information available through additional mechanisms, such as wireless
connection to a TWIC reader, manual download to a TWIC reader, access
via smart-phone, or a searchable Internet database accessible via the
Homeport \48\ or other secure system. We emphasize that the CCL
information is available via the Internet through a wireless device or
manual download to a TWIC reader.\49\
---------------------------------------------------------------------------

    \48\ Homeport is a publicly accessible internet portal located
at https://homeport.uscg.mil, which provides users with current
maritime security information. It also serves as the Coast Guard's
communication tool designed to support the sharing, collection, and
dissemination of sensitive but unclassified information to targeted
groups of registered users within the port population.
    \49\ The CCL is updated daily and is publicly available for
download on the Internet at https://twicprogram.tsa.dhs.gov/TWICWebApp/.
---------------------------------------------------------------------------

    Seven commenters expressed concerns over the CCL because it groups
together individuals who are legitimate security threats with
individuals who merely have a lost or stolen TWIC. These commenters
felt that individuals in the latter categories would be unduly
stigmatized by being placed on the CCL together with individuals
identified as security threats. Accordingly, they argued that the CCL
should focus exclusively on individuals determined to be security
threats.
    We wish to clarify that the CCL does not contain names, any
personally identifiable information, or any security information. The
CCL is simply a list of TWIC numbers that have not yet expired, but are
no longer valid for entry to secure areas due to their reported loss or
theft, being revoked by TSA, or replaced administratively due to
damage, or other reason.
    We also note that the Coast Guard does not maintain or control the
content of the CCL. The CCL is maintained and controlled by TSA. The
Coast Guard has shared these comments with TSA for use in future
planning. Facility and vessel owners and operators should understand
that a variety of factors could cause a TWIC to be listed on the CCL.
    One commenter suggested that we use a vehicle, such as the Homeport
system, to notify employers when an employee has been identified as a
national security threat or otherwise deemed ineligible to hold a TWIC.
In response to this comment, we note that national security threats are
dealt with in the manner prescribed by relevant law enforcement
agencies, and typically do not involve release of any information that
could compromise an ongoing investigation, including whether an
individual may pose a national security threat. We also note, however,
that TSA requires all TWIC applicants to acknowledge that TSA may
notify employers and facility owners and operators if there is an
imminent threat of risk to individuals or property.
    Several commenters expressed opinions on the ANPRM's proposal
regarding a ``privilege granting'' system, which would enable an owner
or operator to register with TSA the names of specific TWIC-holders
granted access to secure areas. TSA would then contact the owner or
operator directly when a registered individual has been added to

the CCL. Approximately 20 commenters stated that they would prefer a
privilege-granting system over a requirement to continually download or
manually check CCL information. One of these commenters suggested that
privilege granting should actually be a minimum requirement for all
owners and operators of vessels and facilities in Risk Group C, because
this would confer a meaningful security benefit at little cost. Most of
the commenters supporting a privilege-granting system opposed the
proposition to pay a fee for it. Two commenters suggested that if a fee
were to be charged, the NPRM should include a fee estimate so that the
public would have more of a basis on which to comment.
    Several commenters were not in favor of the ANPRM's privilege-
granting system. One simply felt it is unnecessary. Another cited
employee privacy concerns. One commenter stated that a privilege-
granting system might provide some benefit to vessels, but would not
benefit facilities. Another stated that a privilege-granting system
would not be a viable option for tug or barge operators because these
operators do not know which individuals require access to which vessels
or facilities.
    After considering the comments and further analysis, we have
decided not to include a privilege-granting system in this NPRM. The
population of TWIC-holders granted access to any given vessel or
facility often changes, which means that a privilege-granting system
would be labor-intensive, costly, and impractical to maintain.
Moreover, we believe that creating and maintaining a privilege-granting
system would require substantial government and/or industry resources,
and commenters were generally unwilling to pay fees that would be
necessary to create and maintain such a system.
    One commenter requested information on how vessels operating
outside of available wireless Internet access zones would download
necessary CCL updates. We wish to clarify that there would be no
obligation to download updated CCL information when there are no new
individuals seeking access to secure areas. For example, a vessel
designated as a secure area that is underway for an extended period of
time with the same crew would not need to download updated CCL
information if card validity was properly confirmed when the TWIC-
holders boarded the vessel. We request additional comments from the
public regarding practical scenarios in which a vessel might not be
able to download necessary CCL updates within the prescribed frequency
(weekly or daily, depending on MARSEC Level). Additionally, we request
comments from the public regarding the regulatory requirements that we
should put in place when vessels are in one of those scenarios. One
possibility would be to continue to require the use of TWIC readers for
identity verification, card authentication, and card validity, even
though the CCL might not have been updated within the prescribed
frequency. This would electronically confirm that the TWIC has not
expired, and also confirm no match against the most recently downloaded
version of the CCL. The owner or operator would be required to update
the CCL at the next available opportunity. We request comments from the
public on this proposal or any preferred alternatives we should
consider.
    One commenter requested guidance on the obligations an employer
might have if notified by TSA that a former employee's TWIC has been
revoked. We wish to clarify that generally, no such notification would
be forthcoming. We note, as mentioned above, that TSA requires all TWIC
applicants to acknowledge that TSA may notify employers and facility
owners and operators if there is an imminent threat of risk to
individuals or property. In those scenarios, TSA would provide
appropriate case-specific guidance to the employer at the time of any
such TSA notification.
    Several commenters requested additional general guidance on any
proposed requirements to perform card validation using CCL information.
We will consider whether and how to issue additional guidance, as
necessary.
f. PIN Usage
    Approximately 30 commenters agreed with the ANPRM's approach that
TWIC-holders should not be required to input their PINs in order to be
granted access to secure areas. Among the reasons commenters cited in
opposing a PIN requirement were: intermittent use makes PINs hard to
remember; difficulty of retrieving forgotten PINs; throughput delays
and other disruptions; and lack of an appreciable security benefit once
a biometric match has been established.
    In the ANPRM, we recognized the operational and environmental
challenges that a PIN requirement would present. The TWIC Pilot also
noted that since many TWIC-holders had rarely, if ever, used their PINs
since activating their TWICs, some workers could not remember their
PINs. These individuals were then required to visit a TWIC enrollment
center to reset their PINs. The TWIC Pilot also noted that inputting
the PIN is not necessary to conduct a biometric match. Consistent with
the comments and TWIC Pilot findings, this NPRM does not propose a
requirement that TWIC-holders enter their PINs in order to access
secure areas.
    Several commenters also requested that PINs not be required during
Coast Guard spot checks and inspections. We note that such a proposal
was not included in the ANPRM. Existing regulation already requires
mariners to provide their PINs to Coast Guard personnel upon
request.\50\ For example, when a mariner's fingerprints cannot be read
using a TWIC reader, Coast Guard personnel may require the mariner to
provide the PIN. To account for this and other instances when a
mariner's identity cannot be verified by means other than the TWIC and
PIN, we are retaining the existing provision that requires mariners to
provide PIN information to Coast Guard personnel upon request.
---------------------------------------------------------------------------

    \50\ See 33 CFR 101.515(d)(2).
---------------------------------------------------------------------------

    Some commenters acknowledged that PIN verification may be useful in
certain circumstances, and that there are certain advantages associated
with PINs. One commenter noted that PIN usage would be a viable
alternative when fingerprint matching is not possible. We agree with
this comment and have addressed this issue below in section IV.F.
``TWIC Inspection Requirements in Special Circumstances.''
    Another commenter suggested that TWIC readers designed to only
check PINs might be less expensive than TWIC readers that perform other
functions. We believe that the operational and environmental challenges
presented by a PIN requirement outweigh this possible cost advantage.
    One commenter stated that PINs are another line of defense against
forged TWICs. We agree with this comment, but do not believe it
warrants a PIN requirement. Although this NPRM does not propose to
require PIN verification, owners and operators may choose to impose
their own PIN verification requirement on individuals before granting
them access to secure areas.
    Finally, several commenters requested that we implement a more
widely available and accessible system for resetting forgotten PINs.
This comment relates to TSA's procedures for resetting PINs. We have
provided these comments to TSA for their consideration. TSA currently
protects PINs by securely locking them on the card as required by the
Federal Information Processing Standards 201-1 (FIPS 201). PIN reset
requires virtual private network (VPN) access to the

TWIC system available only at TWIC enrollment centers. TSA is looking
at possible alternatives and updates to the current PIN reset policy.
4. Utility of TWIC Readers in Reducing TSI Vulnerability
    Many commenters acknowledged the utility of the TWIC program in
reducing TSI vulnerability, though they expressed differing opinions on
the utility of TWIC readers in that regard. Some asserted that TWIC
readers would not reduce risks, especially on small vessels where
crewmembers are familiar with one another, and on vessels where
restricted areas are already protected by other access control
mechanisms. Several of these commenters expressed the opinion that TWIC
effectively reduces risk insofar as personnel are required to complete
a rigorous security threat assessment in order to obtain a TWIC; yet,
they believe that TWIC readers would provide no additional risk
reduction benefit. Although one of these commenters acknowledged the
potential utility of TWIC readers at large facilities and on large
vessels, this group of commenters generally opposed all of the proposed
TWIC reader requirements.
    Other commenters took the opposite view. Several argued that the
TWIC's security benefits would only be realized through the institution
of a standard requirement to use TWIC readers at all MTSA-regulated
vessels and facilities. One point emphasized by this group of
commenters is that visual inspection as a means of identity
verification would not effectively detect counterfeit TWICs.
    One commenter favored an approach in which TWIC readers are used in
addition to--not in place of--visual comparison of the TWIC-holder to
the photograph on the TWIC. Another commenter favored an approach in
which owners and operators would be required to conduct random
electronic biometric matches using a TWIC reader, as opposed to using a
TWIC reader each time an individual accesses secure areas. Finally, one
commenter suggested that we include an option that would allow owners
and operators to schedule periodic Coast Guard visits for the purpose
of conducting comprehensive inspections using the Coast Guard's
portable TWIC readers.
    The wide ranging nature of these comments demonstrates the need for
an analysis of the impacts of TWIC reader requirements in the maritime
sector. Similarly, Congress had also mandated a thorough analysis of
TWIC reader utility in the SAFE Port Act by requiring the Secretary to
`` * * * conduct a pilot program to test the business processes,
technology, and operational impacts required to deploy * * * [TWIC]
readers at secure areas of the maritime transportation system.'' \51\
At the time we published the ANPRM and received the comments above, TSA
had not yet completed data collection for the TWIC Pilot. TSA completed
data collection for the TWIC Pilot on May 31, 2011. In accordance with
the SAFE Port Act, we crafted the proposals in this NPRM in a manner
consistent with the findings of the TWIC Pilot.\52\
---------------------------------------------------------------------------

    \51\ 46 U.S.C. 70105(k).
    \52\ 46 U.S.C. 70105(k).
---------------------------------------------------------------------------

