TWIC Reader Pilot Program Final Report from DHS

On February 27, 2012, DHS issued the SAFEPort Act Final Report on the TWIC Reader Pilot Program. Below are selected quotes from the summary of findings of the report. The purpose of this report is to convey the findings of the Reader Pilot as per the SAFE Port Act.

“The TWIC Reader Pilot was conducted through the combined efforts of a number of DHS offices and components. The Transportation Security Administration (TSA) conducted the pilot and was responsible for overall execution of the TWIC Pilot Test and Evaluation Master Plan (TEMP) developed by the DHS Science & Technology (S&T) Directorate. The DHS Screening Coordination Office (SCO) provided policy guidance regarding the use of biometric credentials. The Federal Emergency Management Administration (FEMA) awarded and administered the Port Security Grants that provided funding to ports and individual facility operators to procure and install the readers and reader infrastructure used in the Reader Pilot….The U.S. Coast Guard (USCG), which is the agency responsible for promulgating the future regulation specifying the use of TWIC readers, participated in all aspects of the Reader Pilot. The USCG will consider the results of the pilot in preparing a Notice of Proposed Rulemaking and subsequent Final TWIC Reader Rule.

To provide independent verification of test procedures and data gathering, DHS S&T arranged for the U.S. Navy Space and Naval Warfare Systems Center Atlantic in Charleston, SC to serve as the Independent Test Agent (ITA) for the Reader Pilot....”

"Key Findings

Despite a number of challenges, the TWIC Reader Pilot obtained sufficient data to evaluate reader performance and assess the impact of using readers at ports and maritime facilities. The lessons learned during the Reader Pilot will provide valuable information regarding readers and access control systems to maritime users.

It was determined that TWIC reader systems function properly when they are designed, installed, and operated in a manner consistent with the characteristics and business needs of the facility or vessel operation.

It also found that reader systems can make access decisions efficiently and effectively.

A number of operational and technological difficulties were documented that affected overall success at many pilot locations….(including) challenges such as complex complexity of biometric credential and reader technology, equipment performance and reliability, operator and user training, card stock durability, and the reluctance of some workers and facilities to use the readers..."

"Business Impact, Throughput without Biometric Identity Verification - …despite having slower throughput times, contact readers proved to have fewer incomplete reader transactions than contactless readers as long as they were protected from debris and moisture and not subjected to excessive wear from use in high-volume situations.

Business Impact, Throughput with Biometric Identity Verification-…the extent of the delay for processing an individual at an access point was sometimes compounded by user unfamiliarity with the TWIC authentication process. It is important to note that when a user is properly trained and acclimated to interface with the card reader, transaction times decrease considerably. TSA plans to issue future documentation of lessons learned to address these and other findings. “

“Training -In general, training requirements were underestimated by the pilot participants. Workers who reported to the same facility daily learned to use the readers quickly. However, when workers were required to access multiple facilities, individuals had to become familiar with site-specific business processes and requirements. Acclimation was further compounded by various reader ergonomics found at different port access points. Readers placed at heights ordistances awkward for drivers to reach slowed access and, in some cases, created a danger to drivers trying to reach misplaced readers. There was also difficulty reading messages on the screens of readers not shielded from direct sunlight, which prevented users from determining the cause of access denial.

In addition to proper training for worker populations, facilities and security personnel required training on how to use the TWIC system. Successful reader and access control system operations require an understanding of the reader and system operation appropriate to the role of the user. Some access control system operators and their security personnel were unfamiliar with the messaging provided by their readers and access control systems, resulting in incorrect assumptions as to the cause of an incomplete read of a card or access denial. In some cases, workers were told there was a problem with their TWIC card when it was actually functioning properly. In addition, many of these access denial problems were traced to individuals not being registered in the access control system.

This unfamiliarity with reader technology also extended to portable TWIC readers. Without sufficient training, security personnel encountered problems operating portable readers-shifting from one reader mode to another or rebooting readers if they "freeze" or "lock up". At facilities where workers are required to enter and exit secure areas multiple times over short periods, biometric identity verification upon every entry is difficult to maintain, especially using portable readers. In some cases portable readers malfunctioned when used carelessly in wet conditions not aligned with vendor guidance.”

“Technology

Reader Performance- The Reader Pilot provided one of the first opportunities to gain knowledge regarding the performance of cards and readers in an actual long-term application. Reader performance in this pilot varied widely. Some readers performed well throughout the TWIC Reader Pilot; some readers were not as mature technologically; others required adjustments; and in one case, the readers initially installed at a facility repeatedly failed and were replaced by readers from another vendor.

Card Stock Durability and Electronic Maturity - TWIC card stock is the same as that used for Personal Identity Verification (PIV) cards issued to all federal employees and contractors as well as members of the military. However, through the Reader Pilot, TSA discovered that an unexpectedly high number of TWIC cards had malfunctioned electronically and could not be read with readers.4 Most TWIC cards that failed could not transmit information to a contactless reader despite the fact that the integrated circuit chip (ICC) could be read by a contact reader.”

