[Federal Register Volume 85, Number 46 (Monday, March 9, 2020)]
[Rules and Regulations]
[Pages 13493-13517]
[FR Doc No: 2019-24343]

=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

Coast Guard

33 CFR Part 105
[Docket No. USCG-2017-0711]
RIN 1625-AC47

TWIC--Reader Requirements; Delay of Effective Date

AGENCY: Coast Guard, DHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Coast Guard is delaying the effective date for three
categories of facilities affected by the final rule entitled,
``Transportation Worker Identification Credential (TWIC)--Reader
Requirements,'' published in the Federal Register on August 23, 2016.
These three categories are: Facilities that handle certain dangerous
cargoes in bulk, but do not transfer these cargoes to or from a vessel;
facilities that handle certain dangerous cargoes in bulk, and do
transfer these cargoes to or from a vessel; and facilities that receive
vessels carrying certain dangerous cargoes in bulk, but do not, during
that vessel-to-facility interface, transfer these bulk cargoes to or
from those vessels. The Coast Guard is delaying the effective date for
these categories of facilities by 3 years. Specifically, this rule will
delay the implementation of the TWIC Reader rule for 370 of the 525
affected Risk Group A facilities by 3 years, while the remaining 155
facilities (which are all facilities that receive large passenger
vessels), as well as 1 vessel, will have to implement the final rule
requirements within 30 days after the effective date of this rule.

DATES: This final rule is effective May 8, 2020.

ADDRESSES: Documents mentioned in this preamble as being available in
the docket are included under docket number USCG-2017-0711 and
available at https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: For information about this document,
call or email LCDR Kevin McDonald, Coast Guard CG-FAC-2; telephone 202-
372-1120; email<EMAIL_ADDRESS>
SUPPLEMENTARY INFORMATION:

Table of Contents for Preamble

I. Abbreviations
II. Basis and Purpose, and Regulatory History
III. Executive Summary
IV. Discussion of Comments and Developments
    A. Confusion Relating to the Difference Between ``CDC
Facilities'' and ``Facilities That Handle CDC in Bulk''

    B. Concerns Relating to the Effectiveness of Electronic TWIC
Inspection
    C. Concerns Regarding Partial Implementation of the TWIC Reader
Rule
    D. Problems Estimating the Total Cost of Implementation of the
Electronic TWIC Inspection Requirement
    E. Use of Electronic TWIC Inspection at Passenger Facilities and
Vessels
    F. Miscellaneous Comments
    G. Comments on the Regulatory Analysis
    1. Comments on the Total Cost of the TWIC Reader Rule
    2. Comments on the Economic Impact of the Rules
    3. Comments on the Use of the TWIC Pilot Program Data
    4. Comments on Collecting New Cost Data
    H. Conclusion
V. Regulatory Analyses
    A. Regulatory Planning and Review
    B. Small Entities
    C. Assistance for Small Entities
    D. Collection of Information
    E. Federalism
    F. Unfunded Mandates Reform Act
    G. Taking of Private Property
    H. Civil Justice Reform
    I. Protection of Children
    J. Indian Tribal Governments
    K. Energy Effects
    L. Technical Standards
    M. Environment

I. Abbreviations

ANPRM Advanced notice of proposed rulemaking
CDC Certain Dangerous Cargoes
CFR Code of Federal Regulations
COTP Captain of the Port
DHS Department of Homeland Security
GDP Gross Domestic Product
FSO Facility Security Officer
FSP Facility Security Plan
FR Federal Register
GAO Government Accountability Office
HSI Homeland Security Institute
HSOAC Homeland Security Operational Analysis Center
MSRAM Maritime Security Risk Analysis Model
MTSA Maritime Transportation Security Act of 2002
NPRM Notice of proposed rulemaking
OIG Office of the Inspector General
OMB Office of Management and Budget
PAC Policy Advisory Council
PACS Physical access control system
RA Regulatory analysis
SAFE Port Act Security and Accountability for Every Port Act of 2006
Sec.  Section symbol
TSA Transportation Security Administration
TSI Transportation Security Incident
TWIC Transportation Worker Identification Credential
USCG United States Coast Guard

II. Basis and Purpose, and Regulatory History

    Pursuant to the Maritime Transportation Security Act of 2002
(MTSA),\1\ and in accordance with section 104 of the Security and
Accountability for Every Port Act of 2006 (SAFE Port Act),\2\ Congress
requires the electronic inspection of Transportation Worker
Identification Credential (TWIC[supreg]) cards (``electronic TWIC
inspection'') upon entry to secure areas on vessels and in facilities
in the United States. Specifically, the SAFE Port Act mandates that the
Secretary promulgate final regulations that require the deployment of
electronic transportation security card readers.\3\ To implement this
requirement in an effective manner, the Coast Guard undertook a series
of regulatory actions culminating in a requirement to implement
electronic TWIC inspection at certain high-risk vessels and facilities
regulated under MTSA. Beginning in 2006, the Coast Guard and the
Transportation Security Administration (TSA) conducted a variety of
rulemaking actions to implement the requirements. This culminated in
the 2016 publication of a final rule implementing the requirement for
electronic TWIC inspection (the ``TWIC Reader rule'').\4\ A detailed
summary of these actions is available in the preamble to the notice of
proposed rulemaking (NPRM) (the ``TWIC Delay NPRM'') for this rule.\5\
---------------------------------------------------------------------------

    \1\ Public Law 107-295, 116 Stat. 2064 (November 25, 2002).
    \2\ Public Law 109-347, 120 Stat. 1884, 1889 (October 13, 2006).
    \3\ See 46 U.S.C. 70105(k)(3).
    \4\ Transportation Worker Identification Credential (TWIC)--
Reader Requirements; Final Rule. August 23, 2016, 81 FR 57652.
    \5\ TWIC Reader Requirements, Delay of Effective Date; Notice of
Proposed Rulemaking. June 22, 2018, 83 FR 29067, at 29068.
---------------------------------------------------------------------------

    Existing regulations require all eligible persons who require
unescorted access to secure areas of MTSA-regulated facilities to
possess a TWIC card. However, while the TWIC card contains
sophisticated authentication, validation, and verification capabilities
using biographic and biometric information, operators of vessels and
facilities are not required to use these features in ascertaining
whether persons are authorized to enter secure areas. Instead, security
personnel must inspect the card visually (i.e., printed name, facial
photograph, expiration date, and overt security features) to allow
entry. The TWIC reader rule changed this requirement for a subset of
high-risk MTSA-regulated facilities (called ``Risk Group A
facilities''), requiring that they conduct an ``electronic TWIC
inspection'' before allowing access to secure areas. This involves
electronic authentication using the TWIC card's Card Holder Unique
Identifier (CHUID), validating that the credential has not been revoked
by comparing it to a TSA-maintained canceled card list, and verifying a
person's biometric (e.g., fingerprint) to the biometric template stored
on the card's chip. Because electronic TWIC inspection requires either
purchasing TWIC readers, integration into an existing physical access
control system (PACS), or other solutions, and electronic inspection
may take longer than visually inspecting the card, the TWIC reader rule
applied the electronic TWIC inspection requirement only to a high-risk
subset of MTSA vessels and facilities.
    After the publication of the TWIC reader rule, the Coast Guard
received a variety of communications from persons affected by the rule
concerning the scope and cost of the rule. Most significantly, numerous
parties took issue with how the Coast Guard defined some of the high-
risk facilities that were subject to the electronic TWIC inspection
requirement. While the Coast Guard had proposed and finalized text that
applied the electronic TWIC inspection requirement to ``facilities that
handle certain dangerous cargoes (CDC) in bulk,'' various parties
expressed confusion with that phrase. After the rule published, they
stated that they had interpreted that phrase to mean that the
regulation applied only to facilities where bulk CDC was transferred
from a facility to a vessel (or vice versa), instead of the
interpretation utilized by the Coast Guard.\6\ Because of this
confusion, various parties stated that they had not been aware of the
full scope of the proposed requirements in the NPRM, and thus not had
an adequate opportunity to comment on the rule. In response to these
inquiries, the Coast Guard published an informal enforcement guidance
document in the ``Maritime Commons'' blog, stating that it would not
enforce the electronic TWIC inspection requirements on facilities that
did not transfer bulk CDC to or from a vessel.\7\
---------------------------------------------------------------------------

    \6\ In the final rule, the Coast Guard stated that a facility
where bulk CDC is stored and handled away from the maritime nexus
would be a Risk Group A facility (because the bulk CDC would still
be protected by the facility's security plan and, thus, would
present a vulnerability), and stated that ``when the bulk CDC is not
a part of the maritime transportation activities, it may be that a
facility could define its MTSA footprint in such a way as to exclude
that area . . . [with the result that] the TWIC reader requirements
. . . would not apply in that area.'' See 81 FR 57712 at 57681.
    \7\ ``TWIC Reader Rule Update,'' March 31, 2017, available at
https://mariners.coastguard.dodlive.mil/2017/03/31/3312017-twic-reader-rule-update/.
---------------------------------------------------------------------------

    On May 15, 2017, several parties petitioned the Coast Guard to
amend the

TWIC reader rule.\8\ The petitioners specifically requested that the
Coast Guard promulgate a new rule that would limit the scope of the
TWIC Reader rule to apply only to facilities that transfer bulk CDC to
or from a vessel, and that facilities where bulk CDC was otherwise
transferred, stored, produced, or used be excluded from the
requirements.\9\ They also requested that the Coast Guard delay
implementation of the TWIC Reader rule immediately, until we
promulgated the new rule.\10\ The Coast Guard denied this petition,
stating, ``[w]hile you suggest that bulk CDC is only dangerous if it is
being transferred to or from a vessel, nothing in our analysis of
target or attack scenarios would indicate that such a distinction would
be relevant.'' \11\ In addition to the petition, the parties also sued
the Coast Guard, seeking to have the TWIC Reader rule vacated on the
basis that the plaintiffs had not had adequate opportunity to comment
on the rule.\12\ However, the court dismissed the lawsuit on ripeness
grounds, without a decision on the merits of the plaintiffs'
claims.\13\
---------------------------------------------------------------------------

    \8\ See www.regulations.gov, docket number USCG-2017-0447.
    \9\ USCG-2017-0447-0001, p. 22.
    \10\ USCG-2017-0447-0001, p. 22.
    \11\ USCG-2017-0447-0005, p. 2.
    \12\ International Liquid Terminals Association v. United States
Department of Homeland Security, 2018 WL 8667001 (09/18/2018).
    \13\ Id.
---------------------------------------------------------------------------

    Congress also passed several laws that impacted implementation of
the TWIC reader program. On December 16, 2016, the President signed the
bill entitled ``Transportation Security Card Program Assessment.'' \14\
This law required, among other things, the Secretary of Homeland
Security to commission a report reviewing the security value of the
TWIC program by: (1) Evaluating the extent to which the TWIC program
addresses known or likely security risks in the maritime and port
environments; (2) evaluating the potential for a non-biometric
credential alternative; (3) identifying the technology, business
process, and operational impact of the TWIC card and readers in
maritime and port environments; (4) assessing the costs and benefits of
the Program, as implemented; and (5) evaluating the extent to which the
Department of Homeland Security (DHS) has addressed the deficiencies of
the TWIC program previously identified by the Government Accountability
Office (GAO) and the DHS Office of the Inspector General (OIG). On
August 2, 2018, the President followed up by signing the
``Transportation Worker Identification Credential Accountability Act of
2018,'' which prohibited the Coast Guard from implementing the TWIC
Reader rule until at least 60 days after it submits the above report to
Congress.'' \15\
---------------------------------------------------------------------------

    \14\ Public Law 114-278.
    \15\ Public Law 115-230.
---------------------------------------------------------------------------

    In response to the petition for rulemaking and other actions taken
by private parties and Congress, the Coast Guard proposed to delay
implementation of the TWIC Reader rule for some facilities subject to
the electronic TWIC inspection requirement. In doing so, we took note
of concerns raised in the original analytical works that formed the
basis for the TWIC Reader rule, namely the question of ``asset
categorization'' that had been raised by the original Homeland Security
Institute (HSI) report on the Coast Guard's risk methodology. That
report specifically ``suggested that further analysis on risk grouping
of asset categories . . . could help to ensure that the results were
more defensible.'' \16\ The purpose of the NPRM was to allow for time
to better assess the risk methodology and conduct this refinement.
Accordingly, we stated that ``delaying the implementation of the TWIC
Reader final rule requirements for certain facilities could allow us to
develop a more precise risk-analysis methodology that would better
identify which of these facilities . . . would benefit from the
electronic TWIC inspection requirements.'' \17\
---------------------------------------------------------------------------

