MARSEC levels, not just at MARSEC Levels 2 and 3. Similarly, one
commenter stated that the CCL should be continually updated at all
times. The commenter stated that once an automated method is
established to do this, there is no additional cost associated with the
increased frequency. While we do agree that, if automated, it is simple
to update the list of cancelled TWICs, we note that not all operators
use an automated system at this time. While we realize that some larger
operations can set up automatic updates of the list, other operations
may need to conduct such updates manually. In our RA, we calculated
that it takes 30 minutes to update the CCL. For that reason, we have
only required in 33 CFR 101.525 that the list of cancelled TWICs be
updated daily during periods of heightened risk according to the
specified MARSEC level. We note that the required periods to update the
list are considered minimum requirements, but operators are free to
update more often if desired.
    One commenter asked if electronic TWIC inspection requirements
should be applied to Risk Groups B and C at higher MARSEC levels. We do
not believe it should. This would require those vessels and facilities
to purchase and install equipment for electronic TWIC inspection for
use during those periods of heightened alert, dramatically increasing
the costs of the rule for what we believe is, at this time,
comparatively little corresponding benefit. Furthermore, changing
electronic TWIC inspection procedures at irregular and long-spaced
intervals can cause confusion that could impair operations.
4. Recordkeeping Requirements
    In the NPRM, the Coast Guard proposed specific recordkeeping
requirements relating to the use of TWIC readers in vessels and
facilities. These proposals, in proposed Sec. Sec.  104.235(b)(9) and
105.225(b)(9), specified that owners or operators must keep records of
each individual granted unescorted access to a secure area, which would
include the FASC-N, date and time that unescorted access was granted,
and the individual's name (if captured). The NPRM also proposed to
require that owners or operators keep documentation demonstrating that
they had updated the CCL with the required frequency. The NPRM proposed
a 2-year minimum retention time for such records, and specified that
TWIC reader and PACS readers were sensitive security information (SSI),
protected under 49 CFR 1520. We received several comments on the
subject of recordkeeping, which are discussed below.
    Many commenters suggested that the 2-year recordkeeping requirement
was too long. One commenter supported the 2-year recordkeeping
requirement, although noted that a shorter period would not be
objectionable if the 2-year requirement was deemed overly burdensome or
unnecessary. Another commenter suggested the period was an issue of
concern, and that the Coast Guard should provide the rationale behind
the requirement to retain records for 2 years rather than any other
amount of time. The same commenter added that the argument for
consistency with other recordkeeping requirements did not justify the
burden of a 2-year requirement, although the commenter did not suggest
an alternative timeframe. One commenter recommended that the records be
retained for only 30 days, noting that this would be less burdensome.
    In this final rule, as explained in more detail below, we are
maintaining the 2-year timeframe for record retention as we do not
believe it is unduly burdensome or unnecessary. We also disagree with
the commenter that consistency with all other MTSA-related records is
an insufficient rationale for requiring records to be kept for a 2-year
period. We believe that if differing records were required to be kept
for varying amounts of time, it would needlessly complicate the storage
of those records and potentially add additional expenses.
    One commenter stated that the 2-year retention period presents
opportunities for the information to be mishandled or misused, and thus
should be shorter, although no specific timeframe was suggested. While
we realize that storing data for any period of time can result in
misuse or mishandling, we note that the information is protected as
SSI, and thus is subject to comparatively strict usage and storage
controls. We believe that the risk of misuse or mishandling of the
information is far outweighed by the security value of collecting and
storing the data for use in security investigations. The commenter also
stated that a shorter window would provide law enforcement sufficient
data to assist in security investigation, but no alternative window was
suggested nor supporting information supplied. Without additional
information, we are not deviating from the 2-year period proposed in
the NPRM and used in all other MTSA-related recordkeeping requirements.
    This commenter also stated that 46 U.S.C. 70105(e) implies that
information gathered by a TWIC reader from a worker's card must not be
shared with an employer or otherwise publicly released. We do not
believe that this characterization is correct. 46 U.S.C. 70105(e)(1)
reads as follows: ``Information obtained by the Attorney General or the
Secretary under this section may not be made available to the public,
including the individual's employer.'' This restriction only applies to
information obtained by the Attorney General or the Secretary, and
includes information received by the Coast Guard. The information
generated by electronic TWIC inspection is obtained by a private entity
(the facility or vessel owner or operator) to whom the restriction in
46 U.S.C. 70105(e)(1) does not apply.
    However, and as the commenter noted, some information collected by

the TWIC reader or PACS is considered SSI, and is thus protected from
unauthorized disclosure under 49 CFR part 1520. The commenter
recommended that the Coast Guard consider all electronic reader
records, whether of an individual or of an aggregated group, be
restricted to security use only and explicitly forbidden to be used in
labor-management issues (such as establishing hours worked or reporting
criminal activity).
    Not all electronic reader records qualify as SSI and thus some
information concurrently collected during electronic TWIC inspection
can appropriately be used by an owner/operator for non-security but
still legitimate purposes without violating 49 CFR 1520. The preamble
of the NPRM contains clear guidance regarding the treatment of certain
information collected by electronic TWIC inspection. In that document,
we clearly stated that ``[w]e consider a TWIC-holder's name and FASC-N
to be SSI under 49 CFR 15.5.'' We went on to explain that ``to the
extent that a PACS contains personal identity [including the FASC-N]
and biometric information, it contains SSI, which must be protected in
accordance with 49 CFR part 15.'' \37\ However, an important aspect of
this final rule is that it allows electronic TWIC inspection to be
integrated with a facility's PACS, which serves many other purposes
beyond security and contains non-SSI information. For example, PACSs
are legitimately used to restrict access for non-security purposes
(such as private or dangerous areas) and to help establish the hours
worked by employees. Owners and operators of facilities have valid uses
for the non-private information not covered in the SSI regulations but
still collected by a PACS regarding the location of personnel on their
property.
---------------------------------------------------------------------------

    \37\ 78 FR 17806-7.
---------------------------------------------------------------------------

    One commenter requested specific information regarding the
requirements established for owners or operators to secure the privacy
of individual cardholders. We note that we have not established any new
requirements in this rule for such safeguarding because the SSI
requirements are already sufficiently comprehensive. See 49 CFR part 15
for regulations covering restrictions on disclosure, persons with a
need to know, marking, consequences of unauthorized disclosure, and
proper destruction of SSI.
    The Coast Guard weighed privacy and security concerns in the
development of this requirement. To minimize the amount of personally-
identifiable information transferred from the TWIC to the TWIC reader,
TWIC readers are specifically designed to only collect the minimum
amount of information necessary to assist in access control and
maritime security. Owners and operators who collect and maintain
protected data from electronic TWIC inspections cannot share this
information outside of their vessel or facility. The only allowable
sharing is back to the TSA or to the Coast Guard for auditing or law
enforcement purposes, or to assist with customer redress.\38\
---------------------------------------------------------------------------

    \38\ See 49 CFR part 1520.
---------------------------------------------------------------------------

    Owners and operators are also bound by the restrictions on
disclosure of SSI.\39\ Unauthorized disclosure of SSI is grounds for a
civil penalty and other enforcement or corrective action by DHS, and
appropriate personnel actions for Federal employees. Corrective action
may include the issuance of an order requiring retrieval of SSI to
remedy unauthorized disclosure, or of an order to cease future
unauthorized disclosure.
---------------------------------------------------------------------------

    \39\ See 49 CFR 15.9(a)(1).
---------------------------------------------------------------------------

    Two commenters suggested that SSI requirements should not apply to
electronic TWIC inspection records if no personally-identifiable
information is recorded (i.e., only the FASC-N, date, and time of the
transaction is recorded). We note that pursuant to 49 CFR
1520.5(b)(11)(i)(A), SSI includes identifying information of certain
transportation security personnel, which includes ``Lists of the names
or other identifying information that identify persons as . . . having
unescorted access to . . . a secure or restricted area of a maritime
facility, port area, or vessel.'' This information is specifically
addressed in the recordkeeping requirements of this final rule. For
example, Sec.  105.225(b)(9) states that the TWIC Reader or PACS system
must capture the ``FASC-N, date and time that unescorted access was
granted; and, if captured, the individual's name.'' If such information
was captured, it would be considered SSI.
    Commenters also suggested additional information that could be
collected during electronic TWIC inspection. One commenter suggested
that an electronic TWIC reader transaction should also include an
identifier for the specific electronic reader device, and if it is a
portable electronic reader, an identifier for the operator of the
device. The commenter suggested that this information would enhance the
usefulness of an audit trail. While we see that there could be some
value in having this information recorded, we believe that it would be
overly complex to add this information into the suite of recorded
information at this time, and the value of such information would not
be worth the additional cost. We note that such information might be
gathered from other sources even without a requirement to collect it in
this final rule. Nonetheless, should we reconsider the scope of data
collection for electronic TWIC inspection in future rulemakings, we
will consider this suggestion.
    Two commenters recommended that recordkeeping requirements should
be extended to situations where an electronic TWIC inspection is not
used, such as visual TWIC inspections, RUA, and escorted access. One
commenter suggested that without recordkeeping requirements for visual
TWIC inspection, there is no incentive--other than avoiding the
consequences of being caught--to actually conduct visual TWIC
inspections. We disagree with these comments. A recordkeeping
requirement for visual TWIC inspections would mean that each owner or
operator would need to record information on each TWIC inspection. We
would need to demonstrate that the cost of such a requirement is
justified before imposing it on the regulated population. In that
regard, we note that in 2013, the Coast Guard conducted 12,171
inspections at MTSA-regulated facilities for compliance with the
regulations in 33 CFR part 105. As part of those inspections, Coast
Guard personnel spot-checked 52,708 TWICs, finding a validity rate of
greater than 97 percent. In light of the high validity rate, we do not
believe that a recordkeeping requirement for visual TWIC inspections is
appropriate or necessary.
    One commenter also suggested that there should be recordkeeping
requirements for when a person is granted unescorted access through the
``special circumstances,'' described in Sec.  101.550 of the final
rule, such as if he or she had reported their TWIC as lost or stolen.
In the NPRM, we did not propose any requirements that records be kept
for transactions that do not make use of electronic TWIC inspection.
While such a suggestion is outside the scope of this final rule, we
will consider it in future regulatory actions.
    Furthermore, we are not creating new requirements for visual
inspections in this final rule, including any recordkeeping
requirements. This final rule pertains to requirements for electronic
TWIC inspection. Requirements pertaining to other means of access,
including access granted through visual TWIC inspection or escorted
access to a secure area, are

outside the scope of the final rule. We do note that electronic TWIC
inspection is a prerequisite for RUA, and thus a record is created when
that transaction occurs. However, due to the nature of RUA, no
additional records are kept outside of the electronic TWIC inspection
transactions. Such recordkeeping would be burdensome and defeat the
purpose of RUA.
    One commenter suggested that the lack of criteria or specificity as
to what the required records should contain severely limits their
efficacy. We believe that the NPRM was clear on what records are
required to be kept, but we will discuss them here in greater length.
Specifically, a record should be kept of each instance in which a
person is granted unescorted access to a secure area. This record must
contain the FASC-N of the TWIC issued to the person granted unescorted
access. If the TWIC reader or PACS captures the individual's name, the
name associated with the TWIC must also be part of the record. Finally,
the record must include the date and time the person was granted
unescorted access (the time can be rounded to the nearest minute; it is
not required that the precise second that access was granted be
captured, although it is acceptable to be more precise). As noted in
the NPRM, ``we allow individual regulated parties to determine the best
method and manner of complying with the recordkeeping requirements.''
\40\
---------------------------------------------------------------------------