    The TWIC Pilot was designed to assess, among other things, the
utility of TWIC readers in enhancing security. The TWIC Pilot found
that when designed, installed, and operated in a manner consistent with
the business considerations of the vessel or facility, TWIC readers
enhance security by reducing the risk that an unauthorized individual
could gain access to secure areas. The TWIC Pilot also found that TWIC
readers enhance security by enabling owners and operators to assign
secure area access privileges to a limited population of TWIC-holders.
The proposals in this NPRM to require TWIC readers are consistent with
the findings of the TWIC Pilot and were developed to reduce TSI
vulnerability at MTSA-regulated facilities and vessels.
5. TWIC Reader Requirements on Vessels
    Many commenters expressed opposition to any requirement for TWIC
readers on vessels. These commenters argued that TWIC readers on
vessels would be expensive, impractical, ineffective in enhancing
security, and would put U.S.-flagged vessels at a competitive
disadvantage relative to foreign-flagged vessels that can operate
without TWIC readers. Instead, these commenters favored using TWIC as a
visual identity badge on vessels. They argued that the greatest value
of the TWIC program is not as an access control device, but rather as a
reliable, standardized means to establish the identity and background
of new employees. The commenters emphasized that TWIC readers would
likely cause logistical problems, and would be unnecessary on vessels
in which crew size is relatively small, because crewmembers are
familiar with one another. Finally, the commenters believed that TWIC
readers are unnecessary on vessels because, in most cases, TWIC-holders
accessing vessels have already had their TWICs checked using a TWIC
reader at shore-side facilities and during Coast Guard inspections.
    One commenter felt that there might be limited utility to TWIC
readers on vessels. Another commenter proposed an alternative approach
that would require vessel owners and operators to specify a certain
percentage of individuals on board for random biometric matches using a
TWIC reader.
    As mentioned previously, we rely on the TWIC Pilot's finding that
TWIC readers enhance security when used properly. Additionally, we
recognize that many of the commenters arguing against the proposed
requirement for TWIC readers on vessels expressed the interest of
owners and operators of vessels in Risk Group B. After considering the
public comments and additional analysis, we have eliminated from this
NPRM the proposal to require TWIC readers on vessels in Risk Group B.
As discussed more fully below in Section IV., ``Section-by-Section
Description of Proposed Rule,'' this NPRM proposes TWIC reader
requirements for vessels in Risk Group A only. Moreover, this NPRM
proposes to exempt from TWIC reader requirements all vessels with 14 or
fewer TWIC-holding crewmembers. These measures should alleviate most of
the concerns raised by commenters with respect to the costs and
logistics of TWIC readers on vessels and on the limits for utility on
vessels with 14 or fewer crewmembers.
    Some commenters expressed the opinion that on small vessels, even a
requirement to use the TWIC as a visual identity badge is an
unnecessary burden that would confer little or no security benefit. We
disagree with this comment. A security benefit is conferred when a
vessel owner or operator is able to confirm that each entrant to a
secure area holds a TWIC.
    One commenter requested clarification as to whether a vessel owner
or operator would be required to check TWICs electronically on days the
vessel does not sail. We wish to clarify that TWIC reader requirements
are triggered when individuals are granted access to secure areas,
regardless of whether a vessel sails.
6. TWIC Reader Requirements for Risk Group A
a. Risk Group A Classification
    Two commenters questioned why Risk Group A includes facilities that
handle bulk CDC, but does not include facilities that handle non-bulk
Division 1.1 or 1.2 explosives. We reiterate that based on the AHP/
MSRAM data and analysis, facilities that handle non-bulk

substances did not warrant placement in Risk Group A. Such facilities
generated lower AHP scores because unlike bulk CDC, Division 1.1 or 1.2
explosives are segregated and kept in smaller quantities.
b. Risk Group A TWIC Reader Requirements
    Six commenters representing owners and operators of large vessels
or facilities expressed general concerns that the ANPRM's proposed TWIC
reader requirements would present significant operational challenges.
Another commenter stated that it would be burdensome if TWIC readers
had to be manually updated to keep CCL information current.
    In considering these comments, we note that the TWIC Pilot elicited
a variety of lessons learned with respect to the operational impacts of
deploying TWIC readers in the maritime sector. The TWIC Pilot generally
found that when TWIC readers are designed, installed, and operated in a
manner consistent with the business considerations of the vessel or
facility, they function properly.
    We believe that the proposals in this NPRM appropriately consider
the findings of the TWIC Pilot and implement the TWIC reader
requirements mandated by MTSA and the SAFE Port Act in a manner that
enhances the nation's maritime security without imposing undue burdens.
More information on the economic analysis for this proposed rule is
provided below in Section V. ``Regulatory Analyses.''
    We also note that in the TWIC 1 Final Rule, we revised 33 CFR
105.115 to permit owners and operators to redefine their ``secure
area'' as only that portion of their access control area that is
directly related to maritime transportation. This revision was intended
to provide greater flexibility to facility owners and operators in
dealing with the operational impacts of implementing the TWIC program
at each individual facility. Additionally, as discussed above, we are
also considering allowing multiple risk group designations within one
facility, to account for situations where one portion of a facility
handles dangerous cargoes and another portion does not.
7. TWIC Reader Requirements for Risk Group B
a. Risk Group B Classification
    Numerous commenters expressed the opinion that Risk Group B is
over-inclusive in terms of the types of vessels and facilities covered.
Many argued that OCS facilities subject to 33 CFR part 106 do not
present risks that warrant placement in Risk Group B.
    Two commenters argued that tank vessels as defined in 33 CFR
Subchapter D should not be placed in Risk Group B. One commenter
suggested that with respect to crewmembers on Subchapter D vessels, the
only requirement to scan their TWICs using a TWIC reader should be upon
initial hiring at the employer's home office.
    One commenter whose vessel is licensed for 800 passengers and
carries a crew of six argued that TWIC reader requirements would be a
financial burden that provides no appreciable security benefit. In
response, we note that in this NPRM, we do not propose to require TWIC
readers for Risk Group B.
    One commenter argued that facilities handling no hazardous
materials other than asphalt cement do not present risks that warrant
placement in Risk Group B. The commenter requested that we specifically
exclude from Risk Group B facilities that handle products designated as
hazardous only due to storage and handling at elevated temperatures.
Two commenters suggested that for purposes of this rule, the term
``hazardous materials'' should not be defined by reference to 49 CFR
172. One of these commenters argued that this definition would cover
many products that present little or no risks. Instead, the commenter
suggested that we adopt the definition of ``hazardous materials'' used
by TSA and/or the Pipeline and Hazardous Materials Safety
Administration.
    We wish to clarify that the term ``hazardous materials'' is defined
in 33 CFR part 101.105 as those materials subject to regulation under
46 CFR parts 148, 150, 151, 153, or 154, or 49 CFR parts 171 through
180. We believe that the types of vessels and facilities referenced in
the comments above are appropriately placed in Risk Group B based on
the AHP/MSRAM analysis. We further believe that the comments above
seeking re-classification out of Risk Group B resulted from the ANPRM's
proposal to require TWIC readers for Risk Group B. We reiterate that,
based on the comments and additional analysis, this NPRM does not
propose TWIC reader requirements for Risk Group B.
b. Risk Group B TWIC Reader Requirements
    One commenter believed that the ANPRM's proposed requirements for
Risk Group B are appropriate. Another commenter argued that identity
verification upon each entry to a secure area would be too burdensome.
Another commenter argued that the proposed TWIC reader requirements in
the ANPRM for Risk Group B at MARSEC Level 2 would be too burdensome.
Finally, two commenters argued that, as a general matter, the ANPRM's
proposals are too burdensome because they would require vessels and
facilities in Risk Group B to have both a TWIC reader and a security
guard to visually inspect TWICs as well.
    Several commenters argued that the ANPRM's requirement for Risk
Group B to conduct random monthly scans using a TWIC reader would be
costly and provide minimal security benefits, especially if done on a
low volume or non-work day. Other commenters requested clarification as
to whether the ANPRM's approach would require monthly scans on all
TWIC-holders associated with a vessel or facility, or only on the TWIC-
holders visiting the vessel or facility on a specific day.
    Several commenters proposed alternative TWIC requirements for Risk
Group B. Some suggested approaches that rely less on TWIC readers than
did the ANPRM's approach. For example, two commenters suggested
requiring only visual TWIC checks for identity verification, card
authentication, and card validation as a routine matter at MARSEC Level
1. Thus, scans using a TWIC reader would only be required once per
month at MARSEC Level 1, but would remain a standard procedure at
higher MARSEC Levels. Another commenter suggested that card validity
checks should be required on small vessels less frequently than as
proposed in the ANPRM. Two commenters opposed the ANPRM's requirement
to perform monthly scans using a TWIC reader at MARSEC Level 1.
    Other commenters suggested alternative approaches that rely more on
TWIC readers than did the ANPRM's approach. For example, several
commenters suggested that owners and operators of vessels or facilities
in Risk Group B should always be required to use TWIC readers to
perform identity verification, arguing that visual checks are less
reliable. Some of these commenters argued that unlike random monthly
scans using a TWIC reader, routine use of TWIC readers would provide
TWIC-holders the benefit of a consistent user experience.
    Based on the comments and further analysis, this NPRM does not
propose TWIC reader requirements for Risk Group B. We have estimated
the annualized cost of the TWIC reader requirements on vessels and
facilities in Risk Group A at $26.5 million, at a 7 percent discount
rate. Had we proposed TWIC reader requirements to also

include Risk Group B facilities, the annualized cost would be $141.2
million, at a 7 percent discount rate. Moreover, including Risk Group B
in the TWIC reader requirements would not only increase the annualized
cost, the average consequence figure (the monetized costs of fatalities
and injuries resulting from a TSI) drops by more than one-third. While
this does not mean that there should be no TWIC reader requirements for
Risk Group B, we believe this analysis supports our phased approach for
requiring TWIC readers first for Risk Group A.
    We also wish to emphasize the utility of TWIC in enhancing security
even when not used in conjunction with TWIC readers. Before mariners
and other individuals were required to obtain a TWIC, they could access
secure areas of MTSA-regulated vessels and facilities after presenting
a State-issued driver's license or any number of other government-
issued identification cards. This patchwork system of valid credentials
required security personnel to become familiar with the appearance and
security features of every type of acceptable credential. Moreover,
since some government-issued credentials are used for purposes other
than security, applicants are not necessarily screened from a security
threat perspective. Additionally, the eligibility criteria for some
government-issued credentials do not preclude issuance to an individual
with a felony criminal record.
    The TWIC program mitigates the above shortcomings. Since April 15,
2009, TWIC has been the single credential used throughout the maritime
sector. Accordingly, security personnel only need to become familiar
with the appearance and security features of one credential. Moreover,
unlike other government-issued credentials, TWIC is specifically
designed for transportation security. Its purpose is to ensure a vetted
maritime workforce by establishing security-related eligibility
criteria, and by requiring each TWIC-holder to undergo TSA's security
threat assessment as part of the process of applying for and obtaining
a TWIC.
    As we go forward with our phased approach to implementing TWIC
reader requirements, we will continue to evaluate the use of TWIC
readers on vessels and at facilities, and determine the need for
additional or different TWIC reader requirements. Proposing
requirements for Risk Group A only in this NPRM is indicative of our
desire to minimize highest risks first, but should not be read to
foreclose revised TWIC reader requirements in the future.
    Several commenters argued that container (cargo) facilities present
risks that actually warrant the more stringent TWIC reader requirements
of Risk Group A rather than those of Risk Group B. In response, we note
that, based on the AHP/MSRAM analysis, being a container facility alone
did not automatically cause a facility to be categorized in Risk Group
B. In addition, several factors led the Coast Guard to decide not to
require TWIC readers for most of these facilities at this time. First,
there are limits on the additional risk reduction (above and beyond the
credentialing and visual identification purposes of the TWIC itself) of
TWIC readers at container facilities. Security risk in the maritime
sector can be considered as following one of three high-level
scenarios: (1) The asset in question could be the target of an attack;
(2) the asset in question could be used as a weapon for an attack; or
(3) the asset could be used to enable or facilitate an attack
elsewhere. For container facilities, the first scenario brings low risk
given the number of personnel concentrated and exposed to an attack and
limited storage of hazardous materials. Similarly, the second scenario
brings low risk as containers bring low risk of use as a weapon.
Furthermore, the use of TWIC readers, or other access control features,
would not mitigate the threat associated with the contents of a
container. The TWIC reader serves as an additional access control
measure, but would not improve screening of cargoes for dangerous
substances or devices. The third scenario is the primary risk driver
for container facilities, with the risk of containers used to smuggle
illicit materials and/or personnel into the country. The additional
verifications provided by TWIC readers, however, would bring limited
utility to this scenario. Those individuals looking to access the
contents of the container could do so after the container exits the
secured area. As such, TWIC readers bring limited additional risk
reduction over the TWIC itself. Additionally, requiring TWIC readers at
container facilities brings significant costs, as these facilities
typically have a higher number of access points per facility (and
therefore would incur more capital costs) and higher numbers of
personnel accessing the facility. While the additional time to use the
TWIC reader to conduct a biometric match over the visual inspection is
limited on an individual basis, the high volume of workers could cause
the associated delay costs to accrue to much more significant levels
than other facility types. Given the large numbers of truck drivers
accessing these facilities, these delays would also be accompanied by
increased air emissions, resulting in greater potential for
environmental impact. Therefore, in this NPRM, only those container
facilities that are otherwise categorized in Risk Group A would be
required to use TWIC readers. We will continue to assess whether
container facilities warrant additional consideration with respect to
TWIC reader requirements. We welcome additional comments from the
public on the risk group classification of container facilities.
8. TWIC Requirements for Risk Group C
a. Risk Group C Classification
    One commenter supported the ANPRM's classification of OSVs in Risk
Group C. One commenter suggested that the passenger cutoff number for
vessels in Risk Group C should not be 500. Instead, this commenter
argued that the cutoff number should be 49 overnight passengers or 150
passengers, similar to the Coast Guard's vessel safety regulations. In
response, we reiterate that the AHP/MSRAM analysis considered factors
based on TSI consequence. These factors are different than the factors
that underpin the Coast Guard's safety regulations. The passenger
cutoff numbers derived from the AHP/MSRAM analysis are more appropriate
for defining the risk-based framework for TWIC reader requirements.
b. Risk Group C TWIC Requirements
    Many commenters agreed with the ANPRM's approach that TWIC reader
requirements would not appreciably enhance security for vessels and
facilities in Risk Group C. One commenter further argued that since
vessels and facilities in Risk Group C are so low risk, even visual
TWIC inspections would be an unnecessary burden that would confer no
security benefit. As noted above, however, several commenters took the
opposing view, broadly asserting that owners and operators of all MTSA-
regulated vessels and facilities (including those in Risk Group C)
should be required to use TWIC readers to control access to secure
areas.
    We believe that although vessels and facilities in Risk Group C
present a less likely target for individuals wishing to do harm, these
vessels and facilities still hold the potential of being involved in a
TSI and with consequences that could still be significant. A security
benefit is conferred when an owner or operator is able to confirm that
each entrant to secure areas holds a TWIC, as the TWIC serves as
evidence that the person has