More to come…Thanks to my friend Don Bruce for sending this report to me. The Houston-Galveston AMSC Facility Security Working Group (http://www.fswg.org) is the best place to go for the best and latest on TWIC.

Preliminary Review of FY 2012 PSGP Solicitation

On February 17, 2012, DHS published the Funding Opportunity Announcement (grant solicitation) for the FY2012 Port Security Grant Program (PSGP.) It can be found at http://www.fema.gov/pdf/government/grant/2012/fy12_psgp_foa.pdf. Below is some information gleaned from an initial scan of the solicitation.

424’s into Grants.gov April 27, 2012

Application deadline is May 4, 2012.

Anticipated Funding Selection Date: 06/29/2012

Anticipated Award Date: 09/30/2012

Cost match is back.

The following match requirements apply for the FY 2012 PSGP (including ferry systems):

 Public Sector. Public sector applicants must provide a non-Federal match (cash or in-kind) supporting at least 25 percent of the total project cost for each proposed project.

 Private Sector. Private sector applicants must provide a non-Federal match (cash or in-kind) supporting at least 50 percent of the total project cost for each proposed project.

 Exceptions. There is no matching requirement for grant awards where the total award is $25,000 or less (with the exception of national and/or regional corporations submitting 11 or more projects throughout their system[s]). If the Secretary of Homeland Security determines that a proposed project merits support and cannot be undertaken without a higher rate of Federal support, the Secretary may approve grants with a matching requirement other than that specified above in accordance with Title 46, Section 70107 of the United States Code of Federal Regulations (46 U.S.C. 70107[c][2][B]).

Field level review will be managed at the COTP level.

Review criteria will be:

Criteria #1. Projects that support development and sustainment of the core capabilities in the NPG and align to PSGP funding priorities identified in Appendix B – FY 2012 PSGP Priorities. These include:

Enhancing Maritime Domain Awareness (MDA)

Enhancing Improvised Explosive Device (IED) and Chemical, Biological, Radiological, Nuclear, Explosive (CBRNE) prevention, protection, response and supporting recovery capabilities

Port Resilience and Recovery Capabilities

Training and Exercises

Equipment Associated with Transportation Worker Identification Credential (TWIC) Implementation

Criteria #2. Projects that address priorities outlined in the applicable AMSP, as mandated under the MTSA and/or the Port-Wide Risk Mitigation Plans (PRMP)

Criteria #3. Projects that address additional security priorities based on the COTP’s expertise and experience of the COTP within the specific port area

Criteria #4. Projects that offer the highest potential for risk reduction for the least cost

Ineligible Entities

The PSGP will not accept applications or IJs from an applicant or sub-applicant for the purpose of providing a service or product to an otherwise eligible entity.

NO FA’s

The Fiduciary Agent process will not be utilized in the FY 2012 PSGP. Eligible applicants will apply directly to FEMA for funding under this program.

PRMP - Port-Wide Risk Management Planning for Group I and Group II Port Areas

In order to receive FY 2012 PSGP funds, Group I and Group II port areas are required to have in place an approved PRMP.

Key language from Funding Guidelines:

First, DHS will focus the bulk of its available port security grant dollars on the highest risk port systems. This determination is based on ongoing intelligence analysis, extensive security reviews, and consultations with port industry partners.

Second, DHS places a very high priority on ensuring that all PSGP applications reflect robust regional coordination and an investment strategy that institutionalizes and integrates a regional maritime security risk strategy.

PSGP Priorities

1. Enhancing Maritime Domain Awareness (MDA)

MDA is the critical enabler that allows leaders at all levels to make effective decisions and act early against threats to the security of the Nation’s seaports. In support of the National Strategy for Maritime Security and the Prevention and Protection mission areas of the NPG, port areas should seek to enhance their MDA through projects that address knowledge capabilities within the maritime domain.

This effort could include access control/standardized credentialing, command and control, communications, and enhanced intelligence sharing and analysis. This effort may also include construction or infrastructure improvement projects that are identified in the PRMP and/or FSPs and/or Vessel Security Plans (VSPs). Construction and enhancement of Interagency Operations Centers for port security should be considered a priority for promoting MDA and unity of effort. MDA requires a coordinated unity of effort within and among public and private sector organizations and international partners. The need for security is a mutual interest requiring the greatest cooperation between industry and government. MDA depends upon unparalleled information sharing. MDA must have protocols to protect private sector proprietary information. Bi-lateral or multi-lateral information sharing agreements and international conventions and treaties will greatly assist enabling MDA.