    \16\ 83 FR at 29070.
    \17\ 83 FR at 29072.
---------------------------------------------------------------------------

    We note that the NPRM did not seek to delay the rule for all
facilities covered under Risk Group A. In drawing a distinction between
the facilities that would be subject to the proposed delay (the non-
transfer facilities), and those we believed should comply on the
original 2018 start date, we noted that ``unlike situations where CDC
is not transferred to or from a vessel, [the categories of facilities
covered by the delay NPRM] present a clear risk of a Transportation
Security Incident (TSI).'' \18\ While we continue to believe this to be
the case, as shown in the discussion below, additional information
related to the incurred expenses of partial implementation of the rule,
as well as the findings of new studies on TWIC effectiveness, has
influenced the scope of this final rule. The reasons for changes
between the TWIC Delay NPRM and final rule are discussed below in
Section IV, ``Discussion of Comments and Developments.''
---------------------------------------------------------------------------

    \18\ 83 FR at 29073.
---------------------------------------------------------------------------

III. Executive Summary

    This final rule finalizes and expands on the proposal in the NPRM
to delay the implementation of the TWIC Reader rule for certain
facilities. While the NPRM proposed limiting the delay only to those
facilities that handle CDC in bulk, but do not transfer it to or from a
vessel and facilities that receive vessels that carry bulk CDC but do
not transfer bulk CDC to or from the vessel, this final rule delays
implementation of the electronic TWIC inspection requirement for all
that handle bulk CDC and facilities that receive vessels carrying CDC,
including faciltiies that transfer bulk CDC to or from a vessel. The
TWIC reader requirement will only go into effect for facilities that
receive large passenger vessels and passenger vessels certificated to
carry 1000 or more passengers and more than 20 TWIC-credentialed
crewmembers. We based this change on comments received, discussed in
further detail below, showing that the cost of implementing electronic
TWIC inspection will be lower if facility operators can implement the
procedure on an enterprise-wide level, rather than in a piecemeal
fashion. We believe that this delay best balances the need for security
with the economic realities of the affected population. Facilities that
receive large passenger vessels will have 60 days from the date of
publication in the Federal Register to implement the TWIC reader
requirements. 33 CFR 104.263, which covers vessels, is not being
amended at this time. Presently, there are no U.S. flagged vessels that
carry bulk CDC, and the one passenger vessel certificated to carry more
than 1000 passengers and more than 20 TWIC-credentialed crew members is
already complying with the 2016 TWIC reader rule, so providing the 60
day delay is unnecessary.
    Delaying implementation of TWIC reader requirements at facilities
that handle CDC in bulk while implementing the requirements at
passenger vessels and facilities carries several benefits. The delay
for facilities that handle CDC in bulk will provide DHS time to further
analyze the results of the Congressionally-mandated TWIC program
assessment and continue the Coast Guard's study of CDC risk.
Furthermore, implementation at passenger vessel facilities will improve
the security at these public-facing facilities, which handle 60-plus
million passengers per year. Finally, it will allow facilities that
handle CDC in bulk operators more time to plan their

implementation of electronic TWIC inspection requirements, an
opportunity to assess new, more flexible reader solutions and
technology, and the opportunity to implement a solution(s) on a larger,
enterprise-wide scale, improving efficiency.
    We note that because DHS only received the results of the TWIC
``comprehensive security assessment'' (titled ``The Risk-Mitigation
Value of the Transportation Worker Identification Credential: A
Comprehensive Security Assessment of the TWIC Program'') in early
August 2019, and the Coast Guard is still analyzing the assessment,
this final rule is only one step in our further evaluation of the TWIC
reader requirements. The Congressional requirement to implement
electronic TWIC inspection requirements in 46 U.S.C. 70105 still
stands, and while we still believe that electronic validation of TWIC
cards provides valuable security benefits, we also believe the
implementation of the electronic TWIC inspection requirement will be
improved by additional data and further evaluation.
    As a result of this delay, regulated facilities and vessels should
not infer that readers, access control systems, or other electronic
inspection solutions provide no security value. While certain reader
requirements are delayed, facilities or vessels may choose to
incorporate such inspection solutions into their Facility or Vessel
Security Plans. Specifically, the use of the electronic inspection
solutions and the TWIC Canceled Card List (CCL) may enhance security
and minimize the risk of an ineligible transportation worker entering a
secure area.
    Overall, we estimate that delaying the implementation of the TWIC
Reader rule for the estimated 370 facilities that handle CDC in bulk
will result in cost savings to both industry and the government of
$23.74 million (discounted at 7 percent) over a 10-year period of
analysis, and an annualized cost savings of $3.38 million (discounted
at 7 percent).\19\ \20\ Using a perpetual period of analysis, we
estimated the total annualized cost savings to industry and the
government of the rule to be $1.53 million in 2016 dollars, discounted
back to 2016. For the purpose of this economic analysis, we use a 10-
year period of analysis in order to properly compare the costs of this
final rule and the TWIC reader rule, where we also estimated the costs
and benefits using a 10-year period of analysis.
---------------------------------------------------------------------------

    \19\ With a 3-percent discount rate, we estimate a total cost
savings of $18.29 million and an annualized cost savings of $2.14
million.
    \20\ At the time of analysis, the Coast Guard did not have a
final draft HSOAC assessment, and therefore we did not incorporate
any cost estimates from that report into our analysis, as we were
unable to review or validate those cost estimates for our RA.
Further, as the HSOAC assessment was published after the publication
of the NPRM, the public would not have had the opportunity to review
and comment on those cost estimates.
---------------------------------------------------------------------------

IV. Discussion of Comments and Developments

    In response to the publication of the NPRM, the Coast Guard
received 13 public comments. All commenters supported the Coast Guard's
proposal to delay implementation of the TWIC reader rule, and most
urged the Coast Guard to expand that delay in implementation to the
class of facility represented by the commenter. Commenters also made a
wide variety of statements about their understanding of the electronic
TWIC inspection rulemaking documents demonstrating substantial
confusion about numerous aspects of the TWIC reader rule, which are
addressed extensively below. Finally, commenters provided additional
information relating to the costs and implementation concerns
surrounding the electronic TWIC inspection requirement that the Coast
Guard has, where applicable, integrated into its analysis.
    In this document, the Coast Guard has grouped together issues from
various commenters into five broad categories, as laid out below. When
possible, we have attempted to identify the specific comment to which
we are responding. Where applicable, we have included a citation to the
comment and page of a statement to which we are responding.

A. Confusion Relating to the Difference Between ``CDC Facilities'' and
``Facilities That Handle CDC in Bulk''

    Many commenters expressed confusion about the scope of the
population affected by the TWIC reader rule, specifically those that
are required to implement electronic TWIC inspection because they meet
the requirements in title 33 Code of Federal Regulations (CFR)
105.253(a)(1) for ``facilities that handle Certain Dangerous Cargoes
(CDC) in bulk.'' \21\ Those commenters argued that they believe this
phrase should only attach to facilities where bulk CDC is transferred
from a vessel to facility or vice versa. These individuals stated that,
if a facility received bulk CDC by other means, or the facility
produces, stores, or uses it in its processes, it should not be
described as ``handling'' bulk CDC.
---------------------------------------------------------------------------

    \21\ While we note that 33 CFR 105.253(a) also contains the
phrase ``[f]acilities that . . . receive vessels carrying CDC in
bulk,'' that second phrase is not relevant to this discussion of the
interpretation of ``Facilities than handle CDC in bulk.''
---------------------------------------------------------------------------

    The primary source of this argument is an unrelated requirement in
33 CFR 105.295, which sets forth additional security requirements for
``CDC Facilities.'' This requirement was established in 2003, and,
while the term ``CDC Facility'' was not defined in regulation, a
subsequently-issued policy document from the Policy Advisory Council
(PAC 20-04) stated that ``in order for a facility to classify as a CDC
Facility, a vessel-to-facility interface must occur, or be capable of
occurring, and involve the transfer of CDC's in bulk.'' \22\ PAC 20-04
also stated that facilities receiving CDC from entities other than
vessels, such as rail cars and tanker trucks, would not be considered
CDC Facilities, but that the Facility Security Plan (FSP) for these
facilities ``must address the fact that they handle such cargoes.''
\23\ This explanation of the meaning of ``CDC Facility'' contrasted
markedly with the elucidation of the phrase ``facilities that handle
Certain Dangerous Cargoes in bulk'' provided in the 2016 TWIC Reader
final rule. In that document, we stated that, in the situation where a
facility stored or used CDC, or the facility was used to transfer CDC
in bulk through rail or other non-maritime means, ``such a facility
would be considered to `handle CDC in bulk' and would be classified as
Risk Group A.'' \24\ We went on to say that ``this is because the bulk
CDC would be on the premises of a MTSA-regulated facility, and thus the
facility's access control system would need to be used to mitigate the
risk of a TSI.'' \25\
---------------------------------------------------------------------------

    \22\ Available at Homeport website, https://homeportr.uscg.mil/Lists/Content/DispForm.aspx?ID=2784. See Policy Advisory (PAC)
Doucument Registry document.
    \23\ PAC 20-04, ``Scenario D.''
    \24\ 81 FR at 57681.
    \25\ 81 FR at 57681.
---------------------------------------------------------------------------

    While the terms ``CDC Facilities'' and ``facilities that handle CDC
in bulk'' sound similar, they are not identical, and the Coast Guard
did not intend to conflate the two terms or use them interchangeably.
The Coast Guard never used the term ``CDC Facilities'' in any of the
TWIC Reader rulemaking documents, and has been using consistent
language since the publication of the Advance Notice of Proposed
Rulemaking (ANPRM) in 2009 (74 FR 13360). We also note substantial
differences in the rationales for the different requirements associated
with the two terms. Various elements in 33 CFR 105.295 specifically
relate to maritime-specific issues, such as searching waterfront areas
for dangerous

devices \26\ and a requirement to release cargo only in the presence of
the Facility Security Officer (FSO) or designated representative,\27\
and form the basis for a maritime-based interpretation of the
applicability of that section. Such requirements would not make sense
for a facility that did not transfer bulk CDC across a dock.
Conversely, the attack scenarios that electronic TWIC identification is
designed to mitigate are all exclusively land-based, specifically
limited attacks from truck bombs, passersby, and (land-based) assault
squads,\28\ and there is no reason a maritime nexus should be assumed.
---------------------------------------------------------------------------

    \26\ 33 CFR 105.295(a)(4).
    \27\ 33 CFR 105.295(b)(1).
    \28\ See 81 FR at 57701.
---------------------------------------------------------------------------

    Despite the Coast Guard's use of distinct language and an
exclusively land-based rationale in the NPRM, many commenters asserted
or implied their belief that the terms were interchangeable, and the
Coast Guard's interpretation of the term ``facilities that handle CDC
in bulk'' in the final rule, therefore, contradicted its guidance in
PAC 20-04. One commenter submitted a copy of PAC 20-04 with scenarios
in which a facilitiy would not be classified as a CDC facility
highlighted, and statement ``here are several reasons why there are
several contradictions.'' \29\ One commenter stated that ``the scope of
the Final Rule was expanded beyond what was initially proposed and
departed from established Coast Guard policy (PAC 20-04),'' \30\ while
another requested that the Coast Guard revise the scope of the final
rule to make it consistent with PAC 20-04. Yet another commenter stated
that applying electronic TWIC inspection requirements to ``facilities
without a maritime nexus or where there is no transfer of CDC over a
dock was unanticipated and unusual based on historical actions taken by
the Coast Guard,'' \31\ and while the commenter did not elaborate on
what those ``historical actions'' were, we assume they are referring to
the issuance of PAC 20-04. A fifth commenter referred to the
application of the term ``facilities that handle CDC in bulk'' to
include facilities that don't transfer CDC over a dock as ``a mistake
in the August 23, 2016 publication,'' \32\ but did notcomment on the
rationale provided in that document.
---------------------------------------------------------------------------