successfully passed TSA's security threat assessment. Accordingly, this
NPRM proposes the same requirements as the ANPRM for Risk Group C,
which includes requirements to visually inspect TWICs before granting
unescorted access to secure areas, as is already required in the
current regulations.
    Some commenters asked whether vessels and facilities in Risk Group
C would need dedicated security guards to perform visual TWIC checks,
and what credentials these security guards would need to possess. Under
current regulations (which would not change under this NPRM) for
vessels and facilities categorized in this NPRM as Risk Group C,
security personnel must visually inspect the TWIC of each person
seeking unescorted access to secure areas. Our regulations do not
require the use of ``dedicated security guards,'' but do require that
the security personnel doing visual inspection of TWICs have certain
knowledge, training, and experience. It is important for owners,
operators, and others with security duties to be familiar with the
technologies embedded in the TWIC, particularly the features that make
the TWIC resistant to tampering and forgery. Those who would be
examining TWICs at access control points should be familiar enough with
the TWIC's physical appearance so that variations or alterations are
easily recognized. Relevant security training requirements for
personnel on vessels and at facilities are found at 33 CFR 104.210,
104.215, 104.220, 104.225, 105.205, 105.210, 105.215, 106.205, 106.210,
106.215, and 106.220.
9. Physical Placement of TWIC Readers
    Eight commenters requested clarification as to whether TWIC readers
would be required at the access points to each secure area or at the
perimeter access points to the vessel or facility. Three commenters
suggested that vessels should not be required to place TWIC readers at
every access point to a secure area. Instead, according to these
commenters, vessels required to have TWIC readers should only be
required to place them at the main access points to the vessels.
Several commenters expressed concerns that if TWIC readers are required
at the access points to each secure area on vessels, safety would be
compromised in emergency situations when crewmembers need immediate
access to those areas.
    We wish to clarify that for both vessels and facilities, the term
``secure area'' is defined as ``* * * the area * * * over which the
owner/operator has implemented security measures for access control * *
*. It does not include passenger access areas, employee access areas,
or public access areas * * *.'' \53\ For facilities, the secure area
may encompass the entire facility, or the facility may consist of a
combination of secure areas and public access areas. Similarly, for
vessels, the secure area may encompass the entire vessel, or the vessel
may consist of a combination of secure areas and passenger and employee
access areas.
---------------------------------------------------------------------------

    \53\ 33 CFR 101.105.
---------------------------------------------------------------------------

    This NPRM proposes different requirements for vessels and
facilities with respect to the placement of TWIC readers. For
facilities, this NPRM proposes to require TWIC readers at the access
points to each secure area. If the entire facility is designated as a
secure area, then TWIC readers would only be required at the access
points to the facility itself. If the secure area does not encompass
the entire facility, then TWIC readers would be required at the access
points to each secure area.
    For vessels, this NPRM proposes to require TWIC readers at the
access points to the vessel itself, regardless of whether the secure
area encompasses the entire vessel. Thus, even if the secure area does
not encompass the entire vessel (e.g., a passenger vessel consisting of
secure areas and passenger and employee access areas), TWIC readers
would only be required at the access points to the vessel itself. TWIC-
holders may be granted unescorted access to the vessel's secure areas
after the TWIC has been verified, validated, and authenticated at a
vessel access control point. TWIC-holders may then move between secure
areas and passenger and employee access areas without processing
through a TWIC reader each time. We request additional comments from
the public on the proposed regulatory provisions regarding the
placement of TWIC readers for vessels and facilities, and how to
minimize crewmembers from entering secure and/or restricted areas if
they do not hold a TWIC.
    With respect to emergency situations, we partially addressed this
issue in the TWIC 1 Final Rule, and added a paragraph to 33 CFR 101.514
clarifying that emergency personnel need not have TWICs to obtain
unescorted access to secure areas during emergencies. Moreover, this
NPRM does not propose to require TWIC readers on vessels at each access
point to a secure area. Instead, TWIC readers would only be required at
the access points to the vessel itself.
    One commenter suggested that with respect to OCS facilities, the
appropriate location for TWIC reader placement is not on the facility
itself, but, rather, at the shore-side points of embarkation for the
facility. This comment echoes a recommendation from NMSAC in the TWIC 1
NPRM,\54\ to which we responded that OCS facilities where access is
limited and can be controlled by reading the TWIC at the point of
embarkation may continue to do so. Note that this NPRM does not propose
TWIC reader requirements for any OCS facilities. Accordingly, OCS
facilities where access is limited and can be controlled by visually
inspecting the TWIC at the point of embarkation may do so.
---------------------------------------------------------------------------

    \54\ See 71 FR 29405.
---------------------------------------------------------------------------

    One commenter suggested that owners and operators of facilities
should not be required to use TWIC readers on docks and other waterside
access points. In response, we emphasize that we are not proposing a
blanket exemption from TWIC reader requirements on docks and other
waterside access points. As proposed in this NPRM, owners and operators
of facilities in Risk Group A would be required to ensure that access
to secure areas is limited to individuals whose TWICs have been scanned
by a TWIC reader.
    We also note that in the TWIC 1 Final Rule, we revised 33 CFR
105.115 to provide greater flexibility to facility owners and operators
by allowing them the option to redefine their ``secure area'' as only
that portion of their access control area that is directly related to
maritime transportation. Thus, facilities whose footprint includes
portions that are not directly related to maritime transportation can
submit an FSP for Coast Guard approval that removes those areas from
the definition of the facility's ``secure area'' for Coast Guard
regulatory purposes. Such facilities would typically include
refineries, chemical plants, factories, mills, power plants, smelting
operations, or recreational boat marinas. As discussed above, we are
also considering allowing multiple risk group designations within one
facility, to account for situations where one portion of a facility
handles dangerous cargoes and another portion does not. Owners and
operators should comply with TWIC reader requirements in a manner that
considers the specific nature of their facilities and their access
points, and they may take advantage of regulatory provisions that would
minimize the impact on operations.
10. Recurring Unescorted Access
    Numerous commenters generally supported the ANPRM's provision

regarding RUA as a means of providing relief to owners and operators
otherwise required to use TWIC readers. Many of these commenters
expressed differing opinions regarding the proposed cutoff number of
14. Six commenters stated that 14 is an appropriate cutoff number. More
than 25 commenters felt that the cutoff number should be higher. One
commenter felt that the cutoff number should be lower. Several
commenters argued that 14 is an arbitrary cutoff number, though they
offered no rationale or alternative cutoff number. Five commenters
suggested that the cutoff number should be approved by the COTP on a
case-by-case basis, considering factors such as an entity's size and
whether a vessel operates with multiple crews.
    Several commenters requested clarification regarding whether an
entity could grant RUA privileges to contractors, vendors, and other
frequent visitors.
    Approximately eight commenters opposed the ANPRM's RUA proposal,
suggesting instead that we should simply exempt all vessels with fewer
than 14 TWIC-holders on board from TWIC reader requirements. One
commenter noted that such an exemption would fall squarely within the
SAFE Port Act's provision that prohibits requiring TWIC readers on
vessels that the Secretary has determined do not have the requisite
number of TWIC-holders as crewmembers.\55\
---------------------------------------------------------------------------

    \55\ 46 U.S.C. 70105(m)(1).
---------------------------------------------------------------------------

    Two commenters argued that RUA would compromise security by
granting unescorted access to secure areas without requiring
individuals to undergo screening using a TWIC reader.
    One commenter felt the phrase ``recurring unescorted access'' could
be misinterpreted to mean that an individual may require an escort to
access a secure area, even if the individual is a TWIC-holder.
    Several commenters opposed a requirement to perform the initial
biometric scan using a TWIC reader on TWIC-holders granted RUA. Their
rationale was that TSA already performs reliable biometric identity
verification prior to the issuance of each individual's TWIC. Some
commenters also raised concerns of potential fraud that could arise if,
as suggested in the ANPRM, an owner or operator pursued an agreement
with a facility or other company to borrow or otherwise have access to
a TWIC reader in order to perform the one-time initial biometric
verification.
    One commenter felt that the proposed initial biometric scan
requirement would be appropriate. Another commenter felt that owners
and operators should be required to perform an electronic biometric
scan using a TWIC reader at the beginning of each shift for each TWIC-
holder granted RUA.
    Three commenters argued that owners and operators granting RUA
privileges should not be required to purchase a TWIC reader to perform
initial biometric scans on RUA grantees. Two commenters suggested that
an Internet-based system would provide the most practical method for
keeping track of RUA grantees.
    One commenter called attention to the fact that employee records
regarding individuals granted RUA would be kept by the employer, not
the Coast Guard or TSA.
    After considering the comments and further analysis discussed below
in Section IV., ``Section-by-Section Description of Proposed Rule,'' we
have removed from this NPRM the RUA provisions proposed in the ANPRM.
RUA was previously proposed to introduce flexibility and provide relief
to vessels otherwise required to use TWIC readers, based on the
familiarity that exists between a relatively small number of
crewmembers. This NPRM incorporates two important proposals, however,
that render RUA an unnecessary provision. First, unlike the ANPRM,
which proposed TWIC reader requirements for Risk Groups A and B, this
NPRM proposes TWIC reader requirements for Risk Group A only. Second,
this NPRM proposes a broad exemption from TWIC reader requirements for
all vessels with 14 or fewer TWIC-holding crewmembers. This exemption
is based on the SAFE Port Act's provision that prohibits requiring TWIC
readers on vessels that the Secretary has determined do not have the
requisite number of TWIC-holders as crewmembers.\56\ These two changes
render the need for RUA as a mechanism for regulatory relief
unnecessary.
---------------------------------------------------------------------------