    \40\ 78 FR 17806.
---------------------------------------------------------------------------

    The commenter also requested additional justification for the 2-
year period, stating that neither the argument for consistency nor the
argument for law enforcement justify the length of time to hold
records. As stated in the NPRM, the timeframe was designed, in part,
for consistency with existing security-related and other recordkeeping
requirements applicable to vessels and facilities, and we note that all
other security recordkeeping requirements in the affected sections are
subject to a 2-year retention period. In response to the commenters who
requested additional justification, we would add that investigations of
TSIs can involve analysis of data that stretches back for that amount
of time, and we want to ensure that any historical data that could be
useful is available. We believe that a 2-year period is an appropriate
amount of time to ask owner operators to store data to ensure that no
investigation is limited due to the unavailability of relevant data. We
continue to believe that a uniform timeframe for recordkeeping
requirements, when practicable, provides the most efficient regulatory
system, and that the costs of storing data are minor compared to the
security benefits provided.
    The commenter also referred to the 2013 GAO report, noting its
concern that the TWIC Pilot Program had difficulties collecting
accurate, consistent data from the pilot sites.\41\ While we are aware
of the GAO's criticisms of the TWIC Pilot Program, we do not believe
those data collection concerns are relevant to the data collection
proposed by the implemented electronic TWIC inspection regulations.
Beyond the fact that both involved data collections, the nature and
uses of the data collected in the two programs are very dissimilar. For
example, among many other items that related to the overall operation
of the facilities at issue, the Pilot Program collected data on the
number of people using TWIC readers, the amount of time taken per
transaction, and the failure rates for transactions. These are very
different data than collected by electronic TWIC inspection, which
collects items such as the FASC-N. The data collected by electronic
TWIC inspection is narrowly tailored to assist the Coast Guard and
other law enforcement agencies in investigating TSIs, and the
criticisms of data collection on the Pilot Report are not analogous.
---------------------------------------------------------------------------

    \41\ ``Transportation Worker Identification Credential: Card
Reader Pilot Results Are Unreliable; Security Benefits Need to Be
Reassessed'' (GAO-13-198) is available in the docket by following
the instructions in the ADDRESSES section of this preamble.
---------------------------------------------------------------------------

    One commenter stated that the recordkeeping requirements proposed
in the NPRM would create a large amount of data and may need to be
stored in a media that is not immediately accessible. The commenter
requested that the final rule allow a reasonable amount of time to
retrieve and produce the electronic records when requested. We agree
with the commenter that a reasonable amount of time will be permitted
to produce any requested records. This final rule deals only with
recordkeeping requirements; it does not specify a timeframe for record
retrieval.
    One commenter requested clarification of a specific situation: a
Port Authority operates a cruise terminal which uses an FSP, but when a
cruise ship is in port, the cruise security line operates under its own
FSP. The commenter asked who would be responsible for maintaining the
records. Based on the information described in this situation, the
owner or operator of the TWIC reader or PACS system conducting the
electronic TWIC inspection would be responsible for maintaining the
required records of those transactions. However, we note that
recordkeeping requirements for any particular facility would be
described in the FSP and that different situations may yield different
results, but that these issues would be resolved during approval of the
FSP.
    Similarly, another commenter described a scenario where a private
security company and a public entity share a facility. The commenter
asked if the entities would need to share records. In response, we note
that there is no requirement to share records, and that the owner or
operator of the TWIC reader or PACS conducting the electronic TWIC
inspections is the entity required to keep the records. Which entity is
responsible for recordkeeping should also be addressed in the FSPs.
    One commenter requested that, if a non-Risk Group A facility were
to use electronic TWIC inspection on a voluntary basis, they should not
be subject to the electronic recordkeeping requirements in proposed
Sec.  105.225(b)(9) and (c). Assuming that a facility is using
electronic TWIC inspection on a voluntary basis to replace visual TWIC
inspection, pursuant to the guidance in PAC 01-11, we disagree. If
replacing security personnel with electronic TWIC inspection, then all
elements of such an inspection, including recordkeeping requirements,
would have to be met. Maintaining the electronic records as required
provides additional security and information in case of a security
breach in the future. Visual inspection programs are not required to
maintain this type of information due to the large amount of time
needed to manually enter the same information.

C. When To Conduct Electronic TWIC Inspection

    One of the areas in which the Coast Guard received the most
comments on the proposed rule was the issue of when a TWIC must be
read. Specifically, the NPRM used language that stated, ``prior to each
entry, all persons seeking unescorted access to secure areas [must]
present their [TWIC] for inspection before being granted such
unescorted access'' (this language was used in proposed Sec. Sec.
101.520(a)(1), 101.525 introductory text, and 101.530 introductory
text).
    Many commenters asked for clarification regarding this language,
specifically relating to issues of where TWIC readers should be
located, and to what specifically ``prior to each entry'' referred.
Despite using identical language in the proposed regulatory

text, the requirement for when to perform electronic TWIC inspection is
very different for vessels than it is for facilities. With regard to
vessels, we stated in the NPRM that ``for vessels, this NPRM proposes
to require TWIC readers at the access points to the vessel itself,
regardless of whether the secure area encompasses the entire vessel.''
\42\ On the other hand, with regard to facilities, we stated that
``this NPRM proposes to require TWIC readers at the access points to
each secure area,'' \43\ which could necessitate a large number of TWIC
readers in facilities like passenger facilities, many of which have
multiple access points to secure areas within the facility. Similarly,
the NPRM RA reflected this information, estimating that each facility
might use a number of TWIC readers (passenger facilities, with many
access points to secure areas, were estimated to require an average of
16 TWIC readers each), whereas each vessel might only be equipped with
one or two, reflecting the fact that they would only be deployed at the
entrances to the vessels, not at each access point to a secure area
within the vessel.
---------------------------------------------------------------------------

    \42\ 78 FR 17803.
    \43\ 78 FR 17803.
---------------------------------------------------------------------------

    Nonetheless, we recognize the confusion brought on by the proposed
language. One commenter, for example, requested a clarification of the
reference to ``each entry'' to a facility or vessel secure area. The
commenter noted that passenger vessels and facilities included
restricted areas, employee access areas, and passenger areas, and it
was unclear from the NPRM where the electronic TWIC inspection
requirements would be applied. In this final rule, we have used
language that we believe more clearly describes the specific
requirements of the rule. We broke the language down into two separate
paragraphs, one for vessels (see Sec.  101.535(a)), and one for
facilities (see Sec.  101.535(b)), using slightly different language
for each. The final regulatory text for facilities now states, ``Prior
to each entry into a secure area of the facility,'' while the final
regulatory text for vessels now states, ``Prior to each boarding of the
vessel.'' While the language is slightly modified, we believe it more
clearly implements the proposed requirements in the NPRM.

1. Secure, Restricted, Public Access, Passenger Access, and Employee
Access Areas

    In terms of clarifying that an electronic TWIC inspection must be
performed prior to each entry into a secure area (for facilities), we
believe that it is important to clarify the term ``secure area,'' as
well as explain the differences between secure areas and other types of
areas on MTSA-regulated vessels and facilities. Many commenters asked
questions that indicated the difference between secure areas,
restricted areas, employee access areas, public access areas, and
passenger access areas was not entirely clear. In this section, we
discuss the definitions of these types of areas, given their
definitions in 33 CFR part 101, as well as the additional explanation
offered in NVIC 03-07 and other documents.
    The statutory requirement for TWIC readers, stated in 46 U.S.C.
70105(a)(1), requires that anyone granted unescorted access to a secure
area of a vessel or facility maintain a valid TWIC. Secure areas are
defined in 33 CFR 101.105. The relevant portion of the definition
states that ``Secure area means the area on board a vessel or at a
facility over which the owner/operator has implemented security
measures for access control in accordance with a Coast Guard approved
security plan. It does not include passenger access areas, employee
access areas, or public access areas.''
    The concept of a secure area is explained in more detail in NVIC
03-07, enclosure (3). Section 3.3b of that document explains that ``for
facilities, the secure area is the entire area within the outer-most
access control perimeter of the facility, with the exception of public
access areas, and encompasses all restricted areas.'' Similarly, ``for
vessels and OCS facilities, the secure area encompasses the entirety of
a vessel or OCS facility, with the exception of passenger or employee
access areas for vessels.''
    Existing regulations distinguish between the secure area and areas
designated as ``restricted.'' The term restricted area, as defined in
existing 33 CFR 101.105, means ``the infrastructures or locations
identified in an area, vessel, or facility security assessment or by
the operator that require limited access and a higher degree of
security protection [than secure areas].''
    NVIC 03-07 also goes into detail explaining the difference between
secure and restricted areas, noting that by virtue of the fact that the
secure area encompasses the entire facility or vessel (with the
exclusion of public, passenger, and employee-access areas), restricted
areas fall within this perimeter.
    Multiple commenters with facilities expressed concerns about the
existence of multiple secure areas within any one facility, and what
access control measures would be required by this final rule. Other
commenters represented both vessels and facilities, but had similar
concerns with regard to the differences among secure, restricted, and
public access areas. The definitions of secure and restricted areas
have implications when determining where to locate electronic TWIC
inspection locations on various facilities. These locations would be
marked in an FSP or a VSP. Given the requirement that electronic TWIC
inspection be conducted ``prior to each entry'' into a secure area (for
facilities), we would anticipate that the inspection points at
facilities would be located at the access points to secure areas. For
example, in a chemical cargo facility the entire facility may be
considered a secure area, as security measures for access control may
surround the entire facility. Such a facility would likely only conduct
electronic TWIC inspection at the entrance to the facility.
Alternatively, a facility might categorize the parking lot as a
``public access area'' so that employees and visitors can park, and
electronic TWIC inspection could be conducted at the access point from
the parking lot into the secure area of the facility. We note that a
second round of electronic TWIC inspection is not required when passing
from a secure area to a restricted area, although we would anticipate
other security measures to be in place.
    For passenger facilities, the majority of the areas may be
designated ``public access areas,'' ``passenger access areas,'' or
``employee access areas'' (such as break rooms). In such an instance,
electronic TWIC inspection points may only be located at entrances to
secure areas such as the pier or FSO's office. The Coast Guard
acknowledges the confusion surrounding this issue, which is why we have
included a clarifying revision to 33 CFR 103.505, Elements of the Area
Maritime Security (AMS) Plan, in which a parenthetical reference to the
TWIC program may create confusion regarding whether TWIC provides
access control for secure or restricted areas. This final rule creates
electronic TWIC inspection requirements for access to secure areas, and
does not address requirements for access control to restricted areas.
    Finally, we note the concerns commenters had relating to secure
areas on water. One commenter noted that the water where barge fleets
are located is considered a secure area, but the area was only
accessible by boat. The commenter questioned how electronic TWIC
inspection could be conducted in such a situation. Similarly, another
commenter requested that they be allowed to conduct electronic TWIC
inspections on shore before entering

barge fleeting areas, as otherwise there would be no way to conduct an
electronic TWIC inspection. Another commenter noted that the only
``access point'' into such secure areas may be a towing vessel with the
dedicated purpose of guarding the area.
    These commenters raise important issues as to how we would apply
the electronic TWIC inspection process to secure areas on water, such
as barge fleeting facilities. Upon consideration, we do not believe
that requiring electronic TWIC inspection prior to entering such areas
would be practical, as there is no particular access point to such an
area that can be controlled by a TWIC reader. Electronic TWIC
inspection would instead be required at the barge fleeting facility's
shore side location.
    Many commenters representing vessels were concerned about a
situation involving a passenger vessel (potentially in Risk Groups B or
C) with multiple secure areas and no one standing watch at the
entrances to each secure area. We note that while the electronic TWIC
inspection requirements are different for vessels than for facilities,
the definitions of secure areas and restricted areas are similar. On
non-passenger vessels, generally the entire vessel is considered a
secure area. Certain areas within the vessel may have higher levels of
security, and those would be considered restricted, which again are not
impacted by this final rule. On passenger vessels, while security
measures would still encompass the vessel, only certain areas would be
considered secure, as passenger access areas and employee access areas
are excluded from the definition of secure areas. As described below in
Section V.C.2 of this preamble, because electronic TWIC inspection on
vessels is only conducted when boarding the vessel, the exact location
of secure and restricted areas on a vessel would not affect the
placement of electronic TWIC inspection points.
a. ``Prior to Each Entry'' for Risk Group A Facilities
    In this final rule, we are finalizing without change the proposed
requirement that electronic TWIC inspection is required prior to each
entry into a secure area of a Risk Group A facility. Similarly, we are
finalizing the proposed requirement that electronic TWIC inspection is
required prior to each entry onto a Risk Group A vessel. While some
commenters objected to this policy, we believe that it represents the
best balance of security and practicability at this time. Furthermore,
we believe that many objections to the policy expressed by industry are
addressed by clarifying that the new requirements apply only to Risk
Group A vessels and facilities, and that vessels and facilities not in
this group have no new requirements in this final rule. In this
section, we address comments specifically related to Risk Group A
facilities. Questions for Risk Groups B and C, as well as questions for
vessels, are discussed in other sections of this preamble.
    Several commenters requested guidance related to operations
conducted under PAC 08-09, change 1. That document allows owners and
operators of a vessel or facility to use a local access card to grant
unescorted access to secure areas, assuming that the local access card
is tied to a valid TWIC and that verification (visual or electronic) of
the local access card is conducted each time access is granted to a
secure area. Pursuant to PAC 08-09, TWICs needed only to be validated
once every 24 hours. However, PAC 08-09 is only valid until the Coast
Guard publishes a final rule requiring the use of TWIC readers as an
access control measure.\44\ Because this final rule establishes
electronic TWIC inspection as a requirement for Risk Group A
facilities, the guidance in PAC 08-09 will no longer be valid with
respect to those facilities upon the effective date of this rule.
Because there are no electronic TWIC inspection requirements for Risk
Groups B and C, PAC 08-09 remains in force for those facilities. We
intend to update PAC 08-09 before the effective date of this final
rule.
---------------------------------------------------------------------------