    \29\ USCG-2017-0711-0003-3.
    \30\ USCG-2017-0711-0012, p. 2.
    \31\ USCG-2017-0711-0005, p. 2-3. We note the commenter included
a footnote to PAC 20-04 (footnote 6), which repeated and emphasized
the definition of ``CDC Facilities.''
    \32\ USCG-2017-0711-0014, p. 1.
---------------------------------------------------------------------------

    One commenter stated that ``in the proposed versions of the reader
rule, Risk Group A included . . . those that exchange [CDC] between the
facility and a vessel.'' \33\ The commenter provided various pinpoint
citations with this statement, which we examined. The first citation,
from the 2009 ANPRM, uses the phrase ``Facilities that handle CDC in
bulk'' \34\ to describe the facilities that we expected would be
included in Risk Group A, without any indication that we meant anything
other than the plain meaning of those words. The second citation, from
the NPRM (78 FR 17785-86), is unclear. The section of the document that
spans these two pages, entitled ``Summary of the Major Provisions of
the TWIC Reader Advanced Notice of Proposed Rulemaking and This NPRM,''
mainly discusses the decision to not propose the ANPRM's suggestion of
separate requirements for Risk Group B vessels and facilities. With
regard to the issue of Risk Group A facilities, the only relevant text
we could find is in Table ES-1, which summarizes the proposal for Risk
Group A facilities using identical language to that described in the
ANPRM, ``Facilities that handle CDC in bulk.'' The third citation the
commenter provides, 78 FR at 17811, does not appear to contain any
relevant textual information, containing only discussions of the HSI
report relied upon in the rulemaking and information on additional data
sources used in the rulemaking. While the commenter goes on to state
that, ``in the final rule, other facilities were included, specifically
those that contain CDCs and those that transfer CDCs only via non-
maritime means, such as by truck, rail, or pipeline,'' \35\ the
commenter's citations provide no basis to conclude any differences
between the language in the ANPRM, NPRM, and final rule or any basis to
conclude that the same phrasing used in each of the documents referred
to anything other than the plain meaning of the words.
---------------------------------------------------------------------------

    \33\ USCG-2017-0711-0004, p. 2.
    \34\ See subsection E, ``Facility and Vessel Risk Groups,''
expected text for Risk Group A Facilities.
    \35\ USCG-2017-0711-0004, p. 2, including a general citation to
the 2013 TWIC Reader final rule.
---------------------------------------------------------------------------

    One commenter expressed confusion regarding the applicability of
the electronic TWIC inspection requirement, specifically in regard to
how they would implement the requirement if they determined they were a
Risk Group A facility.\36\ The regulatory text states that ``prior to
each entry into a secure area of the facility, all persons must pass an
electronic TWIC inspection before being granted unescorted access to
secure areas of the facility.'' The definition of ``secure area''
reads, in part, ``the area . . . at a facility . . . over which the
owner/operator has implemented security measures for access control in
accordance with a Coast Guard approved security plan.'' This was
described at length in the TWIC Reader final rule, and has been clear
for some time, such as when stated by the GAO in 2011,\37\ ``[f]or most
maritime facilities, the secure area is generally any place inside the
outer-most access control point.'' Nonetheless, one commenter asserted
that it had based its planning on ``the assumption that electronic TWIC
inspections will only be required in those locations where bulk CDC is
actually transferred to or from a vessel.'' Based on that assumption,
the commenter suggested that its current planning processes could lead
to unforeseen costs if the Coast Guard does not change its regulations
to meet those expectations. We note that the TWIC Delay NPRM did not
propose or contemplate the commenter's theory that facilities that
handle CDC and transfer it to or from a vessel would only be required
to implement electronic TWIC inspection in the ``maritime nexus'' areas
of their facility. If such a transfer facility also handled CDC in
other parts of the facility, under the proposed TWIC Delay rule, it
would still be required to implement electronic TWIC inspection ``at
each entry to a secure area'' according to the regulatory text.
---------------------------------------------------------------------------

    \36\ USCG-2017-0711-0015, at p. 1-2.
    \37\ GAO-11-657, ``Transportation Worker Identification
Credential: Internal Control Weaknesses Need to Be Corrected to Help
Achieve Security Objectives,'' available at https://www.gao.gov.
---------------------------------------------------------------------------

    This confusion, and the potential impact, is also discussed in the
August 2019 ``comprehensive security assessment'' mandated by Public
Law 114-278, titled The Risk-Mitigation Value of the Transportation
Worker Identification Credential: A Comprehensive Security Assessment
of the TWIC Program. The authors of the assessment, the Homeland
Security Operational Analysis Center (HSOAC), anticipated that this
confusion could ``potentially increase the number of facilities . . .
subject to the TWIC Reader Rule to an even larger population of
facilities.'' HSOAC estimates that up to three times as many facilities
as estimated in the TWIC Reader final rule may fall under the broader
definition of a facility that

handles CDC in bulk, driving the estimate from 525 facilities to
1,500.\38\
---------------------------------------------------------------------------

    \38\ Assessment of the Risk Mitigation Value of the
Transportation Worker Identification Credential,'' HSOAC report at
p. 124 (available in the docket at www.regulations.gov under docket
number USCG-2017-0447). HSOAC derives this estimate by including
Risk Group A facilities; non-risk Group A (non-exempt) bulk liquid
or bulk oil facilities; and non-Risk Group A (non-exempt) facilities
receiving or transferring hazardous, explosive, or radioactive
materials.
---------------------------------------------------------------------------

    Based on the comments received, and the information presented in
the HSOAC assessment, we recognize the similarity between the phrases
``CDC facilities'' and ``Facilities that handle CDC in bulk,'' which
contributed to some confusion among commenters. While we do not believe
that the confusion affects the purpose of electronic TWIC inspection or
should be the cause for delaying implementation of the rule as a whole,
we do understand it may have affected the ability of some facility
operators to effectively comment on the full costs of the rule.
Accordingly, we are expanding on the proposal in the NPRM to delay the
implementation of the TWIC Reader rule at facilities that handle CDC in
bulk and transfer such cargoes from or to a vessel.

B. Concerns Relating to the Effectiveness of the Electronic TWIC
Inspection Requirement

    Since the TWIC Reader rule was published Congress and stakeholders
have questioned the extent to which electronic TWIC inspection,
compared to visual TWIC inspection, improves security and mitigates the
possibility of a TSI. As described above, the TWIC Accountability Act
of 2018 delayed implementation of the TWIC Reader rule until after an
assessment of its effectiveness.\39\ The HSOAC assessment ``review[ed]
the security value of the [TWIC] program,'' including ``evaluating the
extent to which the program . . . addresses known or likely security
risks in the maritime and port environments'' and the extent to which
the ``deficiencies in the program'' identified by the GAO and DHS OIG
have been addressed.\40\ The results of this assessment, which are
discussed in more detail below and are being considered by the Coast
Guard in the decision to delay the TWIC reader requirements, and will
be taken in to account in our consideration of follow-up actions to be
taken during the delay period provided by this final rule. While this
TWIC Reader delay was proposed in order for the Coast Guard to reassess
the risk anaylsis methodology for electronic TWIC inspection, questions
about the effectiveness of electronic TWIC inspection, and the TWIC
program generally, have been raised by various entities over the years.
In the comments to this rulemaking, several commenters raised concerns
about the effectiveness of TWIC, and we have responded to and
contextualized those comments here.
---------------------------------------------------------------------------

    \39\ Public Law 115-230, 132 Stat. 1631 (August 2, 2018).
    \40\ Public Law 114-278, Sec. 1(b)(C)(i) and (v), December 16,
2016.
---------------------------------------------------------------------------

    In the TWIC Reader NPRM and final rule, the Coast Guard set forth
the security rationale for the electronic TWIC inspection procedure,
and explained how it could help mitigate specific terrorist attacks and
lessen the possibility of a TSI. The Coast Guard emphasized three
particular ``attack scenarios''--an attack by a truck bomb, a terrorist
assault team, and a passerby/passenger explosive device situation.
These were considered the ``attack scenarios that are most likely to be
mitigated by the . . . enhanced access control afforded by TWIC
readers, as they require would-be attackers gaining access to the
target in question . . . to inflict maximum damage.'' \41\ Similarly,
in the final rule, we noted that we ``limited our consideration to
attack scenarios that require physical proximity to the intended target
and for which access control would affect the ability to conduct an
attack.'' \42\ In the response to comments during that rulemaking
process, we acknowledged that there were other ways to attack vessels
and facilities (for example, by secreting an explosive device in cargo)
that would not be mitigated by electronic TWIC inspection. We noted
that ``[f]or this reason, our analysis in this final rule focuses on
threats that could be prevented or mitigated through the use of
electronic TWIC inspection.'' \43\
---------------------------------------------------------------------------

    \41\ 78 FR at 17822.
    \42\ 81 FR at 57656.
    \43\ 81 FR at 57656.
---------------------------------------------------------------------------

    Many commenters raised questions about the efficacy of the TWIC
program in preventing attacks. One commenter stated that a TWIC reader
would not prevent the three identified attack scenarios, and that, if
it did, ``we should be using them in Syria and Iraq.'' \44\ While we
cannot speak on the particular security measures used in overseas
military bases, we do note that many U.S. government facilities around
the world indeed do use some form of access control measures for
security purposes.
---------------------------------------------------------------------------

    \44\ USCG-2017-0711-0003, attachment 3, p. 2.
---------------------------------------------------------------------------

    Another commenter questioned the utility of electronic TWIC
inspection in the three identified scenarios, asserting that ``an
individual or group intent on executing such an attack would not be
deterred simply because the targeted facility requires electronic TWIC
inspections rather than visual TWIC inspections.'' (emphasis in
original) \45\ We disagree that electronic TWIC inspection would offer
no additional security value over visual inspection in such a case.
Visual inspection cannot detect if a card has been revoked, cancelled,
or stolen. It is also less effective at determining if a card is
counterfeit or if the person presenting the card is the person to whom
the card was issued. In short, it would be likelier for an adversary to
gain unescorted access to the target--the secure area of the facility--
if the facility relied only on visual TWIC inspection. The commenter
went on to assert that ``terrorists generally use brute force when
attacking a target--particularly when carrying out the types of attacks
identified by [the Coast Guard's Maritime Security Risk Analysis Model]
MSRAM, . . . or blow up a checkpoint or other barrier rather than stop
to use false credentials to gain access.'' (emphasis in original).\46\
We agree that the inability to infiltrate a facility could cause a
terrorist group to employ additional means to initiate a full-scale
attack on a facility, if electronic inspection were used. However, we
would consider this an issue of electronic TWIC inspection
``mitigating'' an attack, as the latter scenarios may be more difficult
to mount, easier to detect, provide more time for responders to arrive,
or give potential targets advance warning of an attack and time to
clear the targeted area, among many other considerations. We also note
that the measures taken to mitigate these sorts of brute-force attacks,
such as bollards, fences, or other barriers, are generally ineffective
at preventing the infiltrations mitigated by electronic TWIC
inspection. The two types of security measures are complementary, not
mutually exclusive.
---------------------------------------------------------------------------

    \45\ USCG-2017-0711-0007, p. 7.
    \46\ USCG-2017-0711-0007, p. 7.
---------------------------------------------------------------------------

    Several commenters \47\ raised concerns that the Coast Guard had
not adequately addressed concerns raised by the GAO in its 2013 report
on the TWIC program.\48\ While the 2013 GAO report raised some concerns
about the TWIC program, we do not believe that report exposed specific
problems with the electronic TWIC inspection requirement. Instead, it
noted concerns

about the TWIC program that are outside the scope of the electronic
TWIC inspection requirement (e.g., unreliable cards and readers used in
the TWIC pilot program, or the ability of GAO operatives to obtain
genuine TWIC cards at enrollment centers using fraudulent means), and
noted that the Coast Guard had not conducted an effectiveness
assessment of the TWIC program as GAO had recommended in 2011.\49\ Many
of the GAO findings, for example, noting that ``the use of TWIC with
readers would not stop terrorists from detonating a truck at the
perimeter of a facility, . . . or obtaining a TWIC card using
fraudulent documents as we did through covert means'' are in fact
identical to the Coast Guard's analysis of these same facts, where we
noted that electronic TWIC inspection does not prevent every
conceivable security threat.\50\ Furthermore, we note that the Coast
Guard and TSA addressed many of the issues that GAO raised, such as
questions about the appropriateness of a single TWIC credential versus
state and local credentials, improved fraud detection techniques, the
establishment of internal and quality controls, or data collection
questions regarding the TWIC program, programmatically, and they no
longer presented an issue by the time we issued the TWIC Reader final
rule.
---------------------------------------------------------------------------