    \56\ 46 U.S.C. 70105(m)(1).
---------------------------------------------------------------------------

11. TWIC Reader Durability, Safety, Approval, Calibration, and
Compliance
    Four commenters expressed concerns that harsh weather and other
physical stresses on vessels and at facilities would likely cause TWIC
readers to fail or otherwise become damaged. One commenter countered
that TWIC readers have already been subjected to environmental testing,
and have proven to function well in the marine environment.
    The TWIC Pilot found that at varying locations, some TWIC readers
experienced difficulty scanning fingerprints in inclement weather.
Certain types of TWIC readers withstood harsh weather conditions,
whereas others were found to be sensitive to those conditions.
Throughout the TWIC Pilot, the conditions under which TWIC readers had
to perform were significantly more challenging than those commonly
found at entrances to office buildings and other more controlled
locations and environments. The TWIC Pilot, however, noted that most of
the challenges associated with weather can be overcome with proper
planning that takes environmental conditions into consideration.\57\
---------------------------------------------------------------------------

    \57\ See page vii of the TWIC Pilot Report. (A copy of the TWIC
Pilot Report is available for viewing in the public docket for this
rulemaking.)
---------------------------------------------------------------------------

    One commenter requested that we consider the safety concerns of
using TWIC readers in areas where flammable materials are stored or
transferred. We agree that safety concerns are of the utmost
importance, and expect that owners and operators who carry or handle
flammable materials would comply with applicable TWIC reader
requirements in a manner that does not compromise safety.
    One commenter stated that TWIC readers must be able to process
biometric scans in 3 seconds or less in order to minimize the impact of
TWIC reader requirements at facilities with large numbers of entrants.
Several commenters stated that we should establish a minimum standard
for errors in connection with TWIC reader technology. We have passed
these comments to TSA for consideration in future planning. TSA has
established the TWIC reader specifications and Qualified Technology
List process (described later in this section) to validate that TWIC
readers meet the specifications. In addition, TSA is conducting a card
error/failure analysis to identify and address TWIC reader and card
failures. There is additional information on TWIC reader throughput in
the TWIC Pilot report, which is available in the public docket for this
rulemaking.
    As discussed in the ANPRM, TWIC readers are considered ``security
systems and equipment,'' and therefore, existing regulatory provisions
applicable to security systems and equipment maintenance would require
that TWIC readers be inspected, tested, calibrated, and maintained in
accordance with the manufacturers'

recommendations.\58\ Additionally, records of such actions would be
required to be maintained for at least 2 years and made available to
the Coast Guard upon request.\59\ The ANPRM sought public comment on
whether TWIC readers should also be subject to additional Coast Guard
inspections and/or third party audits to further ensure that TWIC
readers are maintained in proper working order.
---------------------------------------------------------------------------

    \58\ See 33 CFR 104.260 and 105.250.
    \59\ See 33 CFR 104.235 and 105.225.
---------------------------------------------------------------------------

    Two commenters favored both additional Coast Guard inspections and
third-party audits to check that TWIC readers are maintained in proper
working order. Ten commenters opposed third-party audits, and suggested
that the Coast Guard should conduct compliance inspections. Six
commenters favored neither Coast Guard inspections nor third-party
audits, arguing that owners and operators are already required to
maintain security equipment maintenance logs, which can be reviewed by
the Coast Guard to make compliance determinations. We note that 33 CFR
104.260 and 105.250 already require security systems (which would
include TWIC readers) to be in good working order and inspected,
tested, calibrated, and maintained according to the manufacturer's
recommendation. These existing regulatory provisions also require
owners and operators to maintain records of the results of such testing
for 2 years. Additionally, Coast Guard field inspectors would inspect
TWIC reader functionality as part of regularly occurring inspections.
We agree with the majority of commenters above that appreciable value
would not be added by requiring additional Coast Guard inspections and/
or third party audits beyond the existing provisions on security
systems and equipment maintenance. Therefore, this NPRM does not
propose additional Coast Guard inspections and/or third party audits.
    One commenter generally requested guidance regarding how owners and
operators may voluntarily use TWIC readers before we publish a TWIC
reader final rule. On March 15, 2011, we published a notice announcing
the availability of Policy Advisory Council Decision (PAC-D) 01-11,
``Voluntary Use of TWIC Readers,'' \60\ providing guidance on how
owners and operators may use TWIC readers to meet existing regulatory
requirements. Navigation and Vessel Inspection Circular (NVIC) 03-07
\61\ provides additional guidance to the public on this issue.
---------------------------------------------------------------------------

    \60\ Policy Advisory Council Decision 01-11, ``Voluntary Use of
TWIC Readers,'' available for viewing at https://homeport.uscg.mil/.
    \61\ See Navigation and Vessel Inspection Circular (NVIC) No.
03-07, ``Guidance for the Implementation of the Transportation
Worker Identification Credential (TWIC) Program in the Maritime
Sector,'' (July 2, 2007).
---------------------------------------------------------------------------

    Five commenters requested that we immediately publish a list of
TWIC reader specifications, or a list of acceptable TWIC reader
vendors, so that owners and operators wishing to use Federal grant
money to purchase equipment can do so before we publish a TWIC reader
final rule. Another commenter cautioned that such an approach may not
be advisable because TWIC reader technology is still evolving.
    PAC-D 01-11 provides guidance on how owners and operators of
vessels or facilities can use TWIC readers to meet existing regulatory
requirements for effective identity verification, card validity, and
card authentication. A list of TWIC readers that have passed the
Initial Capability Evaluation (ICE) Test is available at http://www.tsa.gov/assets/pdf/twic_ice_list.pdf. As stated in PAC-D 01-11,
however, TWIC readers allowed pursuant to PAC-D 01-11 may no longer be
valid after promulgation of a TWIC reader final rule, and DHS will not
fund replacement TWIC readers.
    The Department of Commerce's National Institute of Standards and
Technology (NIST) and TSA are developing TWIC reader specifications.
TSA will establish a process to qualify TWIC readers, and will maintain
a Qualified Technology List (QTL) of acceptable TWIC readers. We
anticipate that there may be changes from the ICE Test list to the QTL
list, based on final TWIC reader specifications resulting from the QTL
process.
12. TWIC Pilot and HSI Report
    Seven commenters expressed confidence that the TWIC Pilot would
yield important information that should inform this NPRM, including
information regarding TWIC reader error rates, transaction times,
durability in extreme weather conditions, and TWIC integration with an
existing PACS. Two commenters requested that the TWIC Pilot include
additional ports. The Merchant Marine Personnel Advisory Committee
(MERPAC) recommended that the TWIC Pilot should include a sufficient
number of vessels in appropriately diverse operating areas to test TWIC
reader technology, operating conditions, and procedures.
    TSA completed data collection for the TWIC Pilot on May 31, 2011.
The TWIC Pilot gathered data from pilot sites regarding TWIC reader
performance and reliability as well as throughput data at vehicle and
pedestrian access points, which was instrumental in evaluating the
impact of TWIC reader use on vessel and facility operations. Although
the SAFE Port Act required the pilot program to take place at not fewer
than five distinct geographic locations, the program actually took
place in seven geographic locations to allow for the evaluation of TWIC
reader functionality and impacts across a variety of environmental and
operational conditions. The TWIC Pilot report provides a list of the
TWIC Pilot participants.
    Two commenters urged us to consider the final HSI Report in
crafting the NPRM. We acknowledge that the HSI Report has provided
useful insights and information that have informed the proposals in
this NPRM.
    A summary of both the TWIC Pilot and HSI Report recommendations are
provided below in Sections III.F. ``TWIC Reader Pilot Program'' and
III.G., ``HSI Report,'' respectively. A copy of the TWIC Pilot Report
is available for viewing in the public docket for this rulemaking. A
non-SSI version of the HSI Report is available for viewing in the
public docket for this rulemaking.
13. Security Plan Amendment
    Two commenters requested that the revisions to security plans
resulting from this NPRM should be as minimal as possible. We believe
the proposals in this NPRM are consistent with that request.
    Six commenters generally supported the ANPRM's proposal to require
amendments to security plans within 6 months after we publish a final
TWIC reader rule. Three commenters felt that the ANPRM's proposed
deadline of 6 months is too short. One commenter requested a 9-month
deadline. Five commenters requested at least a 1-year deadline. One
commenter suggested staggered deadlines of 24 months, 18 months, and 12
months for Risk Groups A, B, and C, respectively. Six commenters
requested staggered deadlines based on the expiration dates of existing
security plans. Two commenters suggested that each security plan
amendment deadline should be determined on a case-by-case basis.
Another commenter suggested that requirements to amend security plans
should apply once we have classified each vessel and facility into its
risk group.
    In light of the comments and further analysis, this NPRM would
extend the proposed deadline for security plan updates. Owners and
operators would

be required to amend security plans to include TWIC requirements within
2 years after publication of the final rule in the Federal Register.
    One commenter suggested that amended security plans should be
reviewed by the Coast Guard before owners and operators are required to
invest resources into TWIC-related expenditures. We encourage owners
and operators to work with the Coast Guard, as needed, to prepare
security plans that comply with regulatory requirements. We do not
believe, however, that it is necessary to create a formal coordination
process in which the Coast Guard would review amended security plans
separate from what already exists.
14. Recordkeeping
    The ANPRM proposed a requirement on owners and operators using TWIC
readers to maintain records on each individual granted unescorted
access to a secure area. Owners and operators would be required to
maintain such records for a period of 2 years. Five commenters argued
that owners and operators should not be required to check the TWICs of
individuals leaving a vessel or facility. This is consistent with the
ANPRM's approach, and we propose it in this NPRM as well.
    One commenter considered the ANPRM's proposed 2-year record
retention requirement to be reasonable. Other commenters believed 2
years is longer than necessary for record retention, and suggested
alternative durations ranging from 30 days to 1 year. Fifteen
commenters opposed a 2-year record retention requirement altogether,
arguing that the costs would outweigh the benefits to law enforcement.
One commenter opposed recordkeeping requirements for Risk Group C.
    We believe TWIC reader records can prove useful to law enforcement
without imposing an undue burden on the regulated population. The 2-
year timeframe for record retention was designed, in part, for
consistency with existing security-related and other recordkeeping
requirements applicable to vessels and facilities.\62\ A uniform
timeframe for recordkeeping requirements provides the public with a
consistent and predictable standard.
---------------------------------------------------------------------------

    \62\ 33 CFR 104.235; 33 CFR 105.225.
---------------------------------------------------------------------------

    Two commenters stated that MTSA does not require the Secretary to
impose recordkeeping requirements. We agree with this comment. With
respect to TWIC, MTSA requires the Secretary to prescribe regulations
to prevent an individual from entering secure areas of vessels and
facilities unless the individual is so authorized and either possesses
a TWIC or is escorted by someone who possesses a TWIC.\63\ Thus, while
MTSA does not specifically require the Secretary to impose
recordkeeping requirements, such requirements are within the
Secretary's authority, and they are an important part of the set of
regulations designed to prevent unauthorized access to the secure areas
of the nation's transportation system. For example, in the event of a
TSI or a security breach, records would be available to the Coast Guard
and other law enforcement to enable them to determine who had accessed
the vessel or facility.
---------------------------------------------------------------------------

    \63\ 46 U.S.C. 70105(a).
---------------------------------------------------------------------------