    \44\ PAC 08-09, change 1, p. 2.
---------------------------------------------------------------------------

    We note that while PAC 08-09 will no longer be valid for Risk Group
A facilities, the flexible performance requirements of this final rule
will continue to allow access using local access or PACS cards,
assuming the PACS is able to perform the electronic TWIC inspection
requirements of biometric identification, the card validity check, and
card authentication. While many commenters requested that Risk Group A
facilities be permitted to continue to follow the guidance in PAC 08-09
(some of whom suggested that it could be augmented by a daily card
validity check), we are not granting that request. Electronic TWIC
inspection is a more secure system than that used under PAC 08-09 for a
variety of reasons, but most distinctly because it performs a biometric
identification each time a person is granted unescorted access to a
secure area, whereas the system described in the PAC 08-09 does not.
Biometric identification provides a higher level of certainty that an
individual is an approved TWIC-holder than visual identification.
    One commenter suggested that the purpose of TWIC is for a worker to
be vetted, and that TWIC should not be used as an access control
system, noting that it is up to the owner of the secure space to
determine which TWIC-holders are granted unescorted access. While we
agree that one of the benefits of TWIC is that it ensures an individual
has undergone a background check, we disagree that vetting is the only
purpose of a TWIC. Congress mandated that the TWIC contain the
biometric identification of the TWIC-holder. Furthermore, Congress
explicitly required that the Coast Guard ensure that only individuals
who hold a TWIC be granted unescorted access to secure areas of MTSA-
regulated facilities in 46 U.S.C. 70105(a)(1). We conclude, therefore,
that it is the clear mandate of Congress for this biometric
identification to be used to ensure that only TWIC-holders are granted
unescorted access to secure areas of Risk Group A vessels and
facilities. Using this function of the TWIC for identification
verification purposes will enhance the security afforded by the TWIC
program in the highest-risk areas.
    Other commenters expressed the opposite view, arguing that the
Coast Guard was wrong to limit the requirement of electronic TWIC
inspection to Risk Group A vessels and facilities only. Multiple
commenters suggested that the proposal to limit the use of electronic
TWIC inspection to Risk Group A vessels and facilities deviated from
Congress' intent in developing the TWIC program, and that to conform to
the intent of Congress, we should have extended the mandate to perform
electronic TWIC inspection to Risk Group B as well. Other commenters
noted that in the ``findings'' section of the MTSA statute (Pub. L.
107-251, 101(11)), Congress found that ``[b]iometric identification
procedures for individuals having access to secure areas in port
facilities are important tools to deter and prevent port cargo crimes,
smuggling, and terrorist actions.'' The commenter argued that to be
responsive to Congress, TWIC cards should not be used primarily as a
``flash pass,'' but should be used more often as biometric
identification tools.
    The Coast Guard believes that the requirement instituted in this
final rule represents a reasoned implementation of electronic TWIC
inspection. As analyzed in the NPRM and associated preliminary RA, we
believe the vessels and facilities in Risk Group A are at much greater
risk than other MTSA-regulated vessels and facilities.

Electronic TWIC inspection has a high utility in deterring and
mitigating certain threats to these targets. Given the costs in
infrastructure and operational needs associated with electronic TWIC
inspection, as shown in the TWIC Pilot Program and in the Coast Guard's
regulatory analyses, we do not believe that electronic TWIC inspection
should be extended to other vessels or facilities at this time.
Information and experience gained through the implementation of Risk
Group A vessels and facilities will, however, help to determine whether
and how the electronic TWIC inspection program should be expanded in
the future.
    Several commenters argued that the requirement to undergo
electronic TWIC inspection prior to each entry into a secure area of
facility was overly burdensome and unnecessary. One commenter stated
that the Coast Guard does not understand the day-to-day operations of
passenger vessels and facilities, and that only small areas are secure
and restricted, requiring a TWIC-holder to move in and out of these
areas multiple times per day. We disagree with this statement, and note
that the NPRM and the NPRM RA repeatedly affirmed that a TWIC reader
would be required at each access point to a secure area in a Risk Group
A facility. We acknowledge that in cases where employees of a passenger
facility move repeatedly from a non-secure area (such as a passenger
access area) to a secure area, they will likely have to undergo
repeated electronic TWIC inspections. We also note that these
facilities already use access control measures to prevent unauthorized
persons, including vessel passengers, from entering secure areas, and
that this requirement only involves incorporating electronic TWIC
inspection into those existing access control measures.
    Other commenters also made suggestions that would allow for reduced
numbers of electronic TWIC inspections for employees that enter and
leave secure areas multiple times per day. Several commenters suggested
that checking TWICs against the CCL multiple times per day is
redundant, as the list is only updated, at most, once per day. These
commenters suggested that at lower MARSEC levels, one electronic TWIC
inspection per day would be enough, and then a visual TWIC inspection
could be used for each subsequent entry into a secure area. We note
that electronic TWIC inspection performs much more than just the card
validity check, and that there is a need to check that the individual
presenting the card is the correct individual presenting an authentic
card each time he or she is granted unescorted access to a secure area.
For these reasons, a single electronic TWIC inspection should not allow
repeated grants of unescorted access to secure areas in Risk Group A
facilities.
    One commenter argued that its security needs would be better met
through cross-checking TWICs via its employment, human resources, and
internal security systems, and then issuing badges that it has control
over. The commenter stated that in that situation, it would have the
ability to verify and revoke access as necessary for the security of
the facility. With the new flexibility for electronic TWIC inspection
in this final rule, such cross-checking using facility-specific
identification cards linked to a PACS is possible, as long as the
facility's PACS performs the biometric identification, card validity
check, and card authentication procedures required in this final rule
prior to each entry into a secure area.
    One commenter stated that the ``prior to each entry'' requirement
is impracticable for cruise ship terminals. This commenter stated that
dozens of porters, stevedores, and shore staff constantly move baggage
in and out of secure areas using mechanical equipment such as forklifts
and hand trucks, and that requiring electronic TWIC inspection at each
entry would be potentially unsafe. We realize that there is a need to
balance the requirement to ensure that only TWIC-holders are granted
unescorted access to secure areas with the operational needs of a
facility. In a situation such as that described by the commenter, an
RUA plan could alleviate the burden of repeated and constant electronic
TWIC inspections. The RUA option was designed primarily to address the
needs of baggage handlers and stevedores, and was developed to
facilitate operations such as those described by the commenter where
persons must enter and exit a secure area on a continual basis. RUA is
described in more detail in Section V.C of this preamble.
    Several commenters were concerned that the proposed requirement for
permanently placed TWIC readers at the access points for Risk Group A
facilities offered no flexibility, and could restrict the use of
portable TWIC readers as an option at less heavily-trafficked access
points. We first note that the NPRM did not specifically require a
fixed TWIC reader at all access points, but we assumed that many
facilities would use fixed TWIC readers over portable ones at fixed
access points for the purposes of analysis. However, we agree with the
commenter that the NPRM did not offer enough flexibility, and thus this
final rule adds another option for electronic TWIC inspection.
Facilities will be able to use fixed electronic readers, portable
electronic readers, or a PACS to conduct electronic TWIC inspection,
depending on which works best considering their business operations.
    One commenter raised a concern that a requirement to present a TWIC
prior to each entry into a secure area would mean that TWIC-holders
would have to carry their cards at all times, thus exposing cards to
being damaged in a harsh environment or lost. The commenter recommended
that a system be utilized that would allow them to keep their workers'
TWICs in a safe and secure location where, upon request, the TWICs
could be retrieved and inspected within a reasonable amount of time. We
agree that this could be appropriate in many maritime environments, and
thus the flexibility allowed by this final rule would permit such a
system. A facility could control access to secure areas using a PACS to
conduct the electronic TWIC inspection, thus allowing the TWICs
themselves to be maintained in a safe, nearby location, where they
could be inspected if necessary.
    One commenter requested clarification with regard to overall
personnel accountability within secured areas. Specifically, the
commenter asked if the Coast Guard would require TWIC-holders to record
when they exited a secure area, and if a facility should know who is in
a secured area, at all times. In this rulemaking, we did not propose to
require personnel accountability in this fashion, nor does the final
rule require TWIC-holders to record when they exit a secured area.
Another commenter expressed support for not proposing such a
requirement in the NPRM. The final rule only requires electronic TWC
inspection upon entering a secure area of a Risk Group A facility. With
regard to recordkeeping, as discussed above, this final rule only
requires that records be kept of individuals that enter the secure
area, and of when they entered. This final rule does not require that
records be kept of individuals leaving a secure area, nor does it
require that records be kept of who is in a secure area at any
particular time.
b. Recurring Unescorted Access
    Many commenters requested that the Coast Guard reinstate the
concept of RUA that had originally been considered in the ANPRM, but
was not proposed in the NPRM. As described in the ANPRM, as part of an
RUA plan, the owner or operator of a vessel or facility would conduct
an initial biometric

match of the individual against his or her TWIC, either at hiring or
upon the effective date of a final rule, whichever occurs later. This
biometric match would include a verification of the authenticity and
validity of the TWIC. Once this check is done, the TWIC would only be
used as a visual identity badge, at a frequency to be approved by the
Coast Guard in the amended security plan, so long as the validity of
the TWIC is verified periodically, ranging from monthly to daily,
depending upon Risk Group and MARSEC Level.\45\ RUA, as described in
the ANPRM, would be limited to 14 TWIC-holders per vessel or facility,
although it was not clear whether that meant an RUA regime would only
be approved if the vessel or facility crew were limited to 14 TWIC-
holders, or if 14 people per vessel or facility would be exempted from
electronic TWIC inspection procedures that would still be in place for
other employees or persons seeking access.
---------------------------------------------------------------------------

    \45\ See 74 FR 13362.
---------------------------------------------------------------------------

    The Coast Guard opted not to include RUA in the proposed regulatory
text in the NPRM, despite the fact that many ANPRM commenters supported
various versions of RUA procedures. In the NPRM, we explained that
``RUA was previously proposed [in the ANPRM] to introduce flexibility
and provide relief to vessels otherwise required to use TWIC readers,
based on the familiarity that exists between a relatively small number
of crewmembers.'' \46\ However, by limiting electronic TWIC inspection
requirements to Risk Group A vessels only, and including the vessel
crewmember exemption in the TWIC applicability section, we believed we
had rendered the need for RUA as a mechanism for regulatory relief
unnecessary. One commenter requested clarification about whether the
proposed RUA mechanism would apply to facilities as well, or just
vessels. While the NPRM did not explicitly discuss the use of RUA for
facilities, we did not consider such plans viable. Unlike vessels,
facilities regularly receive unfamiliar personnel, such as visitors,
contractors, and deliveries, and must have a means to ensure those
visitors are valid TWIC-holders, regardless of the size of the regular
staff.
---------------------------------------------------------------------------

    \46\ See 78 FR 17804.
---------------------------------------------------------------------------