    \47\ See USCG-2017-0711-0006, 0007, and 0012.
    \48\ GAO-13-198, ``Transportation Worker Identification
Credential--Card Reader Pilot Results Are Unreliable; Security
Benefits Need to Be Reassessed,'' available at http://www.gao.gov.
    \49\ GAO 13-198, p. 41.
    \50\ GAO 13-198, p. 41.
---------------------------------------------------------------------------

    Several commenters asserted that the Coast Guard's failure to heed
GAO's recommendation to perform an effectiveness study render the final
rule flawed. One commenter stated that ``the Coast Guard's insistence
on promulgating a TWIC Reader Rule while refusing to substantively
respond to the GAO's and HSI's \51\ critiques was arbitrary and
capricious, and was contrary to the obvious intent of the SAFE Port Act
that the rule be based on empirical cost-benefit data. Although the
Coast Guard admits TWIC reader utility requires further study . . . it
nevertheless insists on partial implementation.'' \52\
---------------------------------------------------------------------------

    \51\ This refers to report entitled ``Independent Verification
and Validation of Development of Transportation Worker
Identification Credential (TWIC) Reader Requirements,'' Homeland
Security Institute, October 21, 2008 (the ``HSI Report''). A
redacted version of this document is available in the docket.
    \52\ USCG-2017-0771-0006 at 2-3.
---------------------------------------------------------------------------

    We believe the commenter here has conflated several ideas. First,
we note that while the GAO report stated that an effectiveness study
should be performed, the report was directed at Congress, which
declined to act on the recommendation until after the Coast Guard
promulgated the final rule.\53\ The HSI study, on the other hand,
expressed concerns about the use of asset categorization and,
separately, the mechanism by which the Coast Guard integrated the
``TWIC utility'' factor in determining risk assessments to inform asset
categorization.\54\ Those topics, while important, are not the same
thing as effectiveness. Furthermore, we disagree with the commenter's
assertion that promulgating the rule despite the concerns in these
reports renders the rule legally invalid. We note that the HSI report,
despite expressing concerns, did validate the Coast Guard's risk
analysis methodology and endorse the asset groupings the Coast Guard
suggested. In addressing the public comments on the TWIC rule, written
after the GAO report was released, we noted that the overwhelming
majority of the commenters supported the electronic TWIC inspection
requirements in general based on the security analysis conducted by the
Coast Guard, the lack of a generalized ``effectiveness'' study
notwithstanding. While the issues raised by stakeholders after the
final rule was promulgated merited consideration regarding
implementation of the electronic TWIC inspection requirement, we did
not then and do not now believe that they invalidate the fundamental
principles upon which Congress and the Coast Guard based the analysis.
---------------------------------------------------------------------------

    \53\ GAO 13-198 at 43, ``Matter for Congressional
Consideration.''
    \54\ See HSI study at 26.
---------------------------------------------------------------------------

    Nonetheless, as recommended by GAO, and mandated by Congress, DHS
has provided the HSOAC assessment of the security value of the TWIC
program. While many of the assessment's conclusions concern areas
outside of the particular security effectiveness of the electronic TWIC
inspection requirement, the assessment found that there were some
security benefits to electronic inspection of TWIC cards and that
readers may be a beneficial investment for facilities and vessels.
Specifically, the assessment found that ``the TWIC program is strongest
in reducing the risk presented by individuals who are known or
suspected terrorists and who seek to conduct an attack on a maritime
facility that would require persistent insider access via possession of
a TWIC credential.'' \55\ The assessment determined that ``TWIC does
impose costs on the adversary,'' and ``likely contributes to pushing
threatening actors toward simpler and potentially less harmful
attacks.'' \56\ Furthermore, the assessment found that the TWIC card
reader could ``increase the likelihood that invalid TWIC cards are
detected, and biometrics provide a robust mechanism for identity
verification.'' \57\ Moreover, some existing users have found that the
use of biometric, electronic readers can be both cost saving and
security enhancing. However, the assessment reiterated that the value
of TWIC is directly related to the quality of security that a vessel or
facility has overall, including having other security mechanisms in
place, such as security guards, PACS, and deployable security barriers.
Ultimately, the assessment found that adversaries are capable of
gaining unauthorized access via other means and that ``threats TWIC is
best intended to mitigate are . . . not the most pressing.'' \58\
---------------------------------------------------------------------------

    \55\ HSOAC report at xvii.
    \56\ Id.
    \57\ Id.
    \58\ Id. a. xviii.
---------------------------------------------------------------------------

    The cost effectiveness analysis on the electronic inspection
requirements in the TWIC Reader rule provided by the HSOAC assessment
was less favorable, stating that ``one would be hard-pressed to state
the benefits of TWIC reader rule outweigh the costs.'' \59\ In making
this determination, the assessment examined the Coast Guard's
methodology for determining the costs and benefits in the regulatory
analysis of the 2016 final rule. HSOAC then conducted their own
analysis using the same methodology with new cost data, when available.
The assessment found that the Coast Guard underestimated the costs of
the programs and overestimated the benefits by using the highest
maximum consequence scores. The ``break-even'' analysis used by the
Coast Guard to determine the benefits of the rule was found to be
appropriate, because it is well-established in the cost-benefit
literature, and has been widely used in previous DHS rulemaking
projects. However, the assessment found the Coast Guard overestimated
the benefits by using the average maximum consequence of a successful
terrorist attack, as provided by MSRAM, as the ``worst case'' scenario
in the analysis.\60\ The assessment suggests the use of a range of
consequence scores or the average consequence score would be more
appropriate.\61\ However, as noted in the report, the use of MSRAM data
is limited due to classification restrictions on the data, and in the
2016 analysis,

the Coast Guard was only able to use the maximum consequence for this
reason.
---------------------------------------------------------------------------

    \59\ Id.
    \60\ Id. at 133.
    \61\ Id. at. 135.
---------------------------------------------------------------------------

    The assessment also provided several suggestions and alternatives
to the existing program to improve the cost-effectiveness, including
limiting the facilities subject to the regulation by using a narrower
definition, or using different readers (such as portable readers that
can be used intermittently, access control systems or other inspection
solutions). Despite the reservations regarding the cost effectiveness
and benefits surrounding the TWIC readers, the assessment found that
approximately 50 percent of facilities HSOAC visited and examined have
implemented electronic inspection for TWIC, either in a PACS or
portable reader, and that in some cases those PACS also verify identity
using biometric systems.\62\ Also, nearly 20 percent of facilities
sampled by the assessment used more technologically sophisticated
biometric readers. During this delay period, USCG will be looking at
various means of implementing the use of TWICs at maritime facilities
including more efficient and cost effective electronic validation modes
and methods.
---------------------------------------------------------------------------

    \62\ Id. at 91.
---------------------------------------------------------------------------

    The facilities interviewed in the HSOAC assessment that effectively
integrated readers or access control solutions into operations have had
largely positive experiences.\63\ Perceptions were mixed on the degree
of enhanced security that the readers added, with over half of the
facilities interviewed finding some benefit. Those facilities found
specifically that ``if the readers are working properly, they are an
effective tool and provide an additional level of comfort and
security.'' \64\ While the HSOAC assessment favors a system approach to
risk-mitigation and does not advocate the use of TWIC as a sole means
of security for vessels and facilities, the Coast Guard is encouraged
by positive feedback provided by those facilities that preemptively use
TWIC readers, particularly the satisfaction with the program as a
whole. The Coast Guard is further analyzing the suggestions and
comments provided in the assessment, and determining if modifications
should be made to the program during the delay period.
---------------------------------------------------------------------------

    \63\ Id. at 99.
    \64\ Id. at 96.
---------------------------------------------------------------------------

C. Concerns Regarding Partial Implementation of the TWIC Reader Rule

    In the delay NPRM, the Coast Guard cited concerns about the risk
analysis methodology for electronic TWIC inspection as the chief reason
for proposing a partial delay of the TWIC Reader final rule.
Specifically, we highlighted concerns about ``asset categorization,''
the practice of grouping and analyzing facilities by class, as a basis
for the application of the electronic TWIC inspection requirement. For
example, the Coast Guard treats all facilities that ``handle CDC in
bulk'' as being in the same class, regardless of the geographical
location of the facility (e.g., whether it is near a large population
center) or the specific types and quantities of the bulk CDC handled at
the facility (e.g., whether it is a few thousand gallons of propane or
several thousand tons of chlorine). While questions about how the Coast
Guard would consider particular situations where the presence of bulk
CDC did not pose a threat above a particular threshold were addressed
in the TWIC Reader final rule, concerns raised after its publication
caused us to re-evaluate whether the risk analysis methodology was
adequate or satisfactory.\65\ Furthermore, we began the process of
reconsidering whether asset categorization was an appropriate means by
which to evaluate the risk potential of facilities, as opposed to a
more individualized methodology that incorporates factors such as local
population, environmental considerations, and similar factors. The
possibility of inadvertently capturing low-risk facilities in the mix
of Risk Group A facilities was the reason we proposed to delay the TWIC
Reader rule for ``non-transfer'' facilities. However, because
``transfer'' facilities and passenger facilities are high risk due to
the targets inside the facilities themselves, irrespective of exogenous
considerations, we declined to propose delaying the electronic TWIC
inspection requirements for those classes of facilities.\66\
---------------------------------------------------------------------------

    \65\ See, e.g, 78 FR 17782 at 17811, discussing the availability
of waivers in situations where minimal risk was determined.
    \66\ See 83 FR 29067 at 29073.
---------------------------------------------------------------------------

    Several commenters responded negatively to the Coast Guard's
proposal to implement the electronic TWIC inspection requirement in
only some Risk Group A facilities. One commenter urged the Coast Guard
to delay the requirement for all Risk Group A facilities ``rather than
work piecemeal.'' \67\ Another commenter asserted that a delay for all
facilities is necessary because ``manufacturers need regulatory
certainty to make appropriate, economically justifiable long-term
investments to protect facilities' threat and vulnerability
conditions,'' and that a partial delay will ``continue to create
regulatory uncertainty.'' \68\ A third commenter asserted that ``Coast
Guard personnel offered that delays for implementation for the Final
Rule were likely,'' and that ``it was expected that any delay for the
implementation would apply to all facilities.'' \69\
---------------------------------------------------------------------------

    \67\ USCG-2017-0711-0004, p. 1.
    \68\ USCG-2017-0711-0012, p. 1.
    \69\ USCG-2017-0711-0005, p. 2.
---------------------------------------------------------------------------

    We take seriously concerns that Coast Guard statements and actions
taken subsequent to the issuance of the final rule, including the
passage of legislation that postponed the implementation of the rule,
could create regulatory uncertainty. One commenter noted that ``the
regulated community and equipment manufacturers had reason to believe
the compliance deadline would be extended and the scope of the rule
possibly narrowed,'' leading to ``equipment manufacturers [delaying]
production until there is more certainty on the rule.'' \70\ Similarly,
one commenter noted that compliance with the reader rule would take
significant preparation, including ``restructuring access points,
training security operators, [and] testing the security interplay
between the TWIC readers and our existing access controls,'' \71\ which
it had not begun to implement due to belief that the rule would be
postponed.
---------------------------------------------------------------------------

    \70\ USCG-2017-0711-0013, p. 2.
    \71\ USCG-2017-0711-0005, p. 6.
---------------------------------------------------------------------------

    Several commenters expressed concern about additional costs
associated with partial implementation of the electronic TWIC
inspection requirement. In addition to concerns regarding delayed
production mentioned above,\72\ ``manufacturers remain concerned that
they lack the required lead time to sufficiently plan and install new
equipment, infrastructure, software, and to train new employees,'' \73\
and asserted that partial delay of the final rule would create
``logistical and financial challenges for facilities that are already
in compliance with the TWIC visual inspection requirements.'' \74\
These sentiments are echoed in the TWIC HSOAC assessment, where some
interviewees from Risk Group A facilities have experienced increased
costs and have found the number of vendors shrinking.\75\
---------------------------------------------------------------------------

    \72\ USCG-2017-0711-0013, p. 2.
    \73\ USCG-2017-0711-0012, p. 2.
    \74\ Id.
    \75\ HSOAC report at 98.
---------------------------------------------------------------------------