    Two commenters requested that we prescribe more detailed
recordkeeping requirements. In contrast, one commenter requested that
we allow individual regulated parties to determine the best method and
manner of complying with the recordkeeping requirements. We agree with
the latter commenter's more flexible approach.
    One commenter acknowledged that TWIC-related records could be
useful to law enforcement, but argued that records should only be
shared with law enforcement on a need-to-know basis. Another commenter
suggested that records should only be kept to the extent they provide a
homeland security-related benefit. We believe that TWIC reader
recordkeeping requirements would prove beneficial to law enforcement in
any number of investigations. Accordingly, this NPRM does not propose
restrictions on how law enforcement may use those records.
    One commenter questioned whether portable TWIC readers have the
capability to retain records for 2 years. In response to this question,
we wish to clarify that this NPRM would not require records to be
stored specifically in TWIC readers. Logs from TWIC readers may be
maintained on the TWIC readers themselves or exported to other systems.
As stated above, we are not prescribing the specific method and manner
of complying with the proposed recordkeeping requirements.
    Four commenters expressed concerns regarding the privacy of
personal information stored in TWIC readers. Some commenters
highlighted concerns with respect to foreign-owned vessels and vessels
traveling in foreign waters where equipment may be subject to seizure
by foreign authorities. One commenter suggested that the personal
information stored in a TWIC reader should be classified as SSI, which
would trigger the compliance protections in 49 CFR part 1520.
    We believe that information collected by a TWIC reader needs to be
protected. We wish to clarify that the TWIC requirements found in 33
CFR part 104 do not apply to foreign vessels.\64\ We also wish to
clarify that TWIC readers typically do not capture or record the name
of the TWIC-holder. A TWIC reader only captures the TWIC-holder's name
if it is a contact TWIC-reader (i.e., one that requires the TWIC-holder
to insert the TWIC into a slot for direct contact between the TWIC
reader and the chip embedded in the TWIC) and only after the TWIC-
holder has entered the PIN. This NPRM does not propose to require
owners and operators to specifically use contact TWIC readers, nor does
this NPRM propose any PIN requirement. Therefore, a TWIC reader will
typically capture three pieces of information when an individual's TWIC
is scanned: (1) FASC--N; (2) date; and (3) time. As explained above, a
contact TWIC reader will also capture name information after the PIN
has been entered. A PACS may also capture the name of the TWIC-holder.
We consider a TWIC-holder's name and FASC-N to be SSI under 49 CFR
15.5. Therefore, if that information is captured by a TWIC reader, the
information would need to be protected in accordance with 49 CFR Part
15, which imposes duties on ``certain covered'' persons to protect
SSI.\65\ ``Covered persons'' include, among others: (1) Each owner,
charterer, or operator of a vessel, including foreign vessel owners,
charterers, and operators, required to have a security plan under
Federal or International law; (2) each owner or operator of a maritime
facility required to have a security plan under MTSA and each person
who has access to SSI, as specified in 49 CFR 15.11.\66\ Furthermore,
the International Ship and Port Facility Security Code requires a
vessel's security plan and applicable security records to be protected
from unauthorized access or disclosure.\67\ SSI information collected
by a TWIC reader falls under that requirement.
---------------------------------------------------------------------------

    \64\ See 33 CFR 104.105(d).
    \65\ See 49 CFR 15.7.
    \66\ See 49 CFR 15.7.
    \67\ See International Ship and Port Facility Code, Part A,
adopted on December 12, 2002, Sections 9.7, 9.8 and 10.4.
---------------------------------------------------------------------------

    One commenter supported the ANPRM's proposed requirement that
owners and operators explain how they are protecting personal identity
information stored in a separate PACS. Two commenters questioned
whether MTSA grants the Coast Guard authority to impose such a
requirement.
    To the extent that a PACS contains personal identity and biometric

information, it contains SSI, which must be protected in accordance
with 49 CFR part 15. The Coast Guard, through delegation from the
Secretary, has the authority to impose such recordkeeping requirements.
Section 70124 of Title 46 U.S.C. authorizes the Secretary to issue
regulations necessary to implement provisions of chapter 701 of Title
46 U.S.C, and 46 U.S.C. 70103(c)(4) subjects all security plans to
review by the Secretary. Additionally, 46 U.S.C. 71013(c)(4)(D)
requires the periodic verification of the effectiveness of an FSP.
Recordkeeping requirements are authorized under those statutory
provisions.
15. Other Comments
    Seven commenters requested additional public meetings and greater
coordination between the Coast Guard and affected industries as the
TWIC program is implemented. Two commenters requested greater labor
union input regarding the employee information collected and stored in
the TWIC. One commenter requested greater Coast Guard collaboration
with Congress, authorities from affected States, and Coast Guard
advisory committees during the rulemaking process.
    We will hold at least one public meeting in connection with this
rulemaking and we are considering holding additional public meetings in
connection with this rulemaking. The details of any future public
meeting will be published in a separate notice in the Federal Register.
We welcome the participation and comments of all interested parties.
    Three commenters suggested that TWIC reader requirements should be
tailored to enable integration with an existing PACS, since some owners
and operators have invested substantial resources into existing
systems. We agree with these commenters. In fact, data from the TWIC
Pilot demonstrated that those pilot participants where TWIC readers
were certified for operation with an existing PACS encountered fewer
integration and operational and technical issues than other pilot
participant systems. Accordingly, this NPRM proposes options for
vessels and facilities to either use a stand-alone TWIC reader or to
integrate TWIC into an existing PACS.
    Two commenters requested additional information regarding the
ANPRM's reference to alternate biometrics that may be used in
connection with TWIC. This NPRM continues to propose two alternatives
for biometric matching. Owners and operators may: (1) Use a TWIC reader
to match the TWIC-holder's fingerprint to one of the fingerprint
templates stored in the TWIC; or (2) use a PACS to match the TWIC-
holder's biometric to the biometric stored in a PACS. For the latter
option, owners and operators may use a different biometric than the
fingerprint, such as an iris scan or hand geometry, stored in a PACS to
be matched to the individual seeking access to secure areas. Since the
implementation of the latter option would be unique to each vessel or
facility, it would be impractical for us to propose a single set of
prescriptive regulations for each owner and operator to follow.
Instead, owners and operators would explain in their security plans the
details of how their use of alternate biometrics performs the required
access control functions.
    Two commenters suggested that TWIC functionality should be enhanced
to include other biometrics in addition to fingerprints. We believe
that to enhance the features on the TWIC so that it includes other
biometrics in addition to fingerprints would increase the costs
associated with the TWIC program. We do not currently have data to show
that the benefits of such an enhancement would justify those additional
costs. Furthermore, the only standard for a biometric that the Federal
government has published to date is the fingerprint biometric.\68\
---------------------------------------------------------------------------

    \68\ See National Institute of Standards and Technology (NIST)
Special Publication 800-76-1, ``Biometric Data Specification for
Personal Identity Verification,'' (January 2007), available at
http://csrc.nist.gov/publications/nistpubs/800-76-1/SP800-76-1_012407.pdf.
---------------------------------------------------------------------------

    One commenter suggested that the final TWIC reader rule should
become effective only after a period of 24-36 months to enable owners
and operators to adequately train employees and test their TWIC
readers. We acknowledge that a period for TWIC reader training and
testing is warranted. This NPRM proposes an effective date for
compliance within 2 years after publication of a TWIC reader final rule
in the Federal Register.
    One commenter requested confirmation that the regulations are
imposing minimum requirements, and that owners and operators be given
discretion to implement higher standards. While we have sought to
minimize costs in this rulemaking, owners and operators may impose
security provisions that exceed the minimum regulatory requirements.
    Three commenters suggested that vessels operating outside U.S.
waters should not be required to use TWIC readers, citing concerns
about disruptions at foreign ports due to the inability of foreign
workers to access these vessels. We disagree with these comments and do
not propose an exemption from TWIC reader requirements for vessels
operating outside U.S. waters. Under existing regulation, all persons
requiring unescorted access to secure areas of a MTSA-regulated vessel
must possess a TWIC, regardless of whether the vessel is located in
U.S. waters.\69\ For any individual without a TWIC to access secure
areas of a MTSA-regulated vessel, the individual must be authorized to
be there and also be escorted by a TWIC-holder.
---------------------------------------------------------------------------

    \69\ See 33 CFR 101.514.
---------------------------------------------------------------------------

    One commenter asked whether a non-U.S. citizen is eligible to
obtain a TWIC. A list of certain non-U.S. citizens that are eligible to
obtain a TWIC is available on TSA's Web site at http://www.tsa.gov/sites/default/files/publications/pdf/twic/immigration_status_documents.pdf.
    Some commenters requested additional guidance for situations when
TWIC readers or communication systems malfunction. In this NPRM, we
propose that, in the event of a TWIC reader malfunction, individuals
can still be granted unescorted access to secure areas for a period not
to exceed 7 days, provided that the individual has been granted such
unescorted access in the past and is known to possess a TWIC. Owners
and operators expecting such occurrences should provide appropriate
contingency planning in their security plans. We request comments from
the public regarding whether 7 days is a sufficient amount of time in
which to expect resolution of a typical TWIC reader or communication
systems malfunction.
    Four commenters requested further guidance with respect to how
owners and operators would be required to process TWIC-holders with
poor quality or no fingerprints. In such instances, we expect that the
owner or operator would describe in their security plan the exception
process they plan to use. The exception process may include PIN
verification, alternative biometric verification, visual comparison of
the digital photo stored in the TWIC to the presenter using a portable
reader with a contact interface and releasing the photo to the reader
screen by entering the 6-, 7-, or 8-digit PIN, or an alternative
process proposed by the owner or operator and approved by the Coast
Guard.
    Three commenters argued that TWIC reader requirements at rail
entrances to facilities would be impractical. These

commenters cited throughput delays, increased traffic, environmental
concerns with increased emissions, costs of TWIC readers at seldom-used
rail entrances, and security risks when rail workers leave their
cargoes unattended to walk to the nearest TWIC reader.
    We note that facilities could provide TWIC-holding escorts to rail
workers, which is one way to alleviate these concerns. We also note
that current regulations already require visual inspection of TWICs at
rail entrances to secure areas of regulated facilities. The TWIC Pilot
found that the increase in throughput delay resulting from a TWIC
reader requirement is 2 seconds. Therefore, we do not believe a TWIC
reader requirement at rail entrances to secure areas of Risk Group A
facilities would lead to the results suggested by the commenters. While
we seek to minimize the burdens associated with TWIC reader
requirements, an exemption from such requirements at rail entrances
would be inconsistent with the goal of the TWIC program to ensure that
access to secure areas of the transportation system is limited to
authorized individuals holding a TWIC.
    One commenter suggested that TWIC-holders on all MTSA-regulated
vessels and facilities should be required to visually display their
TWICs, similar to the requirement at federally regulated airports.
Another commenter opposed such a requirement, citing concerns that this
practice might increase the number of lost TWICs.
    In keeping with the longstanding tradition that seafarers keep
their mariner credentials and other important documents on the bridge
or stored in a secure place, this NPRM does not propose to require
TWIC-holders to display their credentials at all times. Existing Coast
Guard guidance acknowledges that such a requirement may not be
practical in the marine environment.\70\ Owners and operators are
permitted to collect and store all crewmember TWICs in the vessel's
pilot house or allow for TWICs to be stored in another secure location
on board the vessel or at the facility.
---------------------------------------------------------------------------

    \70\ See Navigation and Vessel Inspection Circular (NVIC) No.
03-07, ``Guidance for the Implementation of the Transportation
Worker Identification Credential (TWIC) Program in the Maritime
Sector,'' (July 2, 2007).
---------------------------------------------------------------------------