    We received several comments in response to the decision in the
NPRM not to include an RUA provision. Most commenters recommended that
some sort of RUA provision be included in the final rule, although they
differed in their interpretations of what, exactly, an RUA plan would
entail. Furthermore, multiple commenters laid out specific examples of
how RUA could improve operations in several scenarios. These comments
are described below.
    One commenter suggested that an RUA plan for vessel and facility
operations, including operations at facilities that service passenger
vessels, would require that a TWIC-holder undergo electronic TWIC
inspection once when he or she reports for work each day. It was
unclear from these comments specifically how this plan would be
implemented. If RUA were limited to certain crewmembers or employees,
it is unclear how those crewmembers would differentiate themselves from
other TWIC-holders who would still be required to undergo electronic
TWIC inspection prior to each entry into the vessel or into a secure
area of the facility. Furthermore, unless all crewmembers or employees
were subject to the RUA plan, it is unclear how such a system would
reduce costs, as access control measures would still need to be in
place that would need to differentiate between TWIC-holders and non-
TWIC-holders, but also differentiate between those TWIC-holders granted
RUA and those subject to repeated electronic TWIC inspection. These
questions, along with the exemption from electronic TWIC inspection
requirements for vessels with low numbers of crewmembers, are the
reason that the RUA plan was not proposed in the NPRM, despite being
raised in the ANPRM, and we still do not have clear answers to these
issues.
    Several commenters raised the issue of RUA with regard to certain
port workers who repeatedly enter and leave secure areas, such as
baggage porters at cruise terminals or workers such as stevedores
transferring cargo into a secure area. Similarly, one commenter
expressed concern about how porters would be able to do their jobs if
required to conduct electronic TWIC inspection at each entry into the
baggage area. Some commenters suggested that in order to permit workers
to efficiently perform their jobs, which may entail entering and
leaving a secure area several times an hour, biometric checks should be
limited to the beginning of a shift and after extended breaks. The
commenter stated that it is not operationally practical to have these
workers undergo electronic TWIC inspection repeatedly.
    We agree that, for narrow classes of vessel or facility employees
such as baggage porters, the electronic TWIC inspection requirements
could prove particularly burdensome, and that these workers could be
accommodated using a limited form of RUA as suggested by the commenter.
Some scenarios where this may prove useful include, for example,
porters who carry baggage from a curbside check-in area (unsecure) to a
baggage storage area (secure) for cruise customers, or forklift
operators who transport packages from a loading area (unsecure) to a
secure storage area on a vessel or facility. These persons need to
travel back and forth across the secure-unsecure boundary repeatedly,
and repeated electronic TWIC inspections can be both cumbersome and
redundant in these situations.
    Therefore, to accommodate these situations without compromising
security, we have added a limited form of RUA into this rule as Sec.
101.555. The system would operate as follows: a vessel or facility
would designate an area as a ``Designated Recurring Access Area
(DRAA)'' in its security plan. As shown in Figures 1 and 2, the DRAA
would consist of adjoining secure and unsecure areas, as well as the
access gates between them. As long as a TWIC-holder stayed inside the
designated area, he or she could pass between the unsecure and secure
portions of the DRAA without having to undergo an electronic TWIC
inspection each time he or she entered the secure portion.
BILLING CODE 9110-04-P

[GRAPHIC] [TIFF OMITTED] TR23AU16.000

[GRAPHIC] [TIFF OMITTED] TR23AU16.001

BILLING CODE 9110-04-C
    We have considered the problem of differentiating between those
persons granted recurring access and those who must undergo electronic
TWIC inspection prior to each entry. Certain restrictions and
conditions would be applied to ensure that no unauthorized persons gain
access to the secure area through the DRAA. In order to allow recurring
access, the Coast Guard is requiring that security personnel be present
at the access points to the secure areas where recurring access is
used. Although electronic devices, such as TWIC readers or a PACS
reader, can be used to control access at other entrances, in an RUA
situation the TWIC (or a linked PACS card) is not presented at each
entry to the secure area. Instead, the presence of security personnel
is necessary to properly control access while allowing the known DRAA
participants to pass through repeatedly.
    An additional requirement for a DRAA is that the entire unsecured
area must be visible at all times to the on-site security personnel.
This requirement is necessary to ensure that all recurring access
participants have undergone the necessary electronic TWIC inspection
before entering a secure area. We believe that without this
requirement, it might be possible for a non-TWIC-holder to ``talk their
way'' into a secure area by claiming they had already undergone a TWIC
inspection, and had merely returned from an authorized break. We note
that among various GAO criticisms of the maritime security program,
this was one of the means by which GAO investigators were able to
bypass security measures. We agree with one commenter that suggested
electronic TWIC inspection should be repeated once returning from a
break. By requiring recurring access participants to stay within sight
of the security personnel or undergo a new electronic TWIC inspection,
we can ensure that these types of incidents do not happen.
    To gain recurring access, a TWIC-holder would need to undergo

electronic TWIC inspection, including biometric matching, the first
time the TWIC-holder entered the secure portion of a DRAA. This would
of course happen at the beginning of a work shift, but would also
happen after each time the TWIC-holder left the DRAA for any reason,
including administrative reasons, lunch breaks, or even to use the
restroom. We have also added a provision that requires at least one
electronic TWIC inspection per change of security personnel in order to
account for shift changes.
    We have attempted to make the RUA policy as flexible as possible
while still maintaining security. We note that the use of a DRAA is a
wholly voluntary option, and that access to secure areas of a vessel or
facility may always be accomplished through the procedures in
Sec. Sec.  101.535 and 101.550. Even within a DRAA, only access points
that are used for recurring access must be manned by security
personnel, so there can be other access points controlled by unmanned
means (such as a lock connected to a TWIC reader) for employees who do
not need recurring access. Furthermore, an area can be designated a
DRAA at certain times. For example, at a cruise ship terminal, a
curbside area could be designated a DRAA only during boarding times.
This would allow the access points to be secured by unmanned means
during other periods when recurring access is not necessary.
    We also note that a DRAA may be incorporated in a Joint Vessel and
Facility Security Plan, allowing an area where employees can cross from
a pier to a vessel repeatedly without having to undergo electronic TWIC
inspection each time. This can facilitate the loading or unloading of
vessels considered secure areas.
2. Risk Group A Vessels
    We received fewer comments regarding the requirements for
electronic TWIC inspection for Risk Group A vessels than for vessels in
other Risk Groups. In the NPRM, we discussed the TWIC reader
requirements as applied to the Risk Group A vessel population in
Section IV.L, ``Physical Placement of TWIC Readers.'' In that section,
we stated that ``[w]e propose to amend 33 CFR 104.265(a)(4) by
requiring a vessel owner or operator to place TWIC readers at the
vessel's access points only, regardless of whether the secure area
encompasses the entire vessel.'' \47\ We realize that this sentence may
have been confusing, as the only proposed modification to Sec.
104.265(a)(4) was to add the sentence ``Depending on a vessel's Risk
Group, TWICs must be checked either visually or electronically using a
TWIC reader or as integrated into a PACS at the locations where TWIC-
holders embark the vessel'' to the existing requirement that the owners
or operator of a vessel must ensure that only authorized TWIC-holders
are granted unescorted access to secure areas of the vessel.\48\ A
clearer citation would have been to Sec.  101.514(a)(1), which
contained the proposed requirement that prior to each entry, all
persons seeking unescorted access to secure areas in Risk Group A
vessels and facilities must present a TWIC. The regulatory text was
also unclear about what ``prior to each entry'' meant, and many
commenters believed that it meant prior to each entry into a secure
area of the vessel, which was contrary to the stated intent of the
preamble.
---------------------------------------------------------------------------

    \47\ 78 FR 17816
    \48\ 78 FR 17830-17831, Amendatory Instruction 16a
---------------------------------------------------------------------------

    As stated above, in this final rule, we are modifying the
electronic TWIC inspection requirements so that they are both more
flexible and more performance-oriented than described in the NPRM. In
this final rule, we require electronic TWIC inspection rather than the
presentation of a TWIC. Furthermore, again as stated above, we are
clarifying the language relating to the locations of electronic TWIC
inspection. The new language, contained in Sec.  101.535(a),
``Requirements for Risk Group A Vessels,'' reads ``prior to each
boarding of the vessel.'' We believe that this change should improve
the clarity of the regulatory text.
    The Passenger Vessel Association (PVA) noted the confusion between
the preamble and regulatory text, noting in its comments that ``The
proposed rule states (proposed Sec.  104.265(a) \49\), `Prior to each
entry, all persons must present their TWICs for inspection using a TWIC
reader.''' The PVA argued that ``[t]he Coast Guard's explanatory
material in the Federal Register suggesting otherwise cannot override
the very clear language of the proposed regulation.'' We agree that the
language is confusing, and have clarified it appropriately. The
commenter also recommended that the Coast Guard adopt a version of RUA
that would allow a single verification of the TWIC status when the
TWIC-holder reports to the secure area for the first time each day.
While this was not what RUA, as proposed in the ANPRM, was intended to
do, we note that the clarified electronic TWIC inspection requirements
in this final rule will result in far fewer inspections on vessels than
the commenter anticipated.
---------------------------------------------------------------------------

    \49\ We note that the language cited is actually from proposed
Sec.  101.520(a)(1), not Sec.  104.265(a).
---------------------------------------------------------------------------

    One commenter, who operates as a combined ferry/terminal operator,
discussed methodologies to improve security through a ``Combined
Security Plan'' that allowed them to effectively identify risk while
allowing their employees to perform their duties in a secure and
efficient manner. The commenter suggested that its ferries have
multiple points of access from the terminal to the ferry as well as
multiple points of access to secure areas within the ferry. The Coast
Guard agrees that insofar as security measures between a terminal and
ferry can be combined, a combined plan can produce a more effective and
efficient security regime than separate plans. Furthermore, secure
areas within terminals can be connected to the entrances of ferries. In
those instances, where TWIC-holders pass directly from a secure area of
the terminal onto a ferry, an additional electronic TWIC inspection is
unnecessary. For that reason, we interpret the phrase ``prior to each
boarding of the vessel'' in Sec.  101.535(a)(1) to include the
situation in which an electronic TWIC inspection has been carried out
prior to boarding a ferry, and the TWIC-holder has not entered an
unsecure area in the interim. We believe that such an allowance will
reduce the costs of compliance with the electronic TWIC inspection
program for combined ferry/terminal operators without compromising
security.
    Several commenters posed questions relating to a situation in which
a Risk Group A vessel, such as a ferry, has multiple secure areas
separated by unsecure areas, but sole control of its terminal
facilities. These commenters asked whether it would be possible to have
only one TWIC reader at each terminal facility for both vessel and
facility workers. As explained below, such a system could meet the
requirements for electronic TWIC inspection. If a worker is granted
unescorted access to a secure area of a Risk Group A facility, and
remains in the secure area, he or she may board a Risk Group A vessel
without a second electronic TWIC inspection. We note that once on board
a Risk Group A vessel, a worker does not need to undergo additional
electronic TWIC inspections when entering secure areas.
    One commenter stated that vessels at sea should be required to
update the CCL if there are separate and distinct secure areas on board
the vessel. We disagree, and note that the requirement for Risk Group A
vessels is that

electronic TWIC inspections are only performed when the personnel are
boarding the vessel, not, like facilities, at each entry into a secure
area. Therefore updating the CCL while at sea would not serve any
functional purpose.
3. Risk Groups B and C
    In this final rule, we are completely removing any mention of
additional TWIC requirements for vessels and facilities other than
those covered under Sec.  101.535, ``Electronic TWIC inspection
Requirements for Risk Group A.'' Many commenters noted the apparent
differences between the language on Risk Groups B and C in the NPRM
preamble and the proposed regulatory text in Sec. Sec.  101.525 and
101.530, which pertained to Risk Groups B and C respectively.
    In the preamble of the NPRM, we stated that we were making no
changes to either of those groups. For example, in Section III.E.7.b of
the NPRM, ``Risk Group B TWIC Reader Requirements,'' we stated that
``proposing requirements for Risk Group A only in this NPRM is
indicative of our desire to minimize highest risks first. . . .'' \50\
Likewise, in Section III.E.8.b, ``Risk Group C TWIC Requirements,'' we
noted that ``Under current regulations (which would not change under
this NPRM) for vessels and facilities categorized in this NPRM Risk
Group C, security personnel must visually inspect the TWIC of each
person seeking unescorted access to secure areas.'' \51\ Our
preliminary RA echoed this language. In that document, we did not
include any cost analyses relating to vessels or facilities in Risk
Groups B or C.
---------------------------------------------------------------------------