    One commenter suggested that an option set forth in the TWIC
rulemaking

to limit electronic TWIC inspection to discrete areas of a facility
where it handles bulk CDC--originally intended to be an option designed
to reduce costs--could end up creating problems if the delay is limited
to CDC transfer facilities only. The commenter laid out two scenarios
to show how this could happen, as described below.
    In the first scenario, the facility expends resources to isolate
the discrete bulk CDC area to the maritime transfer area. The commenter
writes that ``[i]f after the three-year delay period, the USCG
determines the bulk CDC handled by non-maritime means in many locations
throughout the facility does require electronic TWIC inspections, then
the facility will have no choice but to expand electronic TWIC
inspections to its perimeter fence-line (which also defines its secure
area). In this [scenario], the time effort, resources, and money spent
now isolating the discrete area(s) where bulk CDC is transferred to or
from a vessel will have been wasted.'' (emphasis in original) \76\ This
commenter is confusing the 2016 final rule, and the proposed changes in
the TWIC Delay NPRM. The NPRM did not propose to limit electronic TWIC
inspections to the areas of the facility where bulk CDC is transferred
to or from a vessel. Instead, it proposed to limit the requirement to
``[f]acilities that handle Certain Dangerous Cargoes (CDC) in bulk and
transfer such cargoes from or to a vessel.'' \77\ Such facilities would
still have been subject to the general requirement that they conduct
electronic TWIC inspection pursuant to 33 CFR 101.535(b), which
requires electronic TWIC inspection before being granted unescorted
access to secure areas of the facility. The option to isolate
electronic TWIC inspection to discrete areas of the facility where bulk
CDC is handled still required electronic TWIC inspection at all
locations within the applicable facilities where CDC is handled,
regardless of whether that was the location it was being transferred to
or from a vessel. There was never a proposal to limit the requirement
to maritime transfer areas, and, thus, we would not expect this
scenario to occur.
---------------------------------------------------------------------------

    \76\ USCG-2017-0711-0007, p. 6.
    \77\ 83 FR at 29081.
---------------------------------------------------------------------------

    In the second scenario, the commenter imagines that ``rather than
isolating the discrete area(s) where bulk CDC is transferred to or from
a vessel, a facility chooses to conduct electronic TWIC inspections of
all personnel seeking unescorted access into its secure area (i.e., at
the perimeter fence line. . . . If after the three-year delay period,
the USCG determines the bulk CDC handled by non-maritime means at the
facility does not require electronic TWIC inspections, then the
facility will have wasted significant time, effort, resources, and
money.'' \78\ While the Coast Guard has not ever proposed limiting
electronic TWIC inspection criteria to the maritime area, we realize
that if we were to change the regulation in that way after promulgating
a wider regulation, it could result in significant unnecessary
expenditures. While the commenter's analysis mischaracterizes the
proposal in the TWIC Delay NPRM, we believe this demonstrates that
there remains significant confusion regarding the scope of the rule.
This is a valid point and one that we have considered in promulgating
this delay.
---------------------------------------------------------------------------

    \78\ USCG-2017-0711-0007, p. 6-7.
---------------------------------------------------------------------------

D. Problems Estimating the Total Cost of Implementation of the
Electronic TWIC Inspection Requirement

    In the TWIC Reader rulemaking, the Coast Guard limited the
electronic TWIC inspection to high-risk facilities for purposes of
producing an efficient regulatory scheme. While we acknowledged that
electronic TWIC inspection would improve security at all MTSA-regulated
facilities, we concluded that, for many facilities, the cost of
implementing such measures would be too high relative to the security
benefits achieved. For that reason, we conducted extensive analysis as
to which types of facilities posed the greatest threat to persons and
key infrastructure targets, as well as which types of facilities would
reap the greatest benefits from the proposed countermeasures. We
determined that applying electronic TWIC inspection requirements only
to Risk Group A facilities provided the most efficient security
measures. The TWIC Reader rule final regulatory analysis (RA) estimated
that the rule would require compliance actions by 525 facilities and 1
vessel, for a total cost of $153.8 million (discounted at 7-percent)
over a 10-year period.\79\
---------------------------------------------------------------------------

    \79\ See Transportation Worker Identification Credential (TWIC)
Reader Requirements--Regulatory Analysis and Final Regulatory
Flexibility Analysis, November 2015, p. 8, available at docket #
USCG-2007-28915-0231.
---------------------------------------------------------------------------

    In response to the TWIC Delay NPRM, several commenters challenged
the underlying assumptions that the Coast Guard used in developing this
figure. Commenters first argued that the Coast Guard's analysis
undercounted the number of facilities by including both transfer
facilities and non-transfer facilities in its total estimate of 525
estimated facilities. Secondly, commenters argued that the inclusion of
the phrase ``and receive vessels carrying CDC'' in the text of the
final rule added additional regulated facilities, which were not
included in the RA. We address each of these issues below. We note that
specific comments relating to the Coast Guard's economic analysis are
addressed below in Section IV. G., ``Comments on the Regulatory
Analysis.''
    One major issue raised by commenters concerned the number of
facilities subject to the electronic TWIC inspection requirements,
specifically the idea that the Coast Guard had underestimated the
number of facilities that would be characterized as Risk Group A under
the new regulations. In the 2013 TWIC Reader NPRM, the Coast Guard
estimated that 532 facilities would be classified as Risk Group A,\80\
a number that was modified in the 2016 final rule due to the exclusion
of 7 barge fleeting facilities.\81\ In the TWIC Delay NPRM, we broke
down the nature of these 525 facilities, indicating that they consisted
of 122 ``non-transfer'' facilities, as well as 403 passenger and
``transfer'' facilities combined.\82\ One commenter stated ``neither
the [2013 TWIC Reader NPRM RA] nor the [2016 TWIC Reader final rule RA]
ever discusses this class of facilities.'' \83\ This commenter is
correct: both the TWIC Reader NPRM and final rule applied the
requirement to ``facilities that handle CDC in bulk,'' and did not draw
a distinction between those that transfer it to/from vessels and those
that do not, and so never separated the types of facilities for the
purposes of economic analysis. Because the TWIC Delay NPRM was the
first instance in which the Coast Guard considered different
requirements for transfer and non-transfer facilities, we included a
separate count of the non-transfer facilities.
---------------------------------------------------------------------------

    \80\ 78 FR 17782 at 17787, Table ES-2.
    \81\ 81 FR 57652 at 57654, Table 1.
    \82\ See 83 FR at 29074. We note that the NPRM did not
specifically delineate the breakdown among the 403 facilities that
would not have been delayed under the proposal.
    \83\ USCG-2017-0711-0007, p. 9.
---------------------------------------------------------------------------

    The commenter also suggested that the Coast Guard had dramatically
underestimated the number of non-transfer facilities. The commenter
states, ``it is likely that approximately 525 (or more) facilities
handle bulk CDC by non-maritime means.'' It is unclear if the commenter
is suggesting that there are a total of 525 facilities that handle bulk
CDC by non-maritime means (in line with our estimates), or if there are
525 facilities that handle bulk CDC by non-maritime means exclusively,
which would exceed the Coast Guard's

estimates. The commenter also cited the 2017 Petition for
Rulemaking,\84\ noting, ``the Petition estimated that there are closer
to 1,500 Non-Transfer Facilities nationwide, most of which handle bulk
CDC by non-maritime means.'' \85\ (The use of the phrase ``most of
which'' does appear to imply that the number of facilities is a total
count, in line with Coast Guard estimates.) This figure is cited in the
TWIC assessment report also, as mentioned above. Based on the
information provided by both the commenter and HSOAC, we will attempt
to get a much fuller estimate of the population in future studies, as
described in the TWIC Delay NPRM.
---------------------------------------------------------------------------

    \84\ See USCG-2017-0457-0001.
    \85\ USCG-2017-0711-007, p. 10.
---------------------------------------------------------------------------

    Commenters expressed concern about the inclusion, in the TWIC
Reader final rule, of regulatory text that the Coast Guard did not
originally propose in the TWIC Reader NPRM. Specifically, while the
proposed regulatory text in the TWIC Reader NPRM (and the associated
text discussed in the TWIC Reader ANPRM) applied the Risk Group A
requirements to ``Facilities that handle Certain Dangerous Cargoes
(CDC) in bulk,'' \86\ the TWIC Reader final rule added the phrase ``or
receive vessels carrying CDC in bulk'' to that sentence.\87\ In the
final rule, we explained the rationale for the additional language. In
explaining our interpretation of the word ``handle'' in Sec.
105.253(a), the TWIC Reader final rule stated that the purpose of the
additional language at issue was to ``clarify risk groups.'' \88\ The
Coast Guard explained that a facility that receives vessels carrying
CDC bulk, even if the CDC is not transferred to the facility, is
functionally the same as a facility that creates, stores, processes, or
transfers (i.e., ``handles'') bulk CDC, insofar as there is bulk CDC
present and it is the responsibility of the facility to restrict access
to those CDCs to valid TWIC-holders. We reasoned that, ``[w]hile moored
at a facility, a vessel must rely on the facility's security program to
adequately secure the interface between the facility and vessel and
mitigate the threat of a TSI.'' \89\ Thus, the Coast Guard does not
consider the phrase ``or receives vessels carrying CDC in bulk'' to be
a new class of facilities subject to the electronic TWIC inspection
requirements, but merely clarification of the original proposed text of
Sec.  105.253(a).
---------------------------------------------------------------------------

    \86\ 78 FR 17782 at 17831, proposed regulatory text Sec.
105.253(a)(1).
    \87\ 81 FR 57652 at 57712, final regulatory text Sec.
105.253(a)(1).
    \88\ 81 FR 57652 at 57681.
    \89\ Id.
---------------------------------------------------------------------------

    Because the Coast Guard did not consider the new language to add
new requirements to the rule, we did not list ``facilities that receive
vessels carrying CDC in bulk'' as a separate category of facilities in
the regulatory text, nor did we consider that it would change the
number of facilities affected by the electronic TWIC inspection rule in
the delay NPRM. Furthermore, based on the information available at the
time, the Coast Guard did not believe there were any facilities that
received vessels carrying CDC, but did not in any other way store, use,
process, or transfer bulk CDC on the facility (even if some vessels
carrying bulk CDC did not unload their cargo at the facility), and so
we did not add them to the affected population. However, after the
publication of the final rule, various parties informed the Coast
Guard, without presenting data, that they believed there was a
population of facilities that received vessels carrying CDC bulk
without otherwise handling bulk CDC on their facilities. The Coast
Guard took such statements in good faith, and thus, in the TWIC Delay
NPRM, we stated, ``we cannot determine the number of [facilities that
receive vessels carrying CDC in bulk] at this time.'' \90\
---------------------------------------------------------------------------

    \90\ 83 FR 29067 at 29074.
---------------------------------------------------------------------------

    One commenter argued that because the number of affected facilities
remained consistent between the NPRM and final rule despite the
addition of the new language to Sec.  105.253(a), the Coast Guard's
``accounting for Non-Transfer facilities are so suspect that they
should be ignored.'' \91\ We disagree. As explained above, the affected
population remained consistent between the TWIC reader NPRM and final
rule because the policy in the documents was consistent. Furthermore,
we note that despite its assertion that the lack of a separate
accounting for this class of facility renders the Coast Guard's
calculations moot, the commenter affirms the Coast Guard's original
logic, noting in a parenthetical that ``relatively few facilities that
receive vessels carrying CDC without transferring them do not also
handle bulk CDC by non-maritime means.'' \92\ Similarly, one commenter
argues, ``the methodology defining the risk categories does not include
lay-berth \93\ or other cargoes contained or not transferred.'' \94\
For the reasons described above, the Coast Guard disagrees, and notes
the 2016 TWIC Reader rule methodology explicitly accounts for these
situations.
---------------------------------------------------------------------------

    \91\ USCG-2017-0711-0007, p. 10.
    \92\ USCG-2017-0711-0007, p. 10.
    \93\ ``Lay berth'' is the situation where a vessel docks at a
facility, but does not load or unload cargo.
    \94\ USCG-2017-0711-0013, p. 2.
---------------------------------------------------------------------------