2. Enhancing Improvised Explosive Device (IED) and Chemical, Biological, Radiological, Nuclear, Explosive (CBRNE) prevention, protection, response and supporting recovery capabilities

Port areas should continue to enhance their capabilities to prevent, detect, respond to and recover from terrorist attacks employing IEDs, CBRNE devices and other non-conventional weapons. Of particular concern in the port environment are attacks that employ IEDs delivered via small craft (similar to the attack on the USS Cole), by underwater swimmers (such as underwater mines), or on ferries (both passenger and vehicle). Please refer to the DHS Small Vessel Security Strategy April 2008 document, which can be found at http://www.dhs.gov/files/publications/gc_1209408805402.shtm.

3. Port Resilience and Recovery Capabilities

The Nation’s ability to withstand threats and hazards requires an understanding of risks and robust efforts to reduce vulnerabilities. Mitigating vulnerabilities reduces both the direct consequences and the response and recovery requirements of disasters. One of the core missions of DHS, as outlined in the Quadrennial Homeland Security Review (QHSR) Report, is “ensuring resilience to disasters”. A major goal in support of this mission is to “improve the Nation’s ability to adapt and rapidly recover.” A main objective of this goal is to sustain critical capabilities and restore essential services in a timely manner.

Those responsible for the security and resilience of our Nation’s ports must take appropriate action to reduce risk related vulnerabilities. Resilience spans the full spectrum of activities by exploring options and identifying processes that reduce the magnitude and duration of disruptions. PSGP funds are intended to assist “risk owners” in addressing port security vulnerabilities. Port resilience and recovery should be viewed as a critical component of this overarching effort. During the FY 2007 Supplemental round of port security grants, port stakeholders, through their Area Maritime Security Committees, were encouraged to develop BCRTPs. Those ports that already have completed plans should pursue PSGP funds to address their identified risks and vulnerabilities, including any worthwhile projects that would help enable continuity of port operations and/or rapid recovery of the port following a major incident. Ports that have not completed plans are highly encouraged to complete them and may apply for PSGP funding to facilitate that effort.

4. Training and Exercises

Port areas should assess their training and qualification requirements, coordinate training and qualification of incident response personnel, and regularly test these capabilities through emergency exercises and drills. Exercises must follow the Area Maritime Security Training Exercise Program (AMSTEP) or the Transportation Security Administration (TSA) Intermodal Security Training Exercise Program (ISTEP) guidelines that test operational protocols that would be implemented in the event of a terrorist attack. The efforts include live situational exercises involving various threat and disaster scenarios, table-top exercises, and methods forimplementing lessons learned.

5. Equipment Associated with Transportation Worker Identification Credential (TWIC) Implementation

TWIC is a congressionally-mandated security program through which DHS will conduct appropriate background investigations and issue biometrically enabled and secure identification cards for individuals requiring unescorted access to U.S. port facilities. Regulations outlining the initial phase of this program (card issuance) were issued by TSA in cooperation with the Coast Guard in volume 72 of the Federal Register on page 3492, dated January 25, 2007. See FEMA GPD IB 343, dated June 21, 2010 for further information on the TWIC program and guidance forexecuting PSGP-funded TWIC projects. For FY 2012, infrastructure and installation projects that support TWIC implementation (e.g. cabling, Information Technology [IT], limited construction, etc.) will be given a higher priority than the purchase of TWIC card readers.

DHS Semiannual Regulatory Agenda: MTSA 2

In the Monday February 13 2012 Federal Register, found at http://www.gpo.gov/fdsys/pkg/FR-2012-02-13/pdf/2012-1648.pdf, DHS will post the semiannual regulatory agenda. Of interest to MTSA facilities is the mention of MTSA 2, titled Updates to Maritime Security:

“Abstract: The Coast Guard proposes certain additions, changes, and amendments to 33 CFR, subchapter H. Subchapter H is comprised of parts 101 through 106. Subchapter H implements the major provisions of the Maritime Transportation Security Act of 2002. This rulemaking is the first major revision to subchapter H. The proposed changes would further the goals of domestic compliance and international cooperation by incorporating requirements from legislation implemented since the original publication of these regulations, such as the SAFE Port Act, and including international standards such as STCW security training. This rulemaking has international interest because of the close relationship between subchapter H and the International Ship and Port Security Code (ISPS).”

The Notice gives an action date for a Notice of Proposed Rulemaking of September 2012.

In a search of Regulations.gov under the above docket number, one interesting item surfaces. In one of the files under this rulemaking, the Retrospective Review of Existing Regulations – Progress Report 1-20-2012, the following text appears under a discussion of Updates to Maritime Security Regulations: “The Coast Guard regulations implementing the Maritime Transportation Security Act of 2002 (MTSA) provide security measures for vessel and port facility operations in U.S. ports. Among other things, these regulations require owners or operators of vessels and port facilities to develop security plans. Since promulgation of the MTSA regulations, the Coast Guard has granted exemptions from MTSA provisions on an ad hoc, individual basis. Through this rule, the Coast Guard would formalize several categories of exemptions, which, in turn, will reduce the burden associated with the current ad hoc waiver process.” Under Anticipated Savings in Costs and/or Information Collection Burdens, together with any Anticipated Changes in Benefits (please quantify, to the extent feasible, & also specify baseline, time horizon, & affected groups) appears the following:

• “Clarify MTSA requirements in response to requests for interpretation and guidance.