    \50\ 78 FR 17802.
    \51\ 78 FR 17803.
---------------------------------------------------------------------------

    However, as commenters noted, in proposed Sec. Sec.  101.525 and
101.530, we included language from the ANPRM that contradicted the
statements in the preamble that no new requirements were being proposed
for Risk Groups B and C. The proposed regulatory text would have
required vessels and facilities in Risk Groups B and C to undergo
visual TWIC inspection prior to each entry into a secure area. Thus,
the practical effect of such a requirement would have been to require
security personnel be posted at each entry point, which many commenters
argued would dramatically increase the compliance costs for MTSA-
regulated vessels and facilities in Risk Groups B and C, contrary to
the stated intent of the regulation. The specific comments are
described in greater detail below.
    We received a large number of comments from the owners and
operators of passenger vessels that would have been categorized as Risk
Groups B and C. These individuals suggested that the proposed
regulatory text would impose severe burdens on their operations,
burdens that would be extremely costly and produce relatively little in
the way of security benefits. The PVA's comment summed up many of its
members' statements, noting that ``Group B and C passenger vessels and
facilities have multiple and widely separated secure areas with large
public access areas in between. TWIC-holders move regularly in and out
of those spaces multiple times during the day. As a practical matter,
this means that in those vessels and facilities, there must be some
other person stationed in or outside of each secure area to visually
inspect the TWIC and presumably bar the holder from entry if the visual
inspection is unsatisfactory.'' \52\ We agree with the PVA that, with
regard to passenger facilities, the wording of the proposed regulatory
text could have had this effect, but these concerns are moot because we
removed the proposed provisions on Risk Groups B and C.
---------------------------------------------------------------------------

    \52\ USCG-2007-28915-0190, p. 12.
---------------------------------------------------------------------------

    Many operators of passenger vessels argued that the requirement to
visually inspect TWICs at each entry point into a secure area would be
enormously expensive, impracticable, and provide little security
benefit. One commenter suggested that the use of existing access
control systems on vessels could be used in place of visual TWIC
inspection on vessels. One commenter wrote, ``we do not have enough
berthing to add 2 additional people that would do nothing but sit at
the galley door on opposite shifts and request to see the TWIC card of
[the] same person multiple times per day.'' \53\ Another commenter
wrote that requiring a visual TWIC inspection at each entry to a secure
area on a vessel ``is a bit like asking your brother who lives in your
household for his ID whenever he needs to use the restroom.'' \54\
Commenters also argued that needing to present a TWIC to enter an
unmanned engine room space could hinder access in an emergency. Many
other commenters echoed the substance of these remarks. In this final
rule, we hope to clarify that: (1) With regard to Risk Group A vessels,
the requirement to undergo electronic TWIC inspection applies only upon
boarding the vessel, and (2) there are no new requirements, for either
visual or electronic TWIC inspection, or anything else applicable to
vessels or facilities outside of Risk Group A in this final rule. The
existing visual TWIC inspection requirements in 33 CFR Chapter I,
Subchapter H continue to apply to vessels and facilities outside of
Risk Group A.
---------------------------------------------------------------------------

    \53\ USCG-2007-28915-0139.
    \54\ USCG-2007-28915-0215, p. 3.
---------------------------------------------------------------------------

    We received similar comments pertaining to Risk Group B and C
facilities. Many commenters requested that the final rule should state
that approved FSPs using PAC 08-09 practices continued to be allowed
for Risk Group B and C facilities. We reiterate that this final rule
imposes no changes on the operation of Risk Group B or C facilities;
accordingly, such practices will continue to be allowed. One commenter
suggested that the guidance permitting voluntary use of TWIC readers,
contained in PAC 01-11, be continued for Risk Group B and C facilities.
While that guidance is rendered obsolete by this final rule, we note
that its contents have been largely incorporated into the final rule as
Sec.  101.540, which permits non-Risk Group A facilities to use
electronic TWIC inspection procedures in lieu of visual TWIC inspection
on a voluntary basis.
    One commenter recommended that language be added to proposed Sec.
101.525 (Risk Group B) that would allow a PACS card to be used in place
of a TWIC at each entry to a secure area. Some commenters noted that
the PAC 08-09 practices are significantly less costly than inspecting a
TWIC at each entry into a secure area. While the rule imposes no new
TWIC inspection requirements on Risk Groups B or C, we follow this
suggestion with regard to Risk Group A facilities in the form of
increased flexibility for electronic TWIC inspection. One commenter
added that this could be coupled with a periodic TWIC check to ensure
it is still valid. We note that Coast Guard inspections, conducted at
Risk Group B and C facilities, accomplish exactly this check.
4. Miscellaneous Questions Regarding the Locations of Electronic TWIC
Inspection
    In this section, we address certain questions raised by commenters
on issues related to the locations where electronic TWIC inspections
must take place. Several similar comments asked us to clarify what an
``access point'' to a secure area is. The commenter provided an example
of an alarmed fire escape door that leads to a pier, which is
designated as a secure area. In response, we would clarify that an
``access point'' is any location where personnel access from a non-
secure area to a secure area is permitted, in any circumstance, by a
facility's security plan. However, we agree with the commenter that
requiring an electronic

TWIC inspection in the event of a fire would be unwise. For that
reason, we are including language in Sec.  101.535(e), allowing an
exemption from electronic TWIC inspection requirements for emergency
situations. We believe that this exemption will protect against
unauthorized access to secure areas without compromising safety in the
event of an emergency response.
    The commenter also provided an example of a roll-up baggage door,
where the porters bring in luggage they collect from guests at the curb
in front of a cruise ship terminal. Next to the roll-up door is ``a
typical personnel door.'' The commenter asked if the two doors count as
a single access point, or if they are two separate access points, where
each door requires its own TWIC reader. Again we note that in this
final rule, we are not requiring the installation of TWIC readers;
instead the requirement is that prior to being granted unescorted
access to a secure area, an individual must undergo electronic TWIC
inspection. Thus, two doors to a secure area could be controlled by a
single TWIC reader or PACS reader, if permitted in the FSP.
    The commenter also asked about an area that switches between being
secure and non-secure based on the operations taking place there at a
given time. In such an instance (and permitted, we assume, by the FSP),
when the area is designated secure, persons would need to undergo
electronic TWIC inspection before being granted unescorted access. At
times when the area was designated non-secure, there would be no such
requirement. We would expect the relevant FSP to contain more detail on
how such an area would operate.
D. Determination of Risk Groups
    The third major area of comments related to the determination of
which vessels and facilities should be placed into which Risk Groups.
In Sec. Sec.  104.263 and 105.253 of the NPRM, we proposed three
different Risk Groups, A, B, and C, although there were no differences
between the requirements for Risk Groups B and C. The proposed Risk
Groups were as follows:
    Risk Group A:
     Vessels certificated to carry more than 1,000 passengers;
     Vessels that carry CDC in bulk;
     Vessels engaged in towing another Risk Group A vessel;
     Facilities that handle CDC in bulk;
     Facilities that receive vessels certificated to carry more
than 1,000 passengers; and
     Barge fleeting facilities that receive barges carrying CDC
in bulk.
    Risk Group B:
     Vessels that carry hazardous materials, other than CDC, in
bulk;
     Vessels subject to 46 CFR chapter I, subchapter D, that
carry any flammable or combustible liquid cargoes or residues;
     Vessels certificated to carry 500 to 1,000 passengers;
     Vessels engaged in towing a Risk Group B vessels;
     Facilities that receive vessels that carry hazardous
materials, other than CDC, in bulk;
     Facilities that receive vessels subject to 46 CFR chapter
I, subchapter D, that carry any flammable or combustible liquid cargoes
or residues;
     Facilities that receive vessels certificated to carry
between 500 and 1,000 passengers;
     Facilities that receive vessels subject to 46 CFR chapter
I, subchapter D, that carry any flammable or combustible liquid cargoes
or residues;
     Facilities that receive a vessel engaged in towing a Risk
Group B vessel; and
     All OCS facilities subject to 33 CFR part 106.
    Risk Group C:
     Vessels carrying non-hazardous cargoes that are required
to have a VSP;
     Vessels certificated to carry fewer than 500 passengers;
     Vessels engaged in towing a Risk Group C vessel;
     Facilities that receive vessels carrying non-hazardous
cargoes;
     Facilities that receive vessels certificated to carry
fewer than 500 passengers; and
     Facilities that receive vessels towing a Risk Group C
vessel.
    Most comments were related to the categorization of vessels and
facilities in Risk Group A, with many commenters requesting
clarification on how to classify their own facilities, or offering
rationales for why vessels and facilities should be categorized
differently. As stated in previous parts of this discussion, the NPRM
did not propose any additional requirements for Risk Groups B or C, and
thus, for purposes of the electronic TWIC inspection requirements,
whether or not a vessel or facility is classified as Risk Group A is
the only relevant distinction.
    In this final rule, we have made a number of modifications to the
classification of facilities and vessels in response to the comments.
The major changes are summarized as follows:
     We have changed the crewmember exemption cutoff for
vessels from 14 crewmembers to 20 crewmembers, as well as clarified how
to calculate the number of crewmembers to apply this exemption.
     We have removed the specific reference to barge fleeting
facilities from the Risk Group A classification, and now treat barge
fleeting facilities like all other MTSA-regulated facilities.
     We have eliminated the distinction between Risk Groups B
and C. Vessels and facilities are now classified as either Risk Group A
or non-Risk Group A.
1. Risk Group A Facilities
    In the NPRM, we defined Risk Group A facilities in proposed Sec.
105.253(a) as: (1) Facilities that handle CDC in bulk; (2) Facilities
that receive vessels certificated to carry more than 1,000 passengers;
and (3) Barge fleeting facilities that receive barges carrying CDC in
bulk. We developed Risk Group A, along with the other Risk Groups,
using a risk-based analysis system that identified which types of
facilities were exposed to the most risk in the event of a TSI. This
system used the MSRAM to derive a numeric ``consequence'' for a class
of facilities. Once the potential risk to a class of facilities was
ascertained, we then determined whether a program of electronic TWIC
inspection would provide utility in alleviating that risk. This
analysis is described in far greater detail in the ANPRM \55\ and the
NPRM,\56\ and we refer interested parties to those documents for a
detailed discussion.
---------------------------------------------------------------------------

    \55\ 74 FR 13363.
    \56\ 78 FR 17810.
---------------------------------------------------------------------------

    Several commenters raised issues relating to the fundamental nature
of our analysis, arguing that certain factors, such as the geographic
location of a facility or its proximity to higher-risk facilities
should have been incorporated into our analysis. After considering the
comments, we have decided to largely retain the overall structure of
how Risk Group A is structured. The basis for the analysis is discussed
in Section V.A, above.
    Several commenters suggested that the MSRAM analysis used by the
Coast Guard to determine Risk Group A was flawed, and that a different
methodology to determine the Risk Groups should have been employed that
would bring more facilities into the Risk Group A category. Many of
these commenters recommended that the Coast Guard adopt a risk analysis
approach that focuses on area risks or geography, rather than the risks
associated with classes of facilities. For example, one commenter
recommended that the risk analysis should have included the risk to
port operations where the port has minimum channel depth, or for
petrochemical facilities that would create a significant impact to