E. Use of Electronic TWIC Inspection at Passenger Facilities and
Vessels

    Unlike facilities that handle CDC in bulk, the Coast Guard did not
propose to delay the final rule for any passenger facilities, and based
upon comments to this rulemaking, is not extending the delay to those
facilities at this time. We believe that implementing the electronic
TWIC inspection requirement at passenger facilities and vessels will
provide improved security benefits for these facilities, which include
large ferry and cruise terminals that handle 60 plus million passengers
per year.
    We received only one comment specific to the treatment of passenger
vessels and facilities, which contained several major arguments. First,
the commenter argued that passenger facilities that do not receive
vessels subject to electronic TWIC inspection requirements should also
be exempt from the requirements, regardless of how many passengers use
the facility. More specifically, the commenter suggested that
facilities receiving vessels with less than 20 crewmembers should be
exempt from the electronic TWIC inspection requirement. Finally, the
commenter suggested that electronic TWIC inspection does not
substantially enhance security at passenger facilities.\95\ We address
each of these arguments below.
---------------------------------------------------------------------------

    \95\ USCG-2017-0711-0009, p. 2.
---------------------------------------------------------------------------

    The commenter raised an issue, also raised in the TWIC Reader
rulemaking, that facilities that receive vessels be exempted from the
electronic TWIC inspection requirement due to low numbers of crew. The
comment noted that vessels with 20 or fewer TWIC-holding crewmembers
are exempt from the electronic TWIC inspection requirement, but that
this exemption does not apply to facilities. It stated that, if a Coast
Guard-approved vessel security plan for a larger ferry designates
certain portions of the vessel as off-limits to a passenger and
requires a person to possess a valid TWIC to have unescorted access
secure areas, the same standard should apply to a terminal that
receives such a vessel. The commenter asserted that it was an
``anomaly'' that certain passenger vessels are not required to carry
and deploy TWIC readers, but a facility that receives such a vessel is
required to have and use TWIC readers.\96\ We do not believe this is an
anomaly, and would refer the commenter back to the logic

underpinning the requirement. In the TWIC final rule, in a section
entitled, ``The Crewmember Exemption Does Not Apply to Facilities,''
\97\ we explained that ``the rationale that justifies an exemption for
vessels with a low crew count does not transfer to facilities,'' \98\
noting that while at sea, few persons board or depart a vessel, while
persons constantly do so at facilities. We continue to stand by the
reasoning laid out in that section of the TWIC final rule. The Coast
Guard also reiterated that the statutory provision in 46 U.S.C.
70105(m)(1) mandates an exemption from the electronic TWIC inspection
requirement for vessels with a low crew count, and noted that there was
no such provision for facilities.
---------------------------------------------------------------------------

    \96\ USCG-2017-0711-0009, p. 2.
    \97\ 81 FR at 57682.
    \98\ 81 FR at 57682.
---------------------------------------------------------------------------

    The commenter also suggested that the value of electronic TWIC
inspection at passenger facilities is minimal, and that the current
level of security is adequate. The commenter stated that ``One
[Passenger Vessel Association] ferry operator subject to the current
rule reports that its facility security plan designated only the office
of the facility security officer (FSO) as a secure space and that only
the FSO works in the office. Under the current rule, there will need to
be a TWIC reader installed in this space so the FSO can validate his
own TWIC each time he enters his office.'' \99\ While we cannot speak
to individual circumstances, we note that the definition of a ``secure
area'' is, in part, ``the area . . . at a facility over which the
owner/operator has implemented security measures for access control in
accordance with a Coast Guard approved security plan. It does not
include passenger access areas, employee access areas, or public access
areas.'' \100\ While it is possible that a facility could have no
access control measures outside of the FSO's office, we note that many
passenger facilities do contain substantial secure areas.
---------------------------------------------------------------------------

    \99\ USCG-2017-0711-0009, p. 2.
    \100\ See 81 FR at 57671, citing 33 CFR 101.105.
---------------------------------------------------------------------------

    We do agree with the commenter that there are differences in the
layouts and security profiles of passenger facilities and other Risk
Group A facilities (that handle CDC in bulk), and note that these
differences are paramount in the Coast Guard's decision not to delay
the electronic TWIC inspection for passenger facilities. We stated the
differences explicitly in the final rule, highlighting the differences
between chemical cargo facilities where the entire facility may be
considered a ``secure area'' and facilities that have public access
areas, like parking lots with TWIC inspection conducted at a secure
access point would be outside of the public access area.\101\ For
passenger facilities, the majority of the areas may be designated
``public access areas,'' ``passenger access areas,'' or ``employee
access areas'' (such as break rooms). In such an instance, electronic
TWIC inspection points may only be located at entrances to secure areas
such as the pier or FSO's office.\102\
---------------------------------------------------------------------------

    \101\ 81 FR at 57671.
    \102\ Id.
---------------------------------------------------------------------------

    While we agree with the commenter that the secure area footprint of
a passenger facility may be small, we disagree that this constitutes a
rationale for delaying or eliminating the electronic TWIC inspection
requirements at passenger facilities. Unlike a facility that handles
CDC in bulk, where the targets of a potential terrorist attack would be
located exclusively inside the secure area, at passenger facilities the
potential target--the passengers themselves--would be almost
exclusively located outside the area secured by a TWIC, as passengers
are not escorted, nor do they generally hold TWICs. However, vital
parts of the facility, including waterside access to the vessel,
baggage handling and security areas, storage areas for equipment such
as vessel fuel or cleaning supplies, and administrative offices, are
all secured by electronic TWIC inspection. These security measures help
to ensure that access to those targeted areas is restricted to persons
who have been granted unescorted access to these areas. By implementing
TWIC inspection for waterside access to the vessel and baggage handling
and storage area, and the like, the potential for a TSI is decreased.
For these reasons, the Coast Guard believes it is imperative that we
begin implementation of this part of the electronic TWIC inspection
requirement as soon as possible.

F. Miscellaneous Comments

    The Coast Guard received several comments that do not fit into any
of the above categories. One commenter asked why some Captains of the
Port (COTPs) are authorized to grant waivers to facilities and some are
not, as well as under what conditions waivers are authorized.\103\ We
note that all COTPs are authorized to permit facilities to continue to
operate in the event of non-compliance pursuant to 33 CFR 105.125,
which is different than authority to grant waivers. Waivers can be
authorized under the provisions of 33 CFR 105.130. The regulatory text
in 33 CFR part 105 contains explanations of noncompliance and waivers
and when they will be granted. The commenter also asked whether the
existence of waivers implied that the TWIC delay final rule should
include all facilities subject to the electronic TWIC inspection. For
the reasons discussed above, the answer is no.
---------------------------------------------------------------------------

    \103\ USCG-2017-0711-0008.
---------------------------------------------------------------------------

    One commenter stated that the proposed rule does not define ``bulk
storage.'' \104\ We note that the term ``bulk'' is defined in 33 CFR
101.105, and we apply the plain meaning to the term ``storage.'' The
commenter also suggested that, to avoid confusion, the rule should list
the CDC chemicals, and asked about the treatment of a mixture of
chemicals listed as CDCs. We agree with the commenter that a list of
CDCs would be helpful, and to that end, are publishing such a list
concurrently with this rule, in accordance with 33 CFR 160.202. The
list is published in the docket and will be maintained in Homeport.
With regard to ``mixtures,'' we note it could depend on the particular
chemistry at issue; therefore, we do not have enough information to
provide an answer.
---------------------------------------------------------------------------

    \104\ USCG-2017-0711-0011.
---------------------------------------------------------------------------

G. Comments on the Regulatory Analysis

    The Coast Guard did not receive any comments on the costs and
benefits associated with delaying the implementation of the TWIC Reader
final rule. However, we received several comments regarding the costs
and benefits associated with the requirement for electronic TWIC
inspection, as published in the 2016 TWIC Reader final rule RA.\105\ As
the 2016 TWIC Reader final rule RA is the main data source for the RA
published in the TWIC Delay NPRM, we address these comments below.
---------------------------------------------------------------------------

    \105\ USCG-2007-28915-0231.
---------------------------------------------------------------------------

1. Comments on the Total Cost of the TWIC Reader Rule
    One commenter stated that the Coast Guard underestimated the total
cost of the final TWIC Reader rule, citing the declaration of a Dow
chemical employee.\106\ The employee estimated the TWIC Reader Rule
would result in an annual productivity loss resulting from the delay
time of using the TWIC readers of $3.65 million for one Dow facility,
and a $10 million cost to all Dow facilities including productivity
losses, and hardware, infrastructure, installation, and maintenance
costs. The commenter states that Dow's costs alone are almost half of
the $22.5 million in

annualized costs as estimated by the final rule.
---------------------------------------------------------------------------

    \106\ USCG-2017-0711-0006.
---------------------------------------------------------------------------

    The cost estimates provided in the final TWIC Reader rule represent
the average burden across all facilities subject to that rulemaking,
and therefore the estimates may not reflect the individual
circumstances of each facility or firm. In addition, the $10 million
value provided by the commenter is an annual value and is not
comparable to the $22.5 million annualized cost estimate provided in
the final rule. An annualized value accounts for the fact that the
costs of the rule will differ over time and provides an estimate that
spreads these costs equally over the analysis period, taking a discount
rate into account. This value accounts for years where a facility may
have larger costs associated with implementing the rule due to one time
or infrequent costs such as purchasing hardware, installation, and
infrastructure costs, as well as years where the facility will have
much smaller ongoing costs. During the first two years of the cost
analysis, the Coast Guard accounted for these large onetime costs and
estimated a much larger total annual cost of approximately $56 million
per year. The $10 million value provided by the commenter includes
onetime costs such as hardware and, therefore, is not directly
comparable to the $22.5 million annualized cost estimate, which smooths
these costs over time.
    Furthermore, we note that the majority of the measured costs the
commenter cites are operational losses due to ``average daily loss in
productivity of $10,000 per day.'' The TWIC Reader rule provided
facility operators flexibility with regard to the purchase,
installation, and use of electronic readers, allowing facilities to
adjust their operations to reduce large delay times. The RA for the
TWIC Reader rule accounted for the fact that some facilities may have
to make modifications to business operations to accommodate electronic
TWIC inspection requirements, such as increasing the number of access
points for vehicles. Thus, we believe most facilities would be able to
adjust their operations to ensure the most efficient use of the readers
rather than incurring large delay costs.
2. Comments on the Economic Impact of the Rules
    We received one comment on the potential ``significant economic
impact'' of the TWIC Reader rule.\107\ The commenter believes the TWIC
Reader rule will disrupt the efficient transportation of goods, which,
in turn, may result in ``very high economic costs.'' As evidence, the
commenter provided information on the contribution of Louisiana's oil
and gas and chemical sectors to the Gross Domestic Product (GDP),
employment numbers, and household earnings, information on the amount
of cargo shipped through ports located in Louisiana, as well as
information on the tank truck industry. The commenter also asserts that
the Coast Guard did not regulate container facilities not otherwise
categorized in Risk Group A because of the ``significant levels'' of
''delay costs,'' and states this is evidence of the high economic costs
of transportation delays.
---------------------------------------------------------------------------

    \107\ USCG-2017-0711-0006.
---------------------------------------------------------------------------

    While the economic data presented by the commenter provides
information on the oil and gas industry in Louisiana and on the tank
truck industry, it does not provide any information on how the TWIC
Reader rule may impact these industries, or the cost of the TWIC Reader
rule to these industries. We do note the commenter provides context to
the enormous importance of securing these facilities from terrorist
attack, given their large role in the local, as well as national,
economy.
    Further, the Coast Guard disagrees that we did not regulate
container facilities that would not otherwise be categorized in Risk
Group A because of significant delay costs associated with the TWIC
Reader rule, and this is evidence of the high economic costs of delays.
Rather, the Coast Guard did not regulate these container facilities
because, upon review, we found that many of the high-risk threat
scenarios at container facilities would not be mitigated by electronic
TWIC inspection. Therefore, the costs of electronic TWIC inspection for
container facilities not in Risk Group A would not be justified by the
amount of potential risk reduction at these facilities. This is keeping
with the requirements of Executive Order 12866, which directs agencies
to select approaches which maximize the net benefits to society.
3. Comments on the Use of the TWIC Pilot Program Data
    The Coast Guard received two comments on the 2016 RA's use of cost
information from the TWIC Reader pilot program.\108\ One commenter
stated that the data from the TWIC Pilot Program is too out-of-date to
be used, and that the pilot program failed to accurately evaluate delay
times associated with the 2016 TWIC Reader rule. Both commenters cite
the May 2013 GAO report ``Transportation Worker Identification
Credential: Card Reader Pilot Results Are Unreliable; Security Benefits
Need to Be Reassessed,'' (GAO-13-198) as evidence the pilot data is
inaccurate, and believe the Coast Guard's reliance on this data
contravenes the GAO's findings. Issues with the pilot data were also
raised in the HSOAC assessment. The assessment stated that the use of
the pilot study data in generating the 2015 regulatory analysis was
flawed in that it made faulty assumptions of the number of readers
required at facilities.\109\
---------------------------------------------------------------------------