F. TWIC Reader Pilot Program

    This section discusses the background and findings of DHS's TWIC
Pilot on TWIC reader functionality in the maritime sector. A copy of
the TWIC Pilot report, as well as the GAO reports discussed below, are
available for viewing in the public docket for this rulemaking. The
Coast Guard seeks comments on the following characterizations of the
TWIC Pilot, the Coast Guard's conclusions from the TWIC Pilot, and how
the Coast Guard used the findings from the TWIC Pilot to inform the
NPRM.
1. Background
    The TWIC Pilot was established under Section 104 of the SAFE Port
Act, and was designed to evaluate the business processes, technology,
and operational impacts of implementing a TWIC reader system. The SAFE
Port Act required the Secretary to conduct the TWIC Pilot at not fewer
than five distinct geographic locations, and include vessels and
facilities in a variety of environmental settings.\71\ DHS conducted
the TWIC Pilot in seven geographic locations, and covered five
participant groups: (1) Container terminals; (2) large passenger
vessels and terminals with more than 500 passengers; (3) break-bulk
terminals; (4) petroleum facilities; and (5) small passenger vessels,
towboats, and other facility types. DHS managed the TWIC Pilot through
the joint participation of TSA and the Coast Guard, with grant funding
provided by the Federal Emergency Management Administration through the
Port Security Grant Program.
---------------------------------------------------------------------------

    \71\ 46 U.S.C. 70105(k)(1)(B).
---------------------------------------------------------------------------

    The TWIC Pilot consisted of three phases. In Phase 1 (Initial
Technical Testing), DHS tested TWIC readers under controlled laboratory
conditions to verify that the TWIC readers correctly processed
biometric information from the TWIC, and could also perform other TWIC
verification and validation operations in maritime environments.
    In Phase 2 (Early Operational Assessment) DHS required pilot
participants to install TWIC readers and begin using them. This phase
allowed both TWIC-holders and security personnel to become familiar
with TWIC readers and different operational modes. It also provided an
opportunity to evaluate the initial technical performance of TWIC
readers in maritime settings, and to address problems.
    Phase 3 (System Test and Evaluation) required pilot participants to
verify the identities of individuals granted unescorted access to
secure areas based on potential requirements as set forth in the ANPRM.
Data collected during Phase 3 included: (1) Impacts of the biometric
verification process on vessel and facility operations; (2) measurement
of wait times for access to secure areas; (3) TWIC reader and
infrastructure failures and maintenance requirements; and (4)
implementation and operating costs.
    TSA completed data collection for the TWIC Pilot as of May 31,
2011. The SAFE Port Act required the Secretary to `` * * * submit a
comprehensive report to the appropriate congressional committees * * *
that includes: (A) The findings of the pilot program with respect to
technical and operational impacts of implementing a transportation
security card reader system; (B) any actions that may be necessary to
ensure that all vessels and facilities * * * are able to comply with
[TWIC reader] regulations; and (C) an analysis of the viability of
equipment under the extreme weather conditions of the marine
environment.'' DHS submitted the TWIC Pilot report to Congress on
February 27, 2012.
2. General Findings
    The TWIC Pilot noted a number of benefits associated with the use
of TWIC readers. First, when used properly, TWIC readers provide an
additional layer of security by reducing the risk that an unauthorized
individual could gain access to a secure area. Owners and operators
using TWIC readers can achieve this security risk reduction without
significantly increasing throughput times at access points. Second,
security is further enhanced by enabling owners and operators to assign
access privileges to a specific, limited population of TWIC-holders.
Finally, vessels and facilities using the TWIC as a site access token,
in addition to as a means of identification, may benefit financially
through the reduction of card management operational costs associated
with identity vetting, card inventory, printing equipment, and issuance
infrastructure.
    The TWIC Pilot also elicited a number of operational challenges and
lessons learned. Although the TWIC Pilot provided the most complete
information available regarding the costs associated with large-scale
TWIC reader implementation and integration for access control
available, we note some limitations regarding the TWIC Pilot data. We
were not able to obtain data from a statistically representative sample
of the affected population of MTSA-regulated vessels and facilities
affected by this proposed rule because the TWIC Pilot was a voluntary
program. As such, it was necessary to extrapolate the findings of the
TWIC Pilot across the entire affected population. There were also some
variations as to how individual pilot participants reported their data
to TSA, which made some data manipulations

more difficult. Also, some of the cost reporting included costs that
were not directly related to TWIC readers, but rather general physical
security, and these were included in the pilot participants' cost
estimates.
    Additionally, while not all of the TWIC Pilot participants were in
Risk Group A, using the costs associated with TWIC reader deployment at
facilities not in Risk Group A does not adversely affect our overall
estimates. Potential TWIC reader implementation costs should not differ
greatly across risk groups, as the size and geography of a facility is
independent of its risk grouping. The key difference between the risk
groups is the potential consequences of a TSI at a particular facility,
not the costs associated with potential TWIC reader deployment.
    Since the passage of MTSA in 2002, the United States Government
Accountability Office (GAO) has published a number of reports regarding
implementation of the TWIC program, highlighting both progress and
limitations. Copies of these reports are available for viewing on the
GAO Web site at www.gao.gov, by clicking on the ``Reports &
Testimonies'' tab, and using ``TWIC'' as your keyword search term, as
well as in the docket. The GAO has conducted a review of the TWIC
Pilot, highlighting some of the same limitations with respect to the
quality of TWIC Pilot data we have described above. While we
acknowledge that the TWIC Pilot contained certain data limitations, the
TWIC Pilot provided the most detailed and wide-spread assessment of the
impacts of deploying TWIC readers in the maritime sector to date. The
TWIC Pilot provided useful data with respect to the costs associated
with installing and integrating TWIC readers at facilities, as well as
valuable TWIC-holder population data and TWIC reader failure rates, as
experienced during the TWIC Pilot. As discussed below in Section III.H.
``Additional Data Sources,'' we supplemented TWIC Pilot data with other
data sources as necessary to provide the most accurate estimates for
cost and benefit possible. In accordance with 46 U.S.C. 70105(k)(3),
the proposals in this NPRM are consistent with the findings of the TWIC
Pilot.
    The TWIC Pilot generally found that when TWIC readers are designed,
installed, and operated in a manner consistent with the business
considerations of the vessel or facility, they function properly.
Conversely, the TWIC Pilot also noted a number of operational and
technological difficulties that affected overall success at many pilot
locations. The proposals in this NPRM are designed to be consistent
with the findings of the TWIC Pilot.
3. Specific Challenges and Lessons Learned
    The TWIC Pilot noted that processing delays at access points were
sometimes compounded by user unfamiliarity with the TWIC authentication
process. It is important to note that when a user is properly trained
and acclimated to interface with the TWIC reader, transaction times
decrease considerably. In this NPRM, we have included a 2-year
compliance deadline for TWIC reader implementation to allow adequate
time for proper training.
    The TWIC Pilot noted that training requirements were often
underestimated by TWIC Pilot participants. Additionally, TWIC-holders
experienced challenges becoming familiar with different TWIC reader
modes and processes. Switching among different TWIC reader modes
complicated the learning process, impacting the efficiency of TWIC
reader use. Additionally, TWIC-holders had difficulty interfacing with
TWIC readers from multiple manufacturers with differing designs and
user interfaces. Finally, some TWIC-holders presented the wrong finger,
or did not hold their finger on the fingerprint sensor long enough to
complete the transaction. These occurrences impeded operations and
increased throughput times. In this NPRM, we have included a 2-year
compliance deadline for TWIC reader implementation to allow adequate
time for proper training.
    The TWIC Pilot noted certain challenges that arose when using
portable TWIC readers. At facilities where workers are required to
enter and exit secure areas multiple times over short periods, it was
particularly challenging to maintain biometric checks using portable
readers. Additionally, some portable TWIC readers malfunctioned when
used carelessly in wet conditions not aligned with vendor guidance. In
this NPRM, we do not specifically require the use of portable TWIC
readers. Instead, we take a flexible approach by allowing owners and
operators to choose the type of TWIC readers that best suit their
operational needs.
    The TWIC Pilot noted that while some TWIC readers performed well
throughout the TWIC Pilot, others were not as mature technologically or
required adjustments. In one case, the TWIC readers repeatedly failed
and had to be replaced by another vendor. We expect these challenges to
be mitigated in the future because TSA is developing the QTL so that
approved readers meet durability standards.
    The TWIC Pilot noted that the ability of TWIC readers to work
properly depends, in part, on a functioning TWIC card. In response, TSA
established an Integrated Product Team (IPT) in conjunction with DHS
that is continuing to review the nature and prevalence of non-
functioning TWIC cards and seeking ways to resolve these technical
issues.
    The TWIC Pilot noted TWIC reader installation delays at some
facilities where TWIC systems integrators were unfamiliar with other
components of multi-functional systems. In this NPRM, we have included
a 2-year compliance deadline for TWIC reader implementation to allow
facilities and security personnel adequate time for proper training.
    The TWIC Pilot noted challenges with respect to the registration of
authorized TWIC-holders in a PACS. The registration process proved to
be time-consuming. Some TWIC Pilot participants that were located
within the same geographical region chose to operate using a regional
registration database. This was a successful way to populate their
various PACS. One factor that led to delays was the decision by some
facilities to require TWIC-holders to enter their PIN as part of the
registration process. Since many TWIC-holders rarely, if ever, used
their PIN since activating their TWIC, some workers could not remember
their PIN. These workers then had to visit a TWIC enrollment center to
reset their PIN and return to the facility to complete the registration
process. This NPRM does not propose to require facilities to register
authorized TWIC-holders by requiring them to enter their PIN.
    The TWIC Pilot noted that some participants failed to grant TWIC-
holder rights to specific access points, which increased the number of
invalid transactions using TWIC readers. Developing standard operating
procedures to assign access privileges should mitigate this issue.
    The TWIC Pilot noted that TWIC reader system architecture played a
significant role in overall technical efficiency, performance, and
throughput times. The TWIC Pilot participant with a dedicated network
only used by TWIC readers and PACS showed faster transaction times,
higher validation rates, and fewer technical issues than other TWIC
Pilot participants. System configurations that used hard wired networks
were more efficient with respect to network speed and availability than
wireless networks. Systems that included TWIC readers