commodity supplies, or chemical facilities where an attack could have
significant environmental consequences.
    Other commenters recommended that the Coast Guard consider the
geographic area surrounding a facility as the most important factor in
determining the appropriate Risk Group. Similarly, another commenter
stated that the Coast Guard should expand the risk-based concept and
aggregate risks to the port area first, before using MSRAM to determine
specific risks. In response, the Coast Guard considered a broad range
of factors, including geographic location, when determining the Risk
Groups. The totality of that analysis identifies the highest risk
vessels and facilities.
    One commenter stated that the Port of New York is the nation's
highest-risk port, suggesting that TWIC inspection should also be used
to mitigate risks associated with criminal activity such as drug
trafficking, cargo theft, and alien contraband smuggling. The commenter
suggested that TWIC readers should be required at more facilities in
that port than are required under this rule. We are not requiring
electronic TWIC inspection as a crime prevention measure, and we
reiterate that the primary purpose of requiring electronic TWIC
inspection is not to prevent crime, but to prevent TSIs at high-risk
vessels and maritime facilities.
    One commenter stated that MSRAM does not contain any data that
identifies TWIC readers as a threat mitigation tool, and that
assumptions must have been made that would connect the MSRAM data with
mitigation scenarios based on TWIC readers. In response, as emphasized
throughout this preamble, an electronic TWIC reader is a threat
mitigation tool because it provides identity verification, card
authentication, and card validity checks more effectively than visual
TWIC inspection. In the MSRAM context, a target's ``vulnerability'' is
defined as the probability that an attack will be successful. MSRAM
measures target vulnerability as a product of three factors: (1)
Achievability, which assumes the absence of all security measures and
then factors in the degree of difficulty delivering an attack on a
target; (2) Target Hardness, which considers the probability that the
attack focal point would fail to withstand the attack; and (3) System
Security, which considers the probability of a security strategy in
place to successfully thwart an attack before it occurs. Electronic
TWIC inspection is a component of System Security.
    Some commenters argued that the relative locations of Risk Group A
and B facilities should factor into the risk analysis. One commenter
stated that the NPRM did not consider a scenario where a Risk Group B
facility is immediately adjacent to a Risk Group A facility. The
commenter suggested that a terrorist could use a counterfeit TWIC to
gain access to the Risk Group B facility (which would conduct only a
visual TWIC inspection), and then use the location to mount an attack
on the adjacent Risk Group A facility. Other commenters echoed the
sentiment, stating that a Risk Group B facility that is immediately
adjacent to a Risk Group A facility should not automatically have less
stringent requirements that could become a threat vector.
    While we agree that this specific scenario was not used in our
analysis, we also do not believe that it would be appropriate to
consider. We note that in this scenario, all the counterfeit TWIC
accomplishes is to allow the adversary to get to the perimeter of the
Risk Group A facility. If the Risk Group B facility was not located in
the adjacent location, then it would be even easier for the terrorist
to get to the aforementioned perimeter. Electronic TWIC inspection is
designed to thwart access to the secure area of Risk Group A facility,
not to prevent access to the secure perimeter.
    One commenter recommended that large container terminals should not
be classified as Risk Group B, but rather as Risk Group A. The
commenter stated that a disruption of operations at any one of these
facilities could have a significant impact on the economy, and that the
Coast Guard should have used secondary consequences in its economic
analysis. While we agree that a disruption of a large container
terminal could have significant economic impacts, we disagree with the
suggestion that container facilities should be automatically classified
in Risk Group A. As stated elsewhere in this preamble, MSRAM considers
scenarios associated with threats to container facilities. However, for
the purpose analyzing electronic TWIC inspection, we limited our
consideration to attack scenarios that require physical proximity to
the intended target. Controlling access to a target is an essential
component of security from such attack scenarios because access control
helps to detect and perhaps delay the attackers before they reach the
target. Threats to cargo containers are typically not attack scenarios
that require physical proximity to the intended target. Accordingly,
electronic TWIC inspection would not mitigate such threats. Such
threats are addressed in existing Coast Guard regulations (33 CFR
104.275 and 105.265) that specifically require owners and operators to
implement detailed security measures relating to cargo handling on
vessels and at facilities.
a. Alternative Security Programs
    One commenter, representing the American Gaming Association,
recommended that instead of the risk categorization approach proposed
in the NPRM, the Coast Guard should adopt a case-by-case approach to
classification of facilities participating in its Alternative Security
Program (ASP). This commenter noted that the security measures adopted
on these vessels and facilities can be more restrictive than Coast
Guard regulations require, and that those vessels and facilities should
not be required to use TWIC readers. Furthermore, the commenter stated
that the TWIC reader technology may be duplicative with systems onboard
gaming vessels. We disagree, for the reasons stated above, with using a
case-by-case approach to risk categorization rather than the Risk Group
system proposed in the ANPRM and NPRM. However, we note that several
suggestions that the commenter made are permitted by this final rule.
If the existing security system on a vessel or facility is duplicative
of a TWIC reader (i.e., is capable of conducting a card authentication,
card validity check, and biometric match), then a dedicated TWIC reader
would not be required. We believe that a PACS can be modified to meet
these requirements with relatively little additional costs, as
discussed in the accompanying RA.
    Similarly, several commenters stated that the combined vessel and
facility security plan, as adopted in the PVA ASP, should permit
facilities to be exempt from electronic TWIC inspection requirements if
the vessels they service are exempt. For reasons discussed below, we
disagree. We note that all ASPs, including the PVA ASP, can be used to
integrate security between passenger terminals and vessels, but that
the ASP must meet all electronic TWIC inspection requirements in this
final rule.
b. Determining Risk Group A Facilities
    Several commenters asked questions or requested clarifications of
issues related to whether certain facilities would be classified as
Risk Group A facilities. Our thoughts on these specific questions are
below:
    One commenter requested clarification regarding a cruise terminal

that handles general cargo (presumably not including bulk CDC) when
cruise ships are not present. The commenter asked whether a Risk Group
A classification would only apply to a facility when a passenger vessel
certificated to carry 1,000 or more passengers was at the facility. In
such an instance, movement between Risk Groups would be permissible, if
detailed in the FSP in accordance with 33 CFR 105.253(b). One commenter
suggested that allowing movement between Risk Groups would be unfair to
those facilities that have installed electronic TWIC inspection
technology. We disagree, and note that when subject to Risk Group A
electronic TWIC inspection requirements, a facility would have to make
full and complete use of such technology, and would incur all the costs
of installing the technology.
    One commenter requested clarification that a facility would not be
classed as a Risk Group A facility if it handles multiple passenger
vessels not in Risk Group A simultaneously. This is correct, a facility
(assuming, of course, that does not handle or receive vessels carrying
CDC in bulk) would only be classified as Risk Group A if it handles one
or more vessels certificated to carry over 1,000 passengers. The
relevant risk factor is the presence at the facility of a vessel
certificated to carry more than 1,000 passengers. The relevant risk
factor is not the mere presence on the facility of more than 1,000
people, which would be a transient event driven by simultaneous
arrivals.
    Several commenters requested clarification of the use of the word
``handle.'' Proposed Sec.  105.253(a)(1) categorizes facilities that
handle CDC in bulk as Risk Group A facilities, but commenters had
questions about how to interpret this phrase. These commenters
requested clarification on how a facility would be classified if a
vessel carrying CDC in bulk were to stop at a facility, but not
transfer any of the bulk CDC cargo there. After considering the
comments, and to clarify risk groups, we have determined that any
facility that handles or receives vessels carrying CDC in bulk will be
classified as Risk Group A. While moored at a facility, a vessel must
rely on the facility's security program to adequately secure the
interface between the facility and vessel and mitigate the threat of a
TSI. For that reason, the facility should conduct electronic TWIC
inspection to meet the security needs associated with handling or
receiving vessels that carry CDC in bulk.
    Discussions at public meetings prompted the Coast Guard to clarify
the term ``handle'' as it related to non-maritime commerce.
Specifically, the question was raised whether a facility would be
classified as Risk Group A if it was used to transfer CDC in bulk
through rail or other non-maritime means. In this situation, such a
facility would be considered to ``handle CDC in bulk'' and would be
classified as Risk Group A. This is because the bulk CDC would be on
the premises of a MTSA-regulated facility, and thus the facility's
access control system would need to be used to mitigate the risk of a
TSI. We note that there are provisions where non-maritime activities of
a facility can be located outside of the facility's MTSA footprint. In
that situation, where the bulk CDC is not a part of the maritime
transportation activities, it may be that a facility could define its
MTSA footprint in such a way as to exclude that area. In such a case,
the TWIC reader requirements that are being implemented in this final
rule would not apply in that area.
    Several commenters also requested clarification of the term ``in
bulk.'' The term ``bulk'' or ``in bulk'' is defined in the Coast
Guard's existing MTSA regulations (33 CFR 101.105) as meaning ``. . . a
commodity that is loaded or carried on board a vessel without
containers or labels, and that is received and handled without mark or
count.'' Additionally, the term ``bulk'' is defined in 33 CFR 126.3 as
``. . . without mark or count and directly loaded or unloaded to or
from a hold or tank on a vessel without the use of containers or break-
bulk packaging.'' To clarify, the use of hoses and conveyor or vacuum
systems would be considered direct loading or unloading and thus
involve ``bulk.'' We have added such language to the definition of
``bulk'' in Sec.  101.105 to improve clarity. We have also removed the
phrase ``on board a vessel'' from the definition of ``bulk or in bulk''
to avoid confusion. Specifically, as stated above, a MTSA-regulated
facility would be classified as Risk Group A if it handled bulk CDC
offloaded by a train or other non-maritime means. A MTSA-regulated
facility that handles or receives bulk CDC is determined to be Risk
Group A whether or not the facility accepted the bulk CDC from a
vessel. Finally, one commenter requested clarification that container
terminals do not carry CDC in bulk. While we can clarify that CDC
shipped in containers would not be considered bulk CDC, we note that
some container facilities may also handle CDC in bulk.
    Some commenters requested clarification of the term ``receive,'' in
regards to what the requirements would be if a Risk Group A vessel were
received by a Risk Group B facility. The term ``receive'' is used in
this final rule only in Sec.  105.253(a)(2), which states that
``facilities that receive vessels certificated to carry more than 1,000
passengers'' are considered Risk Group A. In this instance, the word
``receive'' means that the vessel moors or transfers passengers to or
from the facility. If there is a need for such a passenger vessel to
moor up or transfer passengers at a non-Risk Group A facility, the COTP
would need to be contacted to ensure that proper security measures are
in place.
    One commenter asked how Strategic Ports would be classified. A
Strategic Port designation, which means the location is used by the
military to load equipment, has no direct impact on the electronic TWIC
inspection requirements. Individual vessels and facilities will be
required to comply with the applicable parts of this regulation based
on their specific operations.
    One commenter asked if facilities that receive vessels certificated
to carry more than 1,000 passengers would be classified as Risk Group A
if all the vessels the facility received are exempted from the
electronic TWIC inspection requirements by virtue of having fewer than
14 crewmembers. The commenter further stated that it is rare that the
vessels certificated to carry more than 1,000 passengers ever carry
that many, and that there are rarely 1,000 passengers in the facility.
Regardless of this fact, pursuant to Sec.  105.253(a)(2), such a
facility would be required to conduct an electronic TWIC inspection
prior to each entry into a secure area of the facility. We note that
neither condition the commenter discussed is grounds for classifying
the facility as anything other than Risk Group A. The fact that the
vessels are exempt from the electronic TWIC inspection requirement due
to their low manning requirement does not grant a TWIC exemption to the
facility, for reasons discussed in greater detail below.
    Furthermore, the fact that the ferries at issue ``rarely'' carry
the number of passengers they are certificated to carry does not change
the status of the facility either. Our analysis has shown that the
class of facilities that receive large passenger vessels present a
heightened risk of a TSI, and that the use of electronic TWIC
inspection in such facilities is an effective means to mitigate that
danger. We believe that the access control requirements in this rule
represent a good balance between costs and security.

    Several commenters were concerned that the dichotomy between
electronic TWIC inspections on vessels and facilities could present
problems for mariners. One commenter called a situation ``absurd''
where a ferry terminal, servicing ferries certificated to carry over
1,000 passengers, would be required to meet electronic TWIC inspection
requirements, while the ferries themselves would be exempt from those
requirements due to their low crew size. We disagree with the
commenter's characterization of the regulations. Ferry terminals that
handle large ferries present a risk of a large-consequence TSI, so much
so that we believe that requiring a biometric identification before
granting an individual access to the non-passenger areas of the ferry
terminal is a warranted security burden. On the other hand, we do not
believe that electronic TWIC inspection is necessary to gain access to
the ferries themselves, considering that non-TWIC-holding passengers
will also have access to the same vessels. Contrary to the commenter's
assertion, we believe it is quite reasonable to only require electronic
TWIC inspections when the TWIC-holder is accessing an area where non-
TWIC-holders are excluded. As we stated previously, the electronic TWIC
inspection requirements are designed in such a way as to only require a
burden where the security benefits will be tangible and substantial,
which is why they apply as they do.
    Some commenters suggested that where the presence of, and access
to, CDC in bulk can be isolated from areas not containing these
products within a large MTSA footprint, the facility should be allowed
to limit elevated security measures to the higher-risk area only. This
is a subject that was also raised in the NPRM.\57\ Upon consideration,
and given the general flexibility accorded by this final rule, we
believe that this suggestion is appropriate. If bulk CDC is contained
in a discrete area of the facility, it may be possible to isolate that
area from other areas of the facility. Any areas where bulk CDC is
transferred, passed through, or stored (permanently or temporarily)
would be subject to the electronic TWIC inspection access control
requirements. If the owner or operator of a facility were to take this
approach, we would still consider the facility a Risk Group A facility.
However, the owner or operator would be permitted to delineate in the
FSP a portion of the facility as not subject to the electronic TWIC
inspection requirements. The FSP would also have to contain details of
how unescorted access to other secure areas is still limited to TWIC-
holders.
---------------------------------------------------------------------------