    \108\ USCG-2017-0711-0006; USCG-2017-0711-0007.
    \109\ HSOAC report at 128.
---------------------------------------------------------------------------

    While the Coast Guard acknowledges there were many challenges in
the implementation of the TWIC reader pilot program, we believe the
considerable data obtained were of sufficient quantity and quality to
support the general findings and conclusions of the TWIC reader Pilot
Report. The pilot program obtained sufficient data to evaluate TWIC
reader performance and assess the impact of using TWIC readers at
maritime facilities. Furthermore, the Coast Guard supplemented the
information from the TWIC Pilot Program with other sources of
information. For example, in the 2016 RA, the Coast Guard estimated the
number of access points per facility type through the use of an
independent data source (Facility Security Plans), and estimated the
costs of TWIC readers through published pricing information. The Coast
Guard did not use this data from the pilot program for the exact
reasons the commenters suggest.
4. Comments on Collecting New Cost Data
    One commenter stated that the TWIC Delay NPRM gave no indication
the Coast Guard would use the three-year delay period to gather new
economic data, and thus any economic analysis supporting future rule
makings would be based on the same ``faulty'' cost data as the previous
rulemakings.\110\
---------------------------------------------------------------------------

    \110\ USCG-2017-0711-0007.
---------------------------------------------------------------------------

    While the Coast Guard did not explicitly state it would gather new
cost information to support future rulemaking efforts, that does not
mean we would not gather additional cost information to support future
rulemakings. If the Coast Guard chooses to implement a new rulemaking,
the supporting RA would use the best reasonably available economic
information, as required by OMB circular A-4. Depending on the

information available, this cost data may or may not be new.

H. Conclusion

    Based on the concerns of commenters regarding implementation
problems, particularly involving confusion regarding the final rule and
delay NPRM, delays in undertaking compliance action, and difficulty
acquiring equipment, a delay for all facilities that handle CDC in bulk
represents the best path forward. In doing so, we can give facilities
that handle CDC in bulk additional time to acquire and install
equipment, train personnel, make operational adjustments, and update
FSPs to account for use of electronic TWIC inspection in areas that
contain bulk CDC. We also note that, as described in this document and
in the TWIC Delay NPRM, we are studying the distribution of bulk CDC at
MTSA-regulated facilities, with the goals of determining the exact
population of affected facilities and the properties of the particular
chemicals stored at these facilities. We believe that delaying the
implementation of the rule for facilities that handle CDC in bulk will
allow those facilities to reduce costs by providing adequate time to
implement the requirements under conditions of more regulatory
certainty and equipment availability. We also believe that the
implementation of electronic TWIC inspection requirements at passenger
facilities, and for the one large passenger vessel, will provide
immediate security benefits at those facilities and vessel in
protecting vital parts of the facility from potential TSI. Overall, we
estimate that this policy implements the electronic TWIC inspection
requirement at 155 facilities, primarily cruise and large ferry
terminals that handle 60 plus million passengers per year and 1 vessel,
in furtherance of enhanced security measures to protect passengers and
the public. In order to comply with this immediate security need,
facilities and vessels will have 60 days to implement the TWIC reader
requirement. It also provides the Coast Guard time to analyze the
suggestions and comments relating to the TWIC program provided in the
assessment, and determine what modifications should be made during the
delay period.

V. Regulatory Analysis

    This final rule will delay implementation of the TWIC Reader rule
for 3 years for all facilities that handle CDC in bulk, which are
comprised of three types of Risk Group A facilities: (1) Facilities
that handle certain dangerous cargoes in bulk, but do not transfer
these cargoes to or from a vessel; (2) facilities that handle certain
dangerous cargoes in bulk, and do transfer these cargoes to or from a
vessel; and (3) facilities that receive vessels carrying certain
dangerous cargoes in bulk, but do not, during that vessel-to-facility
interface, transfer these bulk cargoes to or from those vessels. This
rule will delay the implementation of the TWIC Reader rule for 370 of
the 525 affected Risk Group A facilities. The remaining 155 facilities
(which are all facilities that receive large passenger vessels), and 1
vessel will have to implement the requirements of the TWIC reader rule
by June 8, 2020.
    Below, we provide an updated regulatory analysis of the TWIC Reader
rule that presents the impacts of delaying the effective date of the
TWIC Reader rule for the three types of Risk Group A facilities defined
in the preceding paragraph. We developed this rule after considering
numerous statutes and Executive orders related to rulemaking. Below we
summarize our analyses based on these statutes or Executive orders.
    For this updated analysis, we estimated the impact of delaying the
TWIC Reader rule by calculating the 10-year cost of this final rule,
where only certain facilities will incur costs starting in Years 1 and
2 and other facilities will incur no costs in the first 2 years, and
compare it to the 10-year cost presented in the RA for the TWIC Reader
rule.\111\ We then calculated the difference between the two costs to
estimate the impact of this final rule. To properly compare the costs
and benefits of this final rule and the TWIC reader rule, we first
updated the costs of the TWIC Reader rule from 2012 dollars to 2016
dollars.
---------------------------------------------------------------------------

    \111\ At the time of analysis, the Coast Guard did not have a
final draft HSOAC assessment, and therefore we did not incorporate
any cost estimates from that report into our analysis, as we were
unable to review or validate those cost estimates for our RA.
Further, as the HSOAC assessment was published after the publication
of the NPRM, the public would not have had the opportunity to review
and comment on those cost estimates. However, we did make
modifications to the RA to address the mathematical errors from the
2016 RA as identified in the HSOAC assessment. These errors affected
estimates of the average number of readers per access point, and the
average installation and infrastructure cost per reader at
facilities.
---------------------------------------------------------------------------

A. Regulatory Planning and Review

    Executive Orders 12866 (Regulatory Planning and Review) and 13563
(Improving Regulation and Regulatory Review) direct agencies to assess
the costs and benefits of available regulatory alternatives and, if
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety effects, distributive impacts, and equity). Executive
Order 13563 emphasizes the importance of quantifying both costs and
benefits, of reducing costs, of harmonizing rules, and of promoting
flexibility. Executive Order 13771 (Reducing Regulation and Controlling
Regulatory Costs) directs agencies to reduce regulation and control
regulatory costs and provides that ``for every one new regulation
issued, at least two prior regulations be identified for elimination,
and that the cost of planned regulations be prudently managed and
controlled through a budgeting process.''
    This rule is a significant regulatory action under section 3(f) of
Executive Order 12866. The Office of Management and Budget has reviewed
it under that Order. It requires an assessment of potential costs and
benefits under section 6(a)(3) of Executive Order 12866. DHS considers
this rule to be an Executive Order 13771 deregulatory action. See the
OMB Memorandum titled ``Guidance Implementing Executive Order 13771,
titled `Reducing Regulation and Controlling Regulatory Costs''' (April
5, 2017). Details on the estimated cost savings of this rule can be
found in the rule's regulatory analysis (RA) that follows.

    We have determined that this final rule does not have an annual
effect on the economy of $100 million or more. This rule is an
``other'' significant regulatory action under Executive Order 12866,
because of its impact on industry.\112\ Therefore, in accordance with
OMB Circular A-4, we have prepared an accounting statement showing the
classification of impacts associated with this final rule.\113\
---------------------------------------------------------------------------

    \112\ Under Executive Order 12866 economically significant
regulatory action means any regulatory action that is likely to have
an annual effect on the economy of $100 million or more, or
adversely affect in a material way the economy, a sector of the
economy, productivity, competition, jobs, the environment, public
health or safety, or State, local, or tribal governments or
communities. The Office of Information and Regulatory Affairs (OIRA)
may deem other regulatory actions significant if that action is
likely to (1) Create a serious inconsistency or otherwise interfere
with an action taken or planned by another agency; (2) Materially
alter the budgetary impact of entitlements, grants, user fees, or
loan programs or the rights and obligations of recipients thereof;
or (3) Raise novel legal or policy issues arising out of legal
mandates, the President's priorities, or the principles set forth in
Executive Order 12866.
    \113\ https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A4/a-4.pdf.

                                        Table 1--OMB A-4 Accounting Statement 2019-2029 Period of Analysis--2016$
--------------------------------------------------------------------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------------------------------------------------------
Category                                 Primary estimate
                                         Minimum estimate
                                           High estimate            Source............
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                        Benefits
--------------------------------------------------------------------------------------------------------------------------------------------------------
Annualized monetized benefits   None..............              7%  None..............              7%  None..............              7%  RA.
 ($ Mil).
                                None..............              3%  None..............              3%  None..............              3%
                               ------------------------------------------------------------------------------------------------------------
Annualized quantified, but                                                         None                                                     RA.
 unmonetized, benefits.
                               ------------------------------------------------------------------------------------------------------------
Unquantifiable Benefits.......    For facilities with a delayed compliance, final rule will postpone the enhanced benefits of electronic    RA.
                                                                              TWIC inspection.
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                      Cost Savings
--------------------------------------------------------------------------------------------------------------------------------------------------------
Annualized monetized cost       $3,380,017........              7%  ..................              7%  ..................              7%  RA.
 savings ($ Mil).
                                $2,144,017........              3%  ..................              3%  ..................              3%  RA.
                               ------------------------------------------------------------------------------------------------------------
Annualized quantified, but                                                         None                                                     RA.
 unmonetized, cost savings.
                               ------------------------------------------------------------------------------------------------------------
Qualitative (un-quantified)      The final rule will delay the cost to retrieve or replace lost PINs for use with TWICs for the facilities  RA.
 cost savings.                                                          with delayed implementation.
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                        Transfers
--------------------------------------------------------------------------------------------------------------------------------------------------------
Annualized monetized..........            Not calculated
                                          Not calculated
                                          Not calculated            RA................
                               ------------------------------------------------------------------------------------------------------------
From whom to whom?............                                                                                RA.
                               ------------------------------------------------------------------------------------------------------------
Annualized monetized                           None
 transfers: ``off-budget''.
                                               None
                                               None
From whom to whom?............                 None
                                               None
                                               None
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                             Miscellaneous Analyses/Category
--------------------------------------------------------------------------------------------------------------------------------------------------------
Effects on State, local, and/                  None
 or tribal governments.
                                               None
                                               None
                               ------------------------------------------------------------------------------------------------------------
Effects on small businesses...            Will not have a significant economic impact on a substantial number of small entities.            RA.
                               ------------------------------------------------------------------------------------------------------------
Effects on wages..............                 None
                                               None
                                               None                 ..................
                               ------------------------------------------------------------------------------------------------------------
Effects on growth.............           No determination
                                         No determination
                                         No determination
--------------------------------------------------------------------------------------------------------------------------------------------------------

    Because this final rule does not modify any of the regulatory
requirements in the TWIC Reader rule but, rather, delays the
implementation of that 2016 final rule for some facilities, we did not
revise our fundamental methodologies or key assumptions from the 2016
TWIC Reader final rule RA.\114\
---------------------------------------------------------------------------

    \114\ USCG-2007-28915-0231.
---------------------------------------------------------------------------

    Table 2 summarizes the changes to the RA between the TWIC Delay
NPRM and this final rule. In this final rule, the Coast Guard modified
the population of facilities that will delay the implementation of the
TWIC reader rule, to include all facilities that handle CDC in bulk. In
addition, we fixed mathematical errors from the 2016 TWIC Reader rule
which impacted the estimated average number of readers per access
point, and the average installation and infrastructure costs for
facilities. Although we have updated our analysis from the NPRM to
reflect these changes, this did not modify the methodology of our RA.

