PAC 01-11, Voluntary Use of TWIC Readers

On March 15, 2001, the U. S. Coast Guard issued Policy Advisory Council (PAC) Decision 01-11, ``Voluntary Use of TWIC Readers.'' Because the readers are still in the pilot stage, facility owner/operators who received grant funding have been reluctant to move forward with purchasing readers. This PAC was issued to give more guidance in purchasing and installing TWIC readers and systems. Below are some points to consider from the PAC.

In discussing the three-pronged card verification, the PAC states:

(1) Regarding Identity verification, the current requirement for identify verification is to compare the photo on the TWIC to the person at the access point (33 CFR 104.265(c)(1)(i), 105.255(c)(1)(i)), or 106.260(c)(1)(i)).

In accordance with 33 CFR §101.130, the Coast Guard determines that a biometric match using a TWIC reader from the TSA list of readers that have passed the Initial Capability Evaluation (ICE) Test (available at: http://www.tsa.gov/assets/pdf/twic_ice_list.pdf ) to confirm that the biometric template stored on the TWIC matches the fingerprint of the individual presenting the TWIC meets or exceeds the effectiveness of the identity verification check.

2. Regarding card validity, the current requirement for card validity is visual inspection to check that the TWIC has not expired (33 CFR 104.265(c)(1)(ii), 105.255(c)(1)(ii), or 106.260(c)(1)(ii)).

In accordance with 33 CFR §101.130, the Coast Guard determines that using a TWIC reader to check for card validity by either

(a) comparing the card’s internal Federal Agency Smart Card Number (FASC–N) to the TSA Cancelled Card List or

(b) using a Certificate Revocation List (CRL)

3. Regarding card authentication, the current requirement for card authentication is visual and/or physical inspection of various security features present on the card (33 CFR 104.265(c)(1)(iii), 105.255(c)(1)(iii), or 106.260(c)(1)(iii)).

In accordance with 33 CFR §101.130, the Coast Guard determines that card authentication with a TWIC reader to perform the CHALLENGE/RESPONSE protocol using the Card Authentication Certificate and the card authentication private key on the TWIC meets or exceeds the effectiveness of the card authentication.

Further:

4. Readers must be operated and maintained in accordance with manufacturer’s instructions, and operated by personnel trained in the use of the reader.

5. The plan must be amended to reflect the use of the reader.

6. PAC Decision 08-09, Incorporating TWIC into Existing Physical Access Control Systems - Change 1, remains valid for vessels or facilities with existing electronic physical access control systems as long as the systems can support a match between the local access card and the individual’s valid TWIC upon each entry.

7. Please note: this PAC is studded with warnings that any readers used that satisfy this PAC may not satisfy a subsequent rulemaking. And: “Any grandfathering or phase-in period considerations will be addressed in the rulemaking process, providing adequate opportunity for comment, but should in no way be inferred from this interim guidance. “ (My emphasis.)

DTOS 59-11-R-00307 Presolicitation Notice, Maritime Security Training

On March 11, MARAD posted a presolicitation notice for contractor services to assess maritime security training courses. The notice is posted in its entirety below.

The Maritime Security training course assessor (hereinafter "Contactor") shall act on behalf of MARAD and the USCG hereinafter (Government) to evaluate maritime security training courses proposed by training providers to ensure conformity with applicable Government requirements. The Contractor shall issue documents of compliance to training providers whose curricula, instructors, facilities, materials and method of instructions conform with applicable requirements. The Contractor shall maintain records that describe the scope of all evaluations performed and track the documents issued. The processes and procedures by which the Contractor performs these services shall be governed by a recognized Quality Standards System (QSS) that will be subject to periodic review by Government Officials. All responses SHALL BE COAST GUARD QSS CERTIFIED.

Responses are to be submitted to MARAD by April 15, 2011.

Some points to be noted include:

1. The contractor will be reviewing both MARAD and USCG security training courses.

2. The contractor needs to be QSS certified, which really narrows the scope. According to the USCG website(3/8/2010) at http://www.uscg.mil/nmc/faq/vso_rule_making.asp, the Coast Guard-approved QSS organizations are as follow: American Bureau of Shipping (ABS), Det Norske Veritas (DNV) and American Council of Education (ACE).

3. Who may be disqualified from responding? NVIC 97-9, Guidance on STCW Quality Standards Systems (QSS) for Merchant Mariner Courses or Training Programs, states, (5)(k), “Coast Guard-accepted QSS organizations must be completely independent of any organizations offering training. Coast Guard-accepted QSS organizations may not exercise direct or indirect managerial or financial control through contract or understanding over any training organization. Likewise, training organizations may not exercise direct or indirect managerial or financial control through contract or understanding over any Coast Guard-accepted QSS organization.”

(Thanks to John Bennett for calling this to my attention and resulting excellent discussion and Steven Sawhill of DNV for excellent discussion.)

Small Vessel Security Plan Report to Public

On Friday March 13, DHS released a public abstract of the Small Vessel Security Implementation Plan, at http://www.dhs.gov/files/programs/gc_1199394950818.shtm. The Plan itself is sensitive security information and will be distributed only to pre-cleared stakeholders, such as AMSC members.

The Introduction to this document describes the role of the Plan, describing it as “the product of a multi-year process that involved public and private stakeholders, DHS, and other federal, state, local, and tribal authorities. “ It is further described as ” a roadmap for realizing the goals and objectives of the DHS National Small Vessel Security Strategy (Strategy)” that “ identifies possible and proven means of managing and controlling risks posed by the potential threat and possibly dire consequences of small vessel exploitation by terrorists.” The Plan will “improve existing operations and systems by leveraging the actions and resources of stakeholder groups in the commercial private sector and the recreational boating community. “ Discussing how the goals of the SVS Strategy are to be put into practice, DHS states, “Many programs included in the Plan are not new or uniquely dedicated to terrorist threats or small vessels. They are ongoing in the agencies that facilitate maritime safety, security, recreation, and commerce. The Plan outlines improvements to this very substantial base of existing programs to achieve higher levels of operational capability and awareness. By design, it will be continuously revised to accommodate new information about threats, technologies, requirements, and lessons learned as programs are implemented. “

The document then addresses steps forward within the framework of the four goals of the Strategy. Each goal is broken into objectives, and those objectives are put into practice by means of a list of “example activities.” These example activities are excellent initiatives that will certainly strengthen the program and mitigate the threat. Some are just good common sense, such as “Standardize warning signage for limited-access areas, such as Defense Department bases, U.S. Army Corps of Engineers restricted areas, or USCG security zones and for special events and high-threat situations to demarcate security zones and safety zones.” Who will be responsible for what, or how these activities will be funded in these times of cutbacks, is not addressed in this abstract. Despite the claim that these activities are already ongoing within federal agencies, if they are not uniquely dedicated to small vessel security or if small vessel security activity is not separately tracked – requiring expenditure for the tracking – there may be a problem with alignment with federal program management standard practices. Hopefully, there will be details in the SSI version that address these concerns, including checklists and detailed timelines and a solid feedback loop for the port security stakeholder community to contribute their input.

The input of the stakeholder community in this process largely ceased after the Summits, and that wasn’t either the choice or the wish of that community.