    \57\ 78 FR 17797.
---------------------------------------------------------------------------

    Finally, many commenters presented examples of specific situations
where they believed that electronic TWIC inspection in parts or in all
of their facilities was inefficient or redundant. With regard to those
situations, we reiterate that an owner or operator may apply for a
waiver of any requirement the owner or operator considers unnecessary,
as provided in 33 CFR 104.130 and 105.130, as appropriate. We have
endeavored to tailor these requirements to be as effective as possible,
but certain situations must be dealt with on an individualized basis.
    One commenter in a public meeting asked the Coast Guard to consider
an exemption for LNG/LPG facilities not conducting transfer operations.
Similarly, this commenter and others requested an exemption for cruise
ship terminals when vessels are not present at the terminal. Without
specific information, we cannot comment on the likelihood of a waiver,
but note that in certain circumstances, facilities can change Risk
Groups depending on operational needs.
    One commenter in a public meeting stated that container facilities
should not be considered CDC facilities, and would therefore not be in
Risk Group A. Given the definition of ``in bulk'' provided in 33 CFR
101.105, any CDC being transported in a container (including tank
containers) would be considered packaged and thus would not cause the
facility to be classified as Risk Group A. We note that if a container
facility were also used to transfer or store bulk CDC, it would be
considered a Risk Group A facility and thus subject to electronic TWIC
inspection requirements.
2. The Crewmember Exemption Does Not Apply to Facilities
    Many commenters supported the Coast Guard's proposal to exempt
vessels with 14 or fewer crewmembers, but felt that a similar exemption
should be applied to facilities with 14 or fewer employees as well. For
the reasons described below, we disagree with this concept and are not
including an exemption for small facilities similar to the exemption
for low-crew vessels.
    One reason not to expand the electronic TWIC inspection exemption
to facilities is due to the specific language of the SAFE Port Act. As
stated above, the vessel exemption is predicated on Section 104 of the
SAFE Port Act, codified in 46 U.S.C. 70105(m)(1), which prohibits the
Coast Guard from requiring the placement of an electronic reader on a
vessel unless the vessel has more individuals on the crew that are
required to have a TWIC than the number we determine warrants such a
reader. No similar mandate exists regarding facilities.
    Secondly, we believe that the nature of access to facilities is
fundamentally different from the nature of access to vessels, and thus
the rationale that justifies an exemption for vessels with a low crew
count does not transfer to facilities with a low employee count. As
stated elsewhere in this preamble, the TWIC serves fundamentally
different roles with regard to facilities and vessels, due to the
nature of the respective populations. On vessels (with the exception of
passenger vessels), everyone on the vessel is generally known to one
another, and new persons are generally not introduced to the vessel
population while at sea. For this reason, the electronic TWIC
inspection requirements for vessels, when applied, require only that
the electronic TWIC inspection occur when boarding the vessel, not
prior to each entry into a secure area of the vessel (such as an engine
room). Conversely, at facilities, the entrance, exit, and egress of
persons who are not employees is a regular occurrence; drivers,
contractors, pedestrians, mariners, and other non-employees are on
facility grounds regularly. Indeed, truck drivers make up one of the
largest populations of TWIC-holders. For this reason, there are many
persons on facility grounds that are not ``known'' to facility
employees, and so additional security measures must be employed to
ensure that unescorted access to the secure areas of a facility is
granted only to TWIC-holders. For Risk Group A facilities, we believe
that the appropriate level of security is to conduct an electronic TWIC
inspection of each individual before granting them such access. That is
why electronic TWIC inspection at facilities is required ``prior to
each entry into a secure area,'' rather than only at the perimeter of
the facility,\58\ as is the case with vessels. Due to the differences
in electronic TWIC inspection requirements, we do not believe an
exemption from the electronic TWIC inspection requirements based on a
low number of employees is appropriate for Risk Group A facilities.
---------------------------------------------------------------------------

    \58\ See Sec.  101.535(b)(1).
---------------------------------------------------------------------------

    One commenter, in addition to requesting the extension of the low
crewmember exemption to facilities, specifically requested that barge
fleeting facilities with 14 or fewer people be excluded as well. In
this final rule, barge fleeting facilities are no longer a

separate class of facilities specifically subject to electronic TWIC
inspection requirements. However, barge fleeting facilities are treated
as facilities, and are subject to the same electronic TWIC inspection
requirements as other facilities.
3. The Low Number of Crewmembers Exemption
    The NPRM proposed that, unlike facilities, vessels in Risk Group A
are exempt from the electronic TWIC inspection requirements unless they
have more than 14 TWIC-holding crewmembers. This exemption was based,
in part, on the statutory limit imposed in the SAFE Port Act, 46 U.S.C.
70105(m)(1), which prohibits the Coast Guard from requiring the
placement of an electronic reader on a vessel unless the vessel has
more individuals on the crew that are required to have a TWIC than the
number we determine warrants such a reader. In the ANPRM and the NPRM,
we tentatively proposed that this number would be 14 crewmembers,
basing our recommendation on an analysis conducted by the Towing Safety
Advisory Committee (TSAC). For the final rule, factoring in comments
received and assumed risks, we have increased this number to 20
crewmembers.
    We received numerous comments on the proposal to exempt all vessels
with 14 or fewer TWIC-holding crewmembers from the electronic TWIC
inspection requirements. In the NPRM, we requested that commenters
explain any alternative suggestions and provide available data to
support their comments. Comments we received generally fell into two
categories. Many commenters suggested different numbers for the
exemption threshold, with a fair majority supporting a larger number,
thus exempting more vessels from the electronic TWIC inspection
requirement. The other main group of commenters requested clarification
on how, specifically, we would calculate the crew size of any
particular vessel to determine whether a Risk Group A vessel would be
exempt from the electronic TWIC inspection requirements. Both items are
discussed below.
4. Calculating the Total Number of TWIC-Holding Crewmembers
    Several commenters raised questions as to how, specifically, the
Coast Guard would calculate the number of TWIC-holding crewmembers on a
vessel to determine whether the vessel would be exempt from the
electronic TWIC inspection requirements. Upon review, we found that
there was some degree of confusion with regard to how this number is
determined. We have identified two approaches to calculating the
exemption number that may have led to this confusion. One approach
would be to calculate the number by counting the total number of
persons employed as crewmembers on the vessel. The NPRM's original
determination of 14 crewmembers was calculated using this approach.
That number included the Master, Chief Engineer, and three four-person
rotating crews. We counted the total number of persons employed as
crew, whether or not all of them would serve together simultaneously.
    The other approach would be to calculate the number by referring to
a vessel's Certificate of Inspection (COI) regarding crew size, which
does not contain information regarding multiple crew rotations, but
rather just the manning requirements for the vessel. Using that
methodology, the same vessel described above, with a Master, Chief
Engineer, and several four-person rotating crews would actually have
had six crewmembers. As explained more fully below, this final rule
adopts the latter approach.
    Commenters also put forth a number of detailed issues relating to
how the number of crewmembers would be determined. One commenter noted
that while at any given time during a shift, the total number of
required TWIC-holders aboard will generally be 14 or fewer, during
shift changes the number will swell to more than 14. The commenter went
on to question the definition of the term ``crewmember,'' noting that
there may be TWIC-holders on board, such as security personnel, who are
not members of the marine crew required under the vessel's COI. The
commenter requested that the Coast Guard clarify the scope of the 14-
crewmember exemption with regard to TWIC-holders who are not members of
the marine crew.
    Similarly, several commenters specifically requested that the Coast
Guard clarify that the 14-crewmember threshold only includes the
required number listed on the vessel's COI, and does not include
``persons in addition to the crew,'' industrial workers, etc. Some
commenters recommended that for uninspected vessels, ``required crew''
should include all personnel assigned to the vessel performing
navigation, safety, and security functions. Commenters also asked
whether crewmembers included additional individuals such as company
representatives, cadets, and contractors. One commenter stated that 46
U.S.C. 2101(21) excludes certain company representatives from being
counted as passengers, so they could be counted as crew. Also, in
situations where a vessel is forced to carry persons other than crew,
such as emergency responders, commenters asked if they would still be
subject to the exemption from the electronic TWIC inspection
requirement.
    In response to these comments, the Coast Guard is providing
additional detail and explanation regarding this exemption. Based on
our own analysis, and on the comments received, we agree with the
commenters who suggested that ``crewmembers'' should include all
personnel required to hold a TWIC in the required manning section of
the COI (and we note that there are no uninspected vessels subject to
MTSA requirements). Other persons in the crew section and the ``persons
in addition to the crew'' section of the COI do not count towards the
calculation for total number of TWIC-holding crewmembers. We reached
this decision for the following reasons.
    First, whether a vessel is subject to electronic TWIC inspection
requirements should not vary based on transient circumstances, such as
whether a company representative is on board, or a crew change causes
the number of TWIC-holders on the vessel to temporarily swell and
exceed the threshold. Electronic TWIC inspection programs must be
incorporated into a security plan and followed consistently. We believe
that the stability from having a consistent electronic TWIC inspection
process will help serve the goals of the inspection requirements while
minimizing the burden on vessels and facilities in Risk Group A.
    Second, establishing the minimum manning requirement as the
threshold number helps to ensure that other manning decisions are not
affected by the electronic TWIC inspection requirements. For example,
if it were based on the total number of employed crew, irrespective of
whether that crew was required for manning the vessel, then some owners
or operators of vessels might choose to lower their staffing
requirements rather than introduce the new procedures. We received
several comments suggesting that certain companies might choose to
eliminate staff rather than comply with electronic TWIC inspection
requirements. Tying the electronic TWIC inspection requirements to the
minimum manning requirements will significantly reduce the risk of this
occurring. The minimum manning requirements of a vessel are tied to the
intrinsic nature of the vessel, and are not nearly as elastic as the
other crewing needs of the vessel.

5. Threshold for the Crewmember Exemption
    Based on the TSAC recommendation, we proposed in the NPRM that the
cutoff number of crewmembers that make a vessel exempt from the
electronic TWIC inspection requirement should be 14. We specifically
requested comments from the public on whether 14 is an appropriate
cutoff number, and requested explanations and available data to support
any arguments for alternative numbers. We received numerous comments
regarding this issue. Some commenters suggested that 14 was an
appropriate number, but the majority suggested that it be increased.
    The PVA and other commenters suggested that the Coast Guard should
not have followed TSAC's recommendation, as not all sectors of the
domestic maritime industry have input into that group's
recommendations. The PVA suggested that 20 was a more appropriate
number, noting that the largest minimum manning requirement for its
members' vessels was 16. This figure is larger than 14, but not so
large that long-time crewmembers would not recognize each other. This
figure was suggested as appropriate because it would be a figure
developed with the consultation of industry.
    Similarly, many passenger vessel operators suggested that the
exemption threshold be set high enough to exempt passenger vessels. One
commenter suggested that the threshold number of 14 did not make sense,
and that even with a crew of 20-30 people, it would be impossible for
an imposter amongst them to go unnoticed. Another commenter suggested
that 40 crewmembers would be a better threshold, arguing that the
regulatory compliance costs of electronic TWIC inspection, added to
other costs relating to security, were too onerous.
    After considering all comments, we have decided to increase the
number to 20 crewmembers as the figure for determining the threshold
number under 46 U.S.C. 70105(m). Considering input received from all
areas of industry, we believe it is an appropriate crew size at or
under which all crewmembers will be able to quickly identify people who
do not have unescorted access to secure areas. We realize that this may
be a conservative figure, and that there is no hard number at which all
crewmembers will recognize each other by sight. This number is highly
dependent on the length of time the crew has served together, and on
the reliability of every individual crewmember's memory. Nonetheless,
we believe that the figure of 20 crewmembers presents a reasonable
threshold at which all members of the crew can be realistically be
expected to recognize one another. However, we are continuing to study
the issue, and may propose to expand the electronic TWIC inspection
requirements by reducing the exemption threshold in a future
rulemaking.
    The Coast Guard realizes that increasing the crewmember threshold
now exempts not only most passenger vessels, but many vessels that
carry CDC in bulk. We are comfortable with this exemption at this time
for two reasons. First, as stated by many of the commenters, we believe
that a crew of 20 on a vessel that carries CDC in bulk will all be
familiar with one another, so the risk of an unauthorized person being
unnoticed on the vessel is slim. Second, due to the requirements for
electronic TWIC inspection at the facilities where the CDC vessels
conduct a majority of their business, the vast majority of these
crewmembers will have their TWIC verified when passing through the
facility on their way to the vessel, during crew changes or other trips
ashore. Finally, one commenter in a public meeting noted that TWIC
readers on vessels may be exposed to explosive atmospheres, and that
therefore, TWIC readers must be intrinsically safe. In the event that
TWIC readers are installed in hazardous areas, they would need to
comply with all applicable requirements associated with those areas,
which would at the minimum likely entail additional costs for testing
and certification, and we note that no TWIC reader on the QTL is
currently certified as intrinsically safe. For these reasons, we
believe that imposing an additional requirement that crewmembers
undergo an additional round of electronic TWIC inspection each time
they board the vessel would provide limited security value for vessel
with fewer than 20 crewmembers carrying bulk CDC.
6. Outer Continental Shelf Facilities
    In the NPRM, we proposed to characterize all OCS facilities as Risk
Group B, meaning that they would not need to undertake electronic TWIC
inspection. In this final rule, the Coast Guard continues to exclude
OCS facilities from electronic TWIC inspection requirements. One
commenter, an owner of some OCS facilities, asked whether TWIC readers
could be placed at ``the point(s) of embarkation'' as opposed to
placing TWIC readers on the OCS facility itself. Such a placement would
be permissible if described in an approved FSP. However, we note that
because OCS facilities are not considered Risk Group A, no electronic
TWIC inspection requirements will apply as a result of this final rule.
7. Vessels and Facilities Not in Risk Group A
    Many commenters supported the Coast Guard's decision not to include
additional requirements for Risk Groups B and C in the NPRM. We
appreciate the support, and agree that at this time, only vessels and
facilities in Risk Group A will be affected by the electronic TWIC
inspection requirements in this final rule. However, as stated in the
NPRM, this final rule ``should not be read to foreclose revised TWIC
reader requirements in the future.'' \59\ Many commenters took this,
and similar statements, as an indication that we had planned to extend
electronic TWIC inspection requirements to Risk Group B vessels and
facilities. As a result, we received several comments on the
categorization of vessels and facilities within those Risk Groups.
---------------------------------------------------------------------------

