to the present that examined DHS efforts to secure the U.S. border.

Some troubling items from “What GAO Found,” that may be of interest to high-risk maritime facilities and vessels pondering threats that might come at them over our borders:

“At the end of fiscal year 2010, DHS investments in border security had grown to $11.9 billion and included more than 40,000 personnel….However, as GAO reported from 2007 through 2011, weaknesses in POE (Point of Entry) traveler inspection procedures and infrastructure increased the potential that dangerous people and illegal goods could enter the country; and that currency and firearms could leave the country and finance drug trafficking organizations and sponsors of terrorism….CBP’s Border Patrol component is moving ahead with a new technology deployment plan to secure the border, but cost and operational effectiveness and suitability are not yet clear. … “

“CBP’s Border Patrol component is moving ahead with a new technology deployment plan to secure the border, but cost and operational effectiveness and suitability are not yet clear. In January 2011, the Secretary of Homeland Security announced a new direction to deploying technology to assist in securing the border. The decision ended the Secure Border Initiative Network technology program—one part of a multiyear, multibillion dollar effort aimed at securing the border through technology such as radar, sensors, and cameras and infrastructure such as fencing. Under a new plan, called Alternative (Southwest) Border Technology, Border Patrol is to develop terrain- and population-based solutions using existing proven technology, such as camera-based surveillance systems. However, the analysis DHS performed to arrive at an appropriate mix of technology in its new plan raises questions. For example, the analysis cited a range of uncertainties in costs and effectiveness, with no clear-cut cost effective technology alternative among those considered, as GAO reported in preliminary observations in March 2011. “

“Overall, DHS reported achieving an acceptable level of border control across less than half of the southwest border and less than 2 percent of the northern border during fiscal year 2010.”

Addressing CBP technology challenges, “For example, as of March 2011, license plate readers were available at 48 of 118 outbound lanes on the southwest border but none of the 179 outbound lanes on the northern border. “

“Traffic checkpoints contributed to furthering the Border Patrol mission to protect the border. In 2008, they accounted for about 35 percent of Border Patrol drug seizures along the southwest border and 17,000 apprehensions of illegal aliens, including 3 individuals identified as persons linked to terrorism. However, we reported in August 2009 that Border Patrol did not have measures to determine if these checkpoints were operating effectively and efficiently, and weaknesses in checkpoint design and operation increased the risk that illegal activity may travel to the U.S. interior undetected. “

Concerning persons passing through both the northern and southern ports of entry, CBP determined that 99% were compliant with U. S. laws and regulations. Of the remainder, the agency “reported a goal to apprehend at least 28 percent of serious criminal activities—such as transporting illegal drugs, guns, or other banned substances.” At the end of fiscal year 2009, the land border Points of Entry had achieved that goal. (It’s impossible to resist pointing out that even in a bad year for flow through the POE’s, even a percentage of 1% is a sizeable universe of persons.)

“As we previously observed in December 2010 and February 2011, and through selected updates, Border Patrol determined in fiscal year 2010 that border security was not at an acceptable level of control for 1,120 southwest border miles and 3,918 northern border miles, and that on the northern border there was a significant or high degree of reliance on enforcement support from outside the border zones for detection and apprehension of cross-border illegal activity.”

I have selected the negative comments from this report because they represent the areas of concern and vulnerability. There were many positive comments, but the negative statements were frequent and alarming.