within the security architecture encountered fewer operational issues.
Finally, TWIC reader implementation costs were lower if facilities were
able to use existing infrastructure. We encourage the regulated
population to take note of these lessons learned. Additionally, in this
NPRM, we take a flexible approach by allowing owners and operators to
choose the type of TWIC readers that best suit their operational needs.
    The TWIC Pilot found that a consistent experience on the part of
TWIC-holders and security personnel enhanced the efficiency of TWIC
reader use. TWIC-holders who reported to the same facility on a daily
basis had a consistent user experience and learned to interface with
TWIC readers quickly. TWIC-holders whose work required them to access
multiple facilities, however, experienced challenges becoming familiar
with TWIC readers from several manufacturers with different designs and
interfaces, as well as many site-specific business processes and
requirements. Different TWIC reader ergonomics found at different
access points further compounded these challenges. For example, truck
drivers visiting several facilities encountered TWIC readers that were
sometimes placed at awkward heights or distances, making the readers
difficult to reach.
    The TWIC Pilot tested both fixed and portable TWIC readers in
different modes of operation. In contactless mode, the card is scanned
by holding it within 4 inches of the TWIC reader. In contact mode, the
card must be inserted into a slot that allows direct contact between
the TWIC reader and the chip embedded in the TWIC. The TWIC Pilot found
that when contactless TWIC readers are used in a non-biometric mode to
verify that the card is authentic, has not expired, and is not on the
CCL, and in a manner consistent with their intended environment, access
point throughput times were less than throughput times required to
visually inspect TWICs. When used in non-biometric mode, however, it is
also necessary to visually compare the photograph on the TWIC to the
TWIC-holder. Although adding a biometric match to the above TWIC reader
functions may take slightly longer than mere visual inspection, the
TWIC Pilot did not find that the resulting access point throughput
delays impacted business operations. Nonetheless, using TWIC readers in
the biometric mode significantly increases the assurance that only
TWIC-holders are permitted to access secure areas.
    The TWIC Pilot also found that fixed readers with both contact and
contactless interfaces yielded a higher validation rate than fixed
readers that only used the contactless interface to read the TWIC. A
contact read required the TWIC to be inserted into the contact slot of
the TWIC reader, which reduced the potential for incorrectly placing
the TWIC, and provided an alternative to the TWIC's internal antennae.
    A successful contactless read requires the user to hold the card
motionless on or near the surface of the TWIC reader for approximately
2 seconds, which was not initially understood by many pilot
participants. As a remedial measure, the posting of explanatory
diagrams helped overcome this problem. The TWIC Pilot found that
switching between different TWIC reader modes created a confusing
process for TWIC-holders and had a negative impact on the efficiency of
TWIC reader use.
    Accordingly, the proposals in this NPRM enable owners and operators
to use fixed or portable, contact or contactless TWIC readers in a
single mode of operation as much as possible. Each owner or operator
would have the discretion to configure a system that best suits the
vessel or facility.
    The TWIC Pilot found that facilities with an existing PACS that
could be easily adapted to incorporate TWIC reader technology took less
time to install than facilities without that existing infrastructure.
Consistent with that finding, this NPRM allows for the integration of
TWIC reader technology into an existing PACS.
    The TWIC Pilot found that geographic location did not affect the
efficiency of TWIC reader functionality. The TWIC Pilot found, however,
that at varying locations, some TWIC readers experienced difficulty
scanning fingerprints in inclement weather. Fully encapsulated fixed
contactless TWIC readers withstood harsh weather, whereas contact TWIC
readers, and TWIC readers exposed to the elements were sensitive to
inclement weather conditions. Throughout the TWIC Pilot, the conditions
under which TWIC readers had to perform were significantly more
challenging than those commonly found at entrances to office buildings
and other more controlled locations and environments. The TWIC Pilot
demonstrated that TWIC readers installed in harsh environments will
occasionally be contaminated with debris, and a maintenance program to
perform regular inspections and cleaning cycles is necessary. The TWIC
Pilot noted, however, that most of the challenges associated with
weather can be overcome with proper planning that takes environmental
conditions into consideration. Proper planning means that a facility's
business practices will be useful in determining which type of TWIC
readers and accompanying infrastructure to use. For example, if an
access point is exposed to direct sunlight, the facility can mitigate
glare by using an awning or hood. If an access point is exposed to
harsh weather, the facility may wish to use an encapsulated fixed TWIC
reader or instead use a portable TWIC reader that is kept inside a
nearby security guard booth.
    TSA is developing the QTL so that approved readers meet durability
standards. Additionally, in this NPRM, we're proposing requirements
that provide owners and operators the flexibility to choose the TWIC
reader that best suits their operational needs.

G. HSI Report

    This section summarizes the analysis and recommendations provided
by HSI after evaluating the risk-based approach that formed the basis
of the proposals in the ANPRM. A non-SSI version of the HSI Report is
available for viewing in the public docket for this rulemaking.
    Prior to publishing the ANPRM, we developed a risk-based approach
based on MSRAM, to inform our proposals for more stringent TWIC reader
requirements on higher-risk vessels and facilities. We engaged HSI to
obtain an independent peer review of our analysis. HSI is a federally
funded research and development center established by the Secretary,
pursuant to Section 312 of the Homeland Security Act of 2002 (Pub. L.
107-296). On October 21, 2008, HSI issued a final report, titled
``Independent Verification and Validation of Development of
Transportation Worker Identification Credential (TWIC) Reader
Requirements'' (HSI Report). The HSI Report provided information and
recommendations that were useful in formulating the proposals in this
NPRM.
    The HSI Report verifies that our AHP/MSRAM analysis matches the way
we described it, and that its findings can be reproduced. The HSI
Report also validates that our AHP/MSRAM analysis is technically sound.
While the HSI Report suggests that some adjustments to the results of
our analysis might be necessary, the report concludes that our
methodology is appropriate for establishing the risk ranking of vessels
and facilities set forth in the ANPRM.
    The HSI Report notes that Risk Group A is well defined, but the
distinction between Risk Groups B and C is not as clear. The HSI Report
also notes that, while adjustments could be suggested with respect to
the ANPRM's proposed

TWIC reader requirements, the overall risk-based approach to specifying
the TWIC reader requirements is fundamentally sound. The HSI Report
recommends that we consider further analysis of how to best group
vessels and facilities into appropriate risk-based categories.
    Our proposals in this NPRM are consistent with the above
conclusions and recommendations. Whereas the ANPRM proposed different
TWIC requirements for Risk Groups B and C, this NPRM proposes the same
TWIC requirements for both of those risk groups. We expect to continue
analyzing the risk rankings to determine whether alternative or
additional considerations would yield more appropriate risk groupings
and corresponding TWIC requirements. As noted earlier, if the Coast
Guard changes the risk groupings, it will be done through rulemaking
and the public will have an opportunity to comment.
    The HSI Report also recommends that we consider better defining the
concept of TWIC utility. As used in the context of the AHP/MSRAM
analysis, TWIC utility accounts for the reduced risk to a vessel or
facility due to TWIC implementation. The HSI Report acknowledges that a
clearer definition of this concept may require analysis of each
individual vessel and facility, which would substantially expand the
scope of the process of developing TWIC reader requirements. The HSI
Report suggests that we consider an approach that combines general
analyses of broad risk groups with specific analyses of individual
vessels and facilities. We are considering the feasibility of
implementing this recommendation.
    The HSI Report recommends that we consider adding flexibility to
TWIC reader requirements by providing a process through which owners
and operators may seek a waiver of TWIC reader requirements based on
the unique features of a specific vessel or facility. The rationale for
this recommendation is that while TWIC reader requirements apply to an
entire risk group, each risk group is comprised of a range of types of
vessels and facilities with fundamentally different security systems.
In response to this recommendation, we note that waiver provisions
already exist in current 33 CFR 104.130, 105.130, and 106.125. These
provisions enable an owner or operator to apply for a waiver of any
requirement that the owner or operator considers unnecessary in light
of the nature or operating conditions of a vessel or facility.
    The HSI Report recommends that we consider using dynamic
consequence data instead of the static maximum consequence data
currently used as part of the MSRAM analysis. The rationale for this
recommendation is that maximum consequence would necessarily change
depending on how vessels and facilities are used. For example, a cruise
ship terminal would have a different maximum consequence when cruise
ships are docked at the facility, as opposed to when the port is empty.
We believe that, due to the amount and complexity of dynamic
consequence data, obtaining such data would not be feasible.
Furthermore, use of dynamic consequence data would eliminate or at
least dramatically reduce the predictability of regulatory
requirements, and would likely not reduce costs significantly, as most
costs would be borne anyway. Nonetheless, we are considering the
feasibility of implementing this recommendation.

H. Additional Data Sources

    TWIC Pilot data was supplemented with other data sources as
necessary to provide the most accurate estimates for cost and benefit
possible. Other data sources included the Coast Guard's Marine
Information for Safety and Law Enforcement (MISLE) database for
population figures, MSRAM for risk hierarchy and consequence data, the
General Services Administration schedule for TWIC reader hardware and
software costs, Environmental Protection Agency data for estimates for
truck throughput, and contracted studies for general discussion points
on access control systems. For a more detailed discussion on the use of
this data, please refer to the ``Preliminary Regulatory Analysis and
Initial Regulatory Flexibility Analysis,'' which is available in the
public docket for this rulemaking. The Coast Guard seeks public comment
on whether or not there are additional data sources that should be
considered. If there are, please include information in your comments
about these data sources and the reason for their relevance.

I. Advisory Committee Input

    This section discusses the input we received from advisory
committees in connection with this rulemaking.
    The Coast Guard has a long tradition of consulting with its
advisory committees before taking regulatory action. We acknowledge the
benefit of consulting with advisory committees. Prior to issuing the
ANPRM, we sent a task statement to MERPAC, NMSAC, and TSAC, asking 18
questions related to TWIC reader requirements. This task statement is
available for viewing in the public docket for this rulemaking. We
accepted and incorporated a number of the advisory committee
recommendations into the ANPRM and this NPRM. For example, we
incorporated TSAC's recommendation to set the crew size cutoff number
at 14 for determining when to exempt vessels from TWIC reader
requirements as discussed more fully below in Section IV.E. ``TWIC
Reader Exemption for Vessels With 14 or Fewer TWIC-holding
Crewmembers.'' Both NMSAC and MERPAC recommended that we wait for
completion of the TWIC Pilot before publishing an NPRM on TWIC reader
requirements. MERPAC recommended against requiring owners and operators
to verify TWIC-holder PIN information. MERPAC also recommended that low
risk vessels and facilities should not be subject to TWIC reader
requirements. These are some examples of the advisory committee
recommendations we incorporated into this NPRM. We greatly appreciate
advisory committee input into this program. Copies of each advisory
committee's formal recommendations and responses to the task statement
are available for viewing in the public docket for this rulemaking.

IV. Section-by-Section Description of Proposed Rule

    This section provides a discussion of the regulations we propose in
this NPRM, which include: updated definitions relevant to this
rulemaking; a provision on the Federalism issues associated with the
Coast Guard's maritime security regulations; TWIC reader and inspection
requirements for Risk Groups A, B, and C, applicable in both normal and
special circumstances; deadlines for compliance with the proposed
regulatory requirements; TWIC reader recordkeeping requirements; TWIC-
related risk group classifications for vessels and facilities;
requirements for the physical placement of TWIC readers; and several
technical amendments to the regulations.
    We note that, if finalized, the proposed regulations would be
subject to the control and compliance measures in 33 CFR 101.410, which
give the COTP authority to impose measures to rectify non-compliance.
The proposed regulations would also be subject to the relevant civil
and/or criminal penalties in 33 CFR 101.415 for violations of any
provision in 33 CFR subchapter H.

A. Definitions

    We propose to amend 33 CFR 101.105 by adding several new defined
terms.
    The term ``biometric match'' would mean a confirmation that: one of
the two

biometric (fingerprint) templates stored in the TWIC matches the
scanned fingerprint of the person presenting the TWIC; or the alternate
biometric stored in a PACS matches the corresponding biometric of the
person.
    The term ``Canceled Card List (CCL)'' would mean the list of TWIC
Federal Agency Smart Credential-Numbers that have been invalidated or
revoked because TSA has determined that the TWIC-holder may pose a
security threat, or because the card has been reported lost, stolen, or
damaged.
    The term ``card authentication'' would mean the electronic
verification that the card presented is a valid TWIC issued by TSA.
    The term ``Card Holder Unique Identifier (CHUID)'' would mean the
standardized data object comprised of the FASC-N, globally unique
identifier, expiration date, and certificate used to validate the data
integrity of other data objects on the credential.
    The term ``card validity check'' would mean the verification that a
TWIC has not been revoked or expired.
    The term ``Mobile Offshore Drilling Unit (MODU)'' is defined by
reference to 33 CFR 140.25.
    The term ``Offshore Supply Vessel (OSV)'' is defined by reference
to 46 CFR 125.160.
    The term ``Physical Access Control System (PACS)'' would mean a
system that includes devices, personnel, and policies that controls the
access to and within a facility or vessel.
    The term ``Risk Group'' would mean the risk ranking assigned to a
vessel, facility, or OCS facility for the purpose of TWIC requirements.
    The term ``TWIC reader'' would mean an electronic device used to
verify and validate: the authenticity of a TWIC; the identity of the
TWIC-holder as the legitimate bearer of the credential; that the TWIC
is not expired; and that the TWIC is not on the CCL. The term is
specifically defined by reference to TSA's Qualified Technology List of
acceptable TWIC readers, because only those devices meet TSA's required
specifications.
    We propose to amend 33 CFR 101.105 by deleting the term ``recurring
unescorted access''. This term was included in 33 CFR 101.105 as part
of the TWIC 1 final rule, though we determined at that time to defer
implementing TWIC reader requirements. RUA was initially proposed to
provide relief to owners and operators of vessels otherwise required to
use TWIC readers, because of the familiarity that exists between a
relatively small number of crewmembers. Two important changes in
approach from the ANPRM to this NPRM render RUA an unnecessary
provision. First, this NPRM proposes to exempt from TWIC reader
requirements all vessels with 14 or fewer TWIC-holding crewmembers,
based on the SAFE Port Act's provision that prohibits requiring TWIC
readers on vessels that the Secretary has determined do not have the
requisite number of TWIC-holders as crewmembers.\72\ This exemption
provides relief equivalent to that which RUA would have provided.
Second, whereas the ANPRM proposed to require TWIC readers for Risk
Groups A and B, this NPRM proposes to require TWIC readers for Risk
Group A only. This change reduces the number of vessels and facilities
to which TWIC reader requirements would apply, and renders the need for
RUA as a mechanism for regulatory relief unnecessary.
---------------------------------------------------------------------------