    \59\ 78 FR 17790.
---------------------------------------------------------------------------

    One commenter suggested that all facilities, including those
proposed to be in Risk Groups B and C, should be required to have at
least one portable TWIC reader. The commenter stated that this would
allow the facility to complete a comprehensive check of a TWIC, which
would help to deter potential attackers by making it more likely that
they would be caught. While we agree that adding electronic TWIC
inspection to all facilities would produce a security benefit, for the
reasons extensively detailed in this rulemaking, we do not believe that
such measures would be efficient at this time for lower-risk
facilities. The commenter also argued that security guards should not
manually check the CCL during visual TWIC inspection, as it could
distract him or her. We note there are no requirements to check the
list of cancelled TWICs during visual TWIC inspection, nor does this
rulemaking affect visual inspection procedures.
    One substantial change being made in this final rule is the
discontinuation of the distinction between Risk Group B and Risk Group
C. The distinction between these two Risk Groups was relevant in the
ANRPM, where we had proposed that Risk Group B vessels and facilities
would be required to use TWIC readers on a random basis, whereas Risk
Group C vessels and facilities would not be required to use TWIC
readers at all. However, in the NPRM, we proposed to eliminate the
random TWIC screenings from the Risk Group B requirements, and thus
there was no distinction in

requirements between those two Risk Groups. Nonetheless, we still
proposed that the terminology for Risk Groups B and C be included in
the regulations. Despite the lack of distinct requirements, many
commenters read the NPRM to mean that electronic TWIC inspection
requirements would be applied in some manner to Risk Group B vessels
and facilities, and many commenters discussed the criteria by which
vessels and facilities were classified as Risk Group B or C.
    One commenter did not support the proposed placement of Oil Spill
Response Vessels and Oil Spill Response Barges in Risk Group B, arguing
that these vessels carry primarily an oily water mixture, rendering
them at low risk for terrorist attack. The commenter provided
additional analysis distinguishing Oil Spill Response Vessels from tank
vessels, and requested that they be classified as Risk Group C.
    Multiple commenters supported the decision to place Offshore Supply
Vessels in Risk Group C, but wanted to clarify the definition of
``Offshore Supply Vessel'' for the purposes of TWIC requirements.
    One commenter argued against the placement of all OCS facilities in
Risk Group B. The commenter believed they should be subject to the same
site-specific analysis that other facilities are subject to, and placed
into Risk Group B or C as appropriate.
    Several commenters responded to the Coast Guard's request for
information as to whether petroleum refineries and storage facilities
should be categorized as Risk Group A. Some commenters stated that it
would be inappropriate for the agency to arbitrarily re-categorize
these facilities without supporting study and analysis, and requested
that if the Coast Guard omitted a risk in its initial analysis, a
second notice and comment opportunity should be provided. One commenter
noted that, according to the Coast Guard's RA, the risk level for
petroleum facilities was more comparable to Risk Group C than Risk
Group A. Commenters also noted that due to the spacing of petroleum
tanks at facilities, it is highly unlikely that a fire at one tank
could ``jump'' to another.
    Several commenters provided the Coast Guard with a 2008 study
entitled ``Risks Associated with Gasoline Storage Sites,'' which they
argued demonstrated that gasoline does not pose a high risk of off-site
consequences if involved in an incident, particularly one related to
security.
    One commenter expressed concern about the expectation regarding the
phase-in statements made in the NPRM, stating that the absence of
``definitive statements'' has left the owners and operators of
facilities in Risk Groups B and C wondering what will happen and what
they should do.
    Similarly, one commenter stated that it seemed as if ``phased in''
was already the basic approach being taken by the Coast Guard, and that
revisions to the electronic TWIC inspection requirements were all but
certain. That commenter requested that instead of this approach, the
Coast Guard should specifically identify the vulnerabilities that will
be addressed and develop a proposal accordingly. Finally, commenters
noted that if the Coast Guard were to propose expanding electronic TWIC
inspection requirements beyond Risk Group A, a new Regulatory
Flexibility Act analysis would be required.
    One commenter drew a distinction between petroleum refineries and
petroleum storage facilities. The commenter stated that the petroleum
storage facilities only store petroleum, whereas refineries may contain
many types of more hazardous materials, such as hydrogen, although the
commenter also stated that such facilities are well-equipped to handle
those materials.
    Based on the comments received on this issue, we are not
categorizing petroleum storage or refining facilities as Risk Group A
in this final rule. Furthermore, we note that if and when the Coast
Guard decides to propose additional electronic TWIC inspection
requirements for facilities not currently classed as Risk Group A,
global factors such as the cost of implementing electronic TWIC
inspection, risk factors relating to the threat of a TSI, or other
unforeseen conditions may have changed, necessitating a reconsideration
of which vessels and facilities should be subject to additional
security measures. The factors raised by commenters will be considered
if and when additional TWIC inspection requirements are proposed in the
future.
    We agree with the argument put forth by commenters that before
extending electronic TWIC inspection requirements, a revised analysis
of the costs and benefits should be undertaken and that opportunity to
comment on those proposed requirements should be provided. Given the
arguments raised in the comments, it is clear that more analysis needs
to be conducted before the requirements of electronic TWIC inspection
are extended to vessels and facilities not in Risk Group A. We do not
believe that setting out the risk parameters for the next group of
vessels and facilities to which electronic TWIC inspection may be
applied is appropriate at this time. If and when the electronic TWIC
inspection requirements are phased in further, the Coast Guard believes
that the additional flexibility afforded by not having preset
definitions for the lower-tier Risk Groups will allow us to better
tailor the future rulemakings appropriately. As the analysis of risks,
threats, and costs continues to evolve, we will conduct further
analysis as appropriate as well as solicit additional information from
the public.
8. Barge Fleeting Facilities
    The inclusion in Risk Group A of barge fleeting facilities that
handle barges carrying CDC in bulk was a topic discussed by a large
number of commenters. The Coast Guard received comments from a variety
of barge fleet operators, towing operators, and trade associations.
Universally, comments on this subject argued that barge fleeting
facilities should not be required to install TWIC readers. For the
reasons described below, based on the comments received, we have
removed the separate requirement that barge fleeting facilities that
handle barges carrying CDC in bulk are specifically considered Risk
Group A. Instead, barge fleeting facilities are considered facilities,
and may be required to perform electronic TWIC inspection if the
standard criteria for Risk Group A are met.
    Barge fleeting facilities are defined in 33 CFR 101.105 as ``a
commercial area, subject to permitting by the Army Corps of Engineers .
. . or pursuant to a regional general permit[,] the purpose of which is
for the making up, breaking down, or staging of barge tows.'' Because
this rulemaking would only affect barge fleeting facilities that
interact with barges carrying CDC in bulk, only those barge fleeting
facilities which are used for the staging of barge tows would be
affected by this final rule. In the NPRM, we proposed that all barge
fleeting facilities that service barges carrying CDC in bulk would be
considered Risk Group A.
    Comments on why barge fleeting facilities should not be included in
Risk Group A fell into four general categories. First, many commenters
argued that the cost of installing TWIC readers at barge fleeting
facilities would be higher than the installation costs at other
facilities due to their remoteness, and that the Coast Guard's
preliminary RA had not taken this into account. Second, several
commenters argued that due to the remote location or lack of permanent
infrastructure of many barge fleeting facilities, the consequences of a
TSI would not be so great as to warrant

an inclusion into Risk Group A. Third, one commenter argued that
because barge fleeting facilities only service vessels that would be
exempt from the TWIC reader requirement (because they have fewer than
14 crew), the facilities should also be exempt. Finally, several
commenters argued that a TWIC reader would not enhance security at
barge fleeting facilities. We address each of these comment categories
below.
    The cost of installing TWIC readers at barge fleeting facilities
was cited by commenters as a reason to reconsider placing them in Risk
Group A. Commenters generally argued that logistical considerations
made installing TWIC readers in barge fleeting facilities substantially
more expensive than at traditional installations. Several commenters
stated that infrastructure costs, such as electricity, Internet access,
and a facility to protect the TWIC reader would cause this requirement
to be dramatically more expensive than originally considered.
Similarly, commenters stated that these costs were not considered by
the Coast Guard in its preliminary RA. Multiple commenters stated that
the $300,000 initial phase-in costs estimated for bulk liquid
facilities seemed like a low estimate. These commenters suggested that
they would refuse to handle barges carrying bulk CDC rather than bear
this increased cost, and that a final rule would cause rates to rise at
other facilities. Similarly, commenters suggested that the decision to
require TWIC readers at these barge fleeting facilities could actually
be detrimental to security because, building on the idea that many
facilities would refuse to handle bulk CDC barges, those barges would
become concentrated at the few facilities that did allow them, thus
increasing the risk profile of the fleeting areas that service them.
    We disagree with the notion that TWIC readers would be
substantially more expensive to operate at barge fleeting facilities
than at other types of facilities. As summarized above, the commenters
who made this argument all cited various infrastructure costs,
including installing electrical connections, Internet service, and a
facility to protect the TWIC reader as drivers of the increased costs.
However, all of these costs are associated with fixed TWIC readers,
which are not required by this rule. Isolated facilities without
electrical or data connections could use portable electronic readers to
comply rather than undertake these measures to install fixed readers.
We note that portable electronic readers can be, and are, operated
using battery power and wireless communication technology to scan TWICs
and check them against the list of cancelled TWICs.
    With regard to our preliminary RA, we disagree that the costs of
TWIC readers was not applied to barge fleeting facilities. As stated
above, as portable electronic readers can be used to conduct electronic
TWIC inspections without expensive upgrades to infrastructure, we
believe that the price of portable electronic readers estimated in the
preliminary RA is applicable to barge fleeting facilities that are not
connected to electrical and information infrastructure. Furthermore,
barge fleeting facilities were counted in the overall analysis of
facilities covered by the proposed rule. Thus, we believe that the
preliminary RA sufficiently analyzed the cost impacts for barge
fleeting facilities.
    Numerous commenters argued that barge fleeting facilities are so
isolated they should not be placed in Risk Group A. For example, one
commenter recommended that barge fleeting facilities be categorized as
Risk Group C, or as an alternative, CDC fleeting areas should be
categorized using a risk-based approach based on the geographic
location in relation to populations, with those in higher-density
locations placed in Risk Group A. One commenter added that for economic
reasons, fleets are usually far removed from major industrial or
population centers, thus limiting the risk as potential targets for
terrorist attacks.
    Because of the MSRAM methodology used to determine risk, we
disagree that perceived geographic isolation of a particular facility
alone should justify lesser security requirements. The risk groupings
are based on the averaged MSRAM scores for each class of facility. In
conducting our risk analysis, one of the primary factors used was an
estimate of the average maximum consequences of a TSI on a class of
facility. In MSRAM, the Coast Guard calculates the maximum consequence
for each facility, which is the estimate of all damages that would
occur from the total loss of a facility caused by a TSI resulting from