             Table 2--Summary of Changes From the TWIC Delay Rule NPRM to TWIC Delay Rule Final Rule
----------------------------------------------------------------------------------------------------------------
       Element of the analysis                   NPRM                  Final Rule         Resulting change in RA
----------------------------------------------------------------------------------------------------------------
Affected Population..................  122 facilities that      370 facilities that      Increases estimated
                                        handle bulk CDC, but     handle bulk CDC, and     cost savings, as
                                        do not transfer it to    an unknown number of     implementation costs
                                        or from a vessel, and    facilities that          will be delayed for
                                        an unknown number of     receive vessels          more facilities.
                                        facilities that          carrying bulk CDC but,
                                        receive vessels          during that vessel-to-
                                        carrying bulk CDC but,   facility interface, do
                                        during that vessel-to-   not transfer bulk CDC
                                        facility interface, do   to or from the vessel.
                                        not transfer bulk CDC
                                        to or from the vessel.
Errors in TWIC Cost Calculations.....  Cost estimates are       The revised cost model   Increases estimated
                                        based on data from the   calibrated the           compliance costs for
                                        2016 TWIC Final Reader   methodology for          facilities, resulting
                                        Rule, which              estimating the number    in a total annualized
                                        incorrectly calculated   of readers. This         cost increase of
                                        the average number of    change yielded more      approximately $4
                                        readers per access       accurate compliance      million (with a 7%
                                        point for facilities,    costs for facilities.    discount rate).
                                        and the average
                                        installation and
                                        average infrastructure
                                        cost per reader for
                                        facilities. These
                                        errors did not impact
                                        the estimated costs
                                        for vessels.
----------------------------------------------------------------------------------------------------------------

    In the 2016 TWIC Reader final rule RA, we estimated that 525
facilities and 1 vessel out of the MTSA-regulated entities (13,825
vessels and more than 3,270 facilities) will have to comply with the
final rule's electronic TWIC inspection requirements using MSRAM's
risk-based tiered approach.\115\ This rule will delay the
implementation of the TWIC reader rule for 370 of the 525 affected Risk
Group A facilities by 3 years, while the remaining 155 facilities
(which are all facilities that receive large passenger vessels), and 1
vessel will have to implement the requirements of the TWIC Reader rule
by June 8, 2020. The results reflect that 370 facilities out of the 525
facilities either handle certain dangerous cargoes in bulk but do not
transfer these cargoes to or from a vessel, or handle certain dangerous
cargoes in bulk and do transfer these cargoes to or from a vessel. This
final rule will also apply to facilities that receive vessels carrying
bulk CDC but, during the vessel-to-facility interface, do not transfer
the bulk CDC to or from the vessel. We did not include these facilities
in our MSRAM risk analysis or RA for the TWIC Reader rule, or in this
final rule's RA because we are unable to determine the number of these
facilities at this time.
---------------------------------------------------------------------------

    \115\ See Table 2.8 on page 26 of the TWIC Reader final rule RA
for the estimate of 525 facilities, and Table 2.1 on page 23 for the
estimate of 1 vessel.
---------------------------------------------------------------------------

    2016 TWIC Reader rule cost estimates from 2012 dollars to 2016
dollars based on Gross Domestic Product (GDP) Deflator data from the
U.S. Bureau of Economic Analysis (BEA).\116\ The GDP deflator is a
measure of the change in price of domestic goods and services purchased
by consumers, businesses, and the government.
---------------------------------------------------------------------------

    \116\ For consistency across rulemaking analyses, we are using
the annual Implicit Price Deflators for Gross Domestic Product (BEA
National Income and Product Accounts (NIPA) Table 1.1.9) values
updated in March 30, 2017 Available for download at https://apps.bea.gov/histdata/fileStructDisplay.cfm?HMI=7&DY=2016&DQ=Q4&DV=Third&dNRD=March-30-2017 under Section 1 (the BEA only has historical data available for
download, Accessed March 15, 2019).
---------------------------------------------------------------------------

    Table 3 summarizes the costs and benefits of the 2016 TWIC Reader
final rule as well as this rule. We do not anticipate any new costs to
industry as a result of implementing this final rule, because it will
not change the applicability of the 2016 final rule or result in any
other changes to the TWIC Reader rule. The impact to the one affected
vessel, along with the qualitative costs and benefits, remain the same.
Because this rule will delay the implementation of the TWIC Reader rule
by 3 years for 370 facilities, it will result in cost savings to both
industry and the government of $23.74 million (discounted at 7 percent)
over a 10-year period of analysis ($191.81 million minus $168.07
million). As stated above, we used the same 10-year period of analysis
in order to be able to properly compare the costs of this final rule
and the TWIC Reader rule, which estimated the costs and benefits over a
10-year period. At a 7-percent discount rate, we estimate the total
annualized cost savings to be $3.38 million ($27.29 million - $23.92
million), and $2.14 million ($25.18 million -$23.04 million). Using a
perpetual period of analysis, and 2019 as the first year of analysis,
we estimated the total annualized cost savings of this rule to be $1.53
million in 2016 dollars, discounting back to 2016 dollars.

  Table 3--Summary of Costs Savings and Change in Benefits: 2016 Final
 TWIC Reader Rule (81 FR 57652) and Final Rule To Delay the TWIC Reader
                                  Rule
------------------------------------------------------------------------
                                                     Final rule to delay
          Category              2016 TWIC reader    the TWIC reader rule
                                  rule (2016 $)           (2016 $)
------------------------------------------------------------------------
Applicability...............  High-risk MTSA-       Same as in the TWIC
                               regulated             Reader rule except
                               facilities and high-  the facilities and
                               risk MTSA-regulated   vessels handling
                               vessels with          bulk CDC, but not
                               greater than 20       transferring it to
                               TWIC-holding crew.    or from the vessel.
Affected Population.........  1 vessel............  No change from the
                                                     TWIC Reader rule.

                              525 facilities (to    370 facilities that
                               comply by Aug. 23,    handle bulk CDC (to
                               2018).                comply by May 8,
                               370           2023). The rule
                               facilities that       will also apply to
                               handle bulk CDC..     facilities that
                               155           receive vessels
                               facilities that       carrying bulk CDC
                               handle passenger      but, during that
                               vessels..             vessel-to-facility
                                                     interface, do not
                                                     transfer bulk CDC
                                                     to or from the
                                                     vessel. However,
                                                     the number of these
                                                     facilities cannot
                                                     be determined at
                                                     this time and will
                                                     not be known until
                                                     after an additional
                                                     study is conducted
                                                     to improve the risk
                                                     methodology and
                                                     determine the new
                                                     risk groups.
Costs to Industry and         Industry: $27.29      Industry: $23.92
 Government ($ millions, 7%    (annualized) *.       (annualized).
 discount rate) *.            Government: $0.014    Government: $0.013
                               (annualized) *.       (annualized).
                              Combined: $27.31      Combined: $23.93
                               (annualized) *.       (annualized).
                              Industry: $191.71     Industry: $167.98
                               (10-year) *.          (10-year).
                              Government: $0.097    Government: $0.088
                               (10-year) *.          (10-year).
                              Combined: $191.81     Combined: $168.07
                               (10-year) *.          (10-year).
Costs Savings to Industry     N/A.................  Industry: $3.38
 and Government ($ millions,                         (annualized).
 7% discount rate) *.                               Government: $0.001
                                                     (annualized).
                                                    Total: $3.38
                                                     (annualized).
                              N/A.................  Industry: $23.73 (10-
                                                     year).
                                                    Government: $0.01
                                                     (10-year).
                                                    Total: $23.74 (10-
                                                     year).
Change in Costs               Time to retrieve or   The rule will delay
 (Qualitative).                replace lost PINs     the cost to
                               for use with TWICs.   retrieve or replace
                                                     lost PINs for use
                                                     with TWICs for the
                                                     facilities with
                                                     delayed
                                                     implementation.
Change in Benefits            Enhanced access       Delaying enhanced
 (Qualitative).                control and           access control and
                               security at U.S.      security for the
                               maritime facilities   facilities with
                               and on board U.S.-    delayed
                               flagged vessels.      implementation.
                              Reduction of human    Delaying the
                               error when checking   reduction of human
                               identification and    error when checking
                               manning access        identification and
                               points.               manning access
                                                     points for the
                                                     facilities with
                                                     delayed
                                                     implementation.
------------------------------------------------------------------------
* Note: These are the final costs to industry and government after
  fixing mathematical errors in 2016 TWIC Final Reader Rule, which
  incorrectly calculated the average number of readers per access point
  for facilities, and the average installation and infrastructure cost
  per reader for facilities, and then inflating the costs to 2016
  dollars.
N/A = Not applicable.

Methodology
TWIC Reader Rule Costs Inflated to 2016 dollars
    As shown in table 3, after adjusting the annualized cost from the
2016 TWIC Reader rule from 2012 dollars to 2016 dollars (over a 10-year
period) and fixing the mathematical errors in 2016 TWIC Reader rule RA,
the annualized cost of the 2016 TWIC Reader rule is approximately
$27.29 million at a 7-percent discount rate.\117\ We performed this
update to compare them to this final rule's total industry costs on the
same basis. We also modified the 2016 final rule cost estimates to fix
mathematical errors identified in the TWIC effectiveness assessment,
which affected estimates of the average number of readers per access
point, and the average installation and infrastructure cost per reader
at facilities. These errors impact the capital and maintenance cost
estimates for facilities, and we identified them after the publication
of the NPRM, and after fixing the mathematical errors in the 2016 TWIC
Reader rule RA, the annualized total cost increased by $4.12 million to
$27.29 million (in 2016$ with a 7-percent discount rate). These errors,
however, did not impact the estimated costs for vessels.\118\
---------------------------------------------------------------------------

    \117\ The published annualized cost in the 2016 TWIC Reader rule
RA was $21.9 million (in 2012 dollars with a 7-percent discount
rate), and after adjusting for inflation this number is $23.3
million (in 2016 dollars with a 7-percent discount rate). https://www.federalregister.gov/documents/2016/08/23/2016-19383/transportation-worker-identification-credential-twic-reader-requirements, page 57700.
    \118\ U.S. Bureau of Economic Analysis, ``Table 1.1.9 Implicit
Price Deflators for Gross Domestic Product,'' published March 30,
2017,vailable at https://apps.bea.gov/histdata/fileStructDisplay.cfm?HMI=7&DY=2016&DQ=Q4&DV=Third&dNRD=March-30-2017 under Section 1 (the BEA has only historical data available for
download). Accessed March 15, 2019.
---------------------------------------------------------------------------

    We used an inflation factor derived from the GDP deflator data. We
calculated the inflation factor of 1.059 by dividing the annual 2016
index number (111.445) by the annual 2012 index number (105.214).
    We then applied this inflation factor to the costs for vessels and
additional costs, which include additional delay costs, travel costs,
and the cost to replace TWIC readers that fail (table 4.38 of the TWIC
Reader final rule RA).\119\ Table 4 presents these inflated costs.
---------------------------------------------------------------------------

    \119\ Additional delay costs account for delays resulting from
the use of an invalid and/or broken TWIC card.

 Table 4--Comparison of Total Cost for Vessels and Additional Costs in 2012 Dollars and 2016 Dollars Under 2016
                                                TWIC Reader Rule
                                                   [Millions]
----------------------------------------------------------------------------------------------------------------
                                                              Vessel                     Additional costs
                      Year                       ---------------------------------------------------------------
                                                      2012 $          2016 $          2012 $          2016 $
----------------------------------------------------------------------------------------------------------------
1...............................................          0.0210          0.0222            4.21            4.46
2...............................................          0.0036          0.0038            4.21            4.46
3...............................................          0.0036          0.0038            4.21            4.46
4...............................................          0.0036          0.0038            4.21            4.46
5...............................................          0.0036          0.0038            4.21            4.46
6...............................................          0.0177          0.0187            4.21            4.46
7...............................................          0.0036          0.0038            4.21            4.46
8...............................................          0.0036          0.0038            4.21            4.46
9...............................................          0.0036          0.0038            4.21            4.46
10..............................................          0.0036          0.0038            4.21            4.46
                                                 ---------------------------------------------------------------
    Total.......................................          0.0677          0.0717           42.10           44.59
----------------------------------------------------------------------------------------------------------------
Totals may not sum due to rounding.

    For facilities, we applied this inflation factor to capital,
maintenance, and operational costs because the final rule will apply
only to these cost elements. Capital costs consist of the cost to
purchase and install TWIC readers, as well as the cost to fully replace