• Formalize exemptions from certain MTSA provisions, which would provide an annual savings of $125,000 to society.”
  

It is difficult to interpret this statement in the light of the minimal savings figure given (did the Coast Guard forget some zeroes?) Perhaps MTSA 2 will enshrine PAC 57-05, Exceptions to Part 105 Applicability for Oil and Natural Gas Facilities and PAC 09-09, Exempting Facilities That Transfer and Store Asphalt, in the applicability section of 33 CFR 105. Most facilities that are going to get out of MTSA under these PAC’s are probably already out. It is difficult to envision wider exemptions in the new suite of regs (PAC 02-11) in the light of the small savings figure.

Information on Problems with CFATS Program, Care of Chemical Facility Security News

My good friend and fellow blogger Patrick Coyle has been reporting on the problems with the CFATS program in his blog Chemical Facility Security News, http://www.chemicalfacilitysecuritynews.blogspot.com. As always, his reporting is very objective and thorough. This morning (Feb. 3, 2012) he posted information concerning hearings about CFATS that are being conducted by the House Energy and Commerce Committee. This post included a link to a Committee Staff Background Memo that contained a summary of the problems that the CFATS program has experienced. The memo can be found at:

http://republicans.energycommerce.house.gov/Media/file/Hearings/Environment/020312/HMTG-112-IF18-20120203-SD001.pdf, and parts are reproduced below. This information will be of interest to the many MTSA facilities who will be required to submit a Top-Screen and who will be affected by the CFATS-MTSA harmonization.

“On March 31, 2011, DHS Undersecretary of NPPD, Rand Beers, testified before the Subcommittee on Environment and the Economy that CFATS covered 4,744 high-risk facilities nationwide and that 4,126 facilities had received final high-risk determinations. In addition, Mr. Beers stated that while more than 4,100 facilities have submitted Site Security Plans (or Alternative Security Programs) to date -- and DHS was in the process of reviewing these submissions, DHS was still issuing final tier notifications to facilities across all four risk tiers.

In addition, Mr. Beers testified that more than 39,000 facilities had registered with DHS and completed the top-screen process. Of these facilities, DHS considered more than 8,064 as high risk and required them to submit a site vulnerability assessment. To determine if a facility is to be regulated as high risk and, if so, which tier it falls into, DHS uses a computer system that assesses risk based upon potential worst-case scenarios for a particular facility. On July 21, 2011, DHS officials informed Committee staff that in May 2010, CFATS program officials realized they had used improper inputs and modeling in the computer assessments for the formal tiering process, resulting in improper tiering of 600 facilities between the end of 2009 and spring 2010. In addition, DHS officials made clear that CFATS officials at that time consciously chose to not tell anyone about it. After personnel changes for the CFATS program, an internal investigation in Summer 2011 led to notifications of those facilities that had received a corrected CFATS risk tier as a result of a June 27, 2011, re-tiering process. Specifically, 148 facilities were tiered at a lower risk tier, 99 facilities were found not to need a tier and no longer became subject to CFATS regulation, 41 facilities have either data errors that still need correction or have their redetermination under review, and 175 facilities remain in the same level but will have the risk levels for their chemicals of interest decrease.

Following the “mis-tiering” episode, the new Director of Infrastructure Security Compliance Division, Penny J. Anderson, and her Deputy Director, David M. Wulf, conducted an internal review of the entire CFATS and Ammonium Nitrate programs at DHS, summarizing their findings in a November 10, 2011, memorandum to Undersecretary Rand Beers and Assistant Secretary David Keil. Fox News ran a print story about the contents of the report on December 21, 2011.1

The report identifies five (5) main programmatic challenges for the CFATS program: inadequate training capability, an overreliance on hired consultants for expertise, inappropriate transitions for new hires, uncertainty from extremely short program authorizations, and issues regarding job descriptions and the presence of an employee union. It also lists nine (9) staffing challenges for the CFATS program, including inexperienced managers, personnel placed in jobs for which they are not qualified, inadequate internal staff control, and lack of regulatory compliance expertise. Following the internal memorandum, the Department prepared a list of recommendations for correcting the troubles plaguing the program. It identifies the highest program priorities: speeding up the SSP review process, preparing for compliance inspections, and development and implementation of a personnel surety program for CFATS. The only legislative recommendation made in the report was a long-term extension of the existing program.”