    \72\ 46 U.S.C. 70105(m)(1).
---------------------------------------------------------------------------

B. Federalism

    A Presidential Memorandum, dated May 20, 2009, entitled
``Preemption,'' \73\ requires an agency to codify a preemption
provision in its regulations if the agency intends to preempt State
law. We propose to add new 33 CFR 101.112, providing a statement
regarding the preemption principles that apply to 33 CFR subchapter H.
---------------------------------------------------------------------------

    \73\ 74 FR 24693.
---------------------------------------------------------------------------

    We believe the field-preemption Federalism principles articulated
in United States v. Locke and Intertanko v. Locke \74\ apply to 33 CFR
parts 101, 103, 104, and 106. Therefore, States and local governments
are foreclosed from regulating within this field. We believe the
Federalism principles articulated in Locke also apply to 33 CFR part
105, at least insofar as a State or local law or regulation applicable
to MTSA-regulated facilities for the purpose of their protection, would
conflict with a Federal regulation (i.e., it would either actually
conflict or would frustrate an overriding Federal need for uniformity).
---------------------------------------------------------------------------

    \74\ 529 U.S. 89, 120 S.Ct. 1135 (March 6, 2000).
---------------------------------------------------------------------------

C. Additional Persons Required To Obtain TWICs

    This NPRM withdraws the ANPRM's proposal to include non-
credentialed individuals engaged on towing vessels not regulated under
33 CFR part 104 among the list of mariners required to possess a TWIC.
We seek public comment on the number of vessels pilots without a
Federal license, and whether a specific provision to include them in
the regulatory requirement to obtain a TWIC is necessary.
    In the ANPRM, we proposed to explicitly require non-Federally
licensed vessel pilots and non-credentialed individuals engaged on
towing vessels not regulated under 33 CFR part 104 to possess a TWIC.
The purpose of this proposal was to update the regulations to more
thoroughly incorporate the list of individuals required by 46 U.S.C.
70105(b) to possess a TWIC.
    Subsequent developments have caused us to withdraw part of the
ANPRM's proposal. Section 809 of the CGAA 2010 authorized the Secretary
to exempt any credentialed mariner who is not granted unescorted access
to secure areas of a vessel from the requirement to possess a TWIC. On
December 19, 2011, the Coast Guard's Office of Vessel Activities (CG-
543) published Policy Letter No. 11-15,\75\ describing both policy and
forthcoming regulatory solutions that we are undertaking to implement
Section 809. Policy Letter No. 11-15 contains exemptions for certain
mariners from the requirement to obtain or hold a TWIC. Exempt mariners
would include mariners not operating under the authority of a
credential and mariners serving on a vessel not required to have a
Vessel Security Plan. These are mariners that the ANPRM's proposal
would have explicitly included among the list of mariners required to
obtain a TWIC.
---------------------------------------------------------------------------

    \75\ CG-543 Policy Letter No. 11-15, ``Processing of Merchant
Mariner Credentials (MMC) For Mariners Not Requiring a
Transportation Worker Identification Credential,'' available for
viewing at https://homeport.uscg.mil/.
---------------------------------------------------------------------------

    In light of Section 809 and related Coast Guard regulatory action,
this NPRM withdraws the ANPRM's proposal to include non-credentialed
individuals engaged on towing vessels not regulated under 33 CFR part
104 among the list of mariners required to possess a TWIC.
Additionally, while there may be some vessel pilots that do not hold
Federal licenses, we have not determined whether there is a population
of State-licensed vessel pilots that are not otherwise required to
obtain a TWIC because they access secure areas of MTSA-regulated
vessels. We seek public comment on this subject, and whether a specific
provision to include them in the regulatory requirement to obtain a
TWIC is necessary. If there is a population of State-licensed vessel
pilots not covered under the current regulatory requirement to obtain a
TWIC, we intend to revise 33 CFR 101.514 to cover that population.

D. TWIC Reader Requirements for Risk Group A

    We propose to add new 33 CFR 101.520 that sets forth the TWIC
reader requirements for Risk Group A. We have determined that owners
and operators of vessels or facilities in Risk Group A should be
required to implement the TWIC's most protective measures using a TWIC
reader or TWIC-integrated PACS.
    At MARSEC Level 1, all persons seeking unescorted access to secure
areas would be required to present a TWIC and fingerprint for biometric
identity verification, card authentication, and card validity check.
The owner or operator would be required to perform the card validity
check based on CCL information no more than 7 days old. The owner or
operator may perform these functions using a TWIC reader or a TWIC-
integrated PACS. If using a PACS, biometrics other than fingerprints
may be used to perform the identity verification, provided that the
owner or operator links the person, the TWIC, and the alternate
biometric in the PACS. To do this, the owner or operator would be
required to perform a one-time biometric match and card authentication
using a TWIC reader. Owners or operators would be required to explain
in their security plans how the PACS performs the required security
functions and how the SSI captured by the PACS is protected.
    At MARSEC Level 2, the same procedures would apply as those at
MARSEC Level 1, except that the owner or operator would be required to
perform the card validity check based on CCL information no more than 1
day old. The heightened security threats present at elevated MARSEC
Levels justify this additional requirement.
    We propose two additional provisions in 33 CFR 101.520 to ensure
that CCL information is updated and used appropriately. First, owners
and operators would be required to update CCL information within 12
hours of any increase in MARSEC Level, regardless of when the CCL
information was last updated. Second, owners and operators would be
required to use the most recently obtained CCL information when
conducting card validity checks.
    Finally, we propose a provision in 33 CFR 101.520 that would
authorize the COTP to temporarily suspend TWIC reader requirements at a
facility if the COTP determines that such requirements are causing
delays resulting in excessive vehicle build-up or other unintended
consequence. A facility owner or operator could contact the COTP
seeking such a determination. During the period of any such suspension,
the owner or operator would be required to perform visual TWIC
inspections for identity verification, card authentication, and card
validation.

E. TWIC Reader Exemption for Vessels With 14 or Fewer TWIC-Holding
Crewmembers

    We propose to add new 33 CFR 101.520(e), exempting all vessels with
14 or fewer TWIC-holding crewmembers from TWIC reader requirements. The
statutory basis for this exemption is the SAFE Port Act provision that
prohibits the Secretary from requiring TWIC readers on a vessel unless
the vessel has more individuals on the crew required to have a TWIC
than the number the Secretary determines warrants such a reader.\76\
The underlying rationale for this exemption is that vessels with a
small enough number of TWIC-holders on board have a reduced TSI
vulnerability from unauthorized access because the small number of
crewmembers are easily recognizable and known to one another. We
propose 14 as the cutoff number based on a recommendation from TSAC.
According to TSAC, vessels with 14 or fewer crewmembers have a reduced
vulnerability because the individuals are all ``known'' to one another.
The number was developed by taking into account the fact that for a
small vessel, such as a towing vessel or offshore supply vessel, the
crew would typically include up to one Master, one Chief Engineer, and
three four-person crews who rotate through watch shifts.
---------------------------------------------------------------------------

    \76\ 46 U.S.C. 70105(m).
---------------------------------------------------------------------------

    We seek public comment on this proposal to exempt all vessels with
14 or fewer TWIC-holding crewmembers from TWIC reader requirements,
including whether 14 is an appropriate cut-off number. We request that
commenters please explain and provide available data to support their
comments.
    We recognize that, particularly for smaller vessels such as towing
vessels, the value of electronic identity verification is less than it
is for facilities, which generally interact with greater numbers of
vendors, visitors, and facility employees. For this reason, and because
TWIC readers are only proposed for Risk Group A, we believe it is
neither appropriate nor necessary to exempt facilities with 14 or fewer
TWIC-holders from TWIC reader requirements.

F. TWIC Inspection Requirements for Risk Groups B and C

    We propose to add new 33 CFR 101.525 and 101.530 that set forth the
TWIC visual inspection requirements for Risk Groups B and C,
respectively. In this NPRM, we are not proposing TWIC reader
requirements for vessels and facilities in Risk Groups B and C. We
believe the overall approach in this proposed rule would implement the
TWIC reader program in a targeted manner that enhances the security of
MTSA-regulated vessels and facilities without imposing undue burdens.
We request public comment on this determination.
    At all MARSEC Levels, all persons seeking unescorted access to
secure areas of vessels or facilities in Risk Groups B or C would be
required to present a TWIC for visual identity verification, card
authentication, and card validity check, prior to each entry. An owner
or operator would perform identity verification by visually matching
the photograph on the TWIC to the individual presenting it. An owner or
operator would verify TWIC authenticity by visually checking its
security features to determine whether it has been tampered with or
forged. An owner or operator would validate the TWIC by visually
checking the expiration date on the face of the TWIC to determine
whether it has expired. Owners and operators of vessels or facilities
in Risk Groups B and C would not be required to check TWICs against the
CCL.
    As discussed above in Sections II. and III. above, we are
considering a phased approach to implementing TWIC reader requirements
by proposing such requirements first for vessels and facilities in Risk
Group A, where the risk of harm is greatest. We have estimated that for
Risk Group A, the ratio of annualized cost of TWIC reader requirements
to average consequence figures (the monetized costs of fatalities and
injuries resulting from a TSI) warrants the TWIC reader requirements
proposed in this NPRM. For Risk Group B, we believe the estimated ratio
of annualized cost of TWIC reader requirements to average consequence
figures supports our phased approach. We will continue to analyze risk
data and consider whether additional or modified TWIC reader
requirements would be warranted in the future. For a more detailed
discussion of the costs and benefits of the proposals in this NPRM,
please refer to Section V., ``Regulatory Analyses'' below.
    The proposed TWIC inspection requirements in 33 CFR 101.525 and

101.530 would be minimum requirements. We have included proposed
regulatory provisions stating that owners and operators would have the
discretion to impose access control measures that are stricter than the
minimum regulatory requirements.
    Although this NPRM proposes the same substantive TWIC inspection
requirements for Risk Groups B and C, these requirements appear in
separate sections because we are continuing to gather data and analyze
whether different requirements would be appropriate for these risk
groups. Any such modifications would be proposed in a separate
rulemaking document, with the opportunity provided for public comment.

G. TWIC Inspection Requirements in Special Circumstances

    We propose to add new 33 CFR 101.535 that sets forth TWIC
inspection requirements in special circumstances. These provisions are
designed to provide an appropriate level of flexibility in the TWIC
reader and inspection requirements when special circumstances arise.
    If an individual is unable to present a TWIC because it has been
lost, damaged, or stolen, and the individual has previously been
granted unescorted access to secure areas and is known to have
previously possessed a TWIC, an owner or operator would be permitted to
grant the individual unescorted access to secure areas for a period of
no longer than 7 consecutive days, provided that the following
conditions are met: (1) The individual has reported the TWIC as lost,
damaged, or stolen to TSA as required in 49 CFR 1572.19(f); (2) the
individual presents another identification credential that meets the
requirements of 33 CFR 101.515; and (3) there are no other suspicious
circumstances associated with the individual's claim of loss or theft.
With the exception of these individuals, all others who are granted
unescorted access to secure areas would be required to produce their
TWIC upon request from TSA, the Coast Guard, any other authorized DHS
representative, or a law enforcement officer.
    If an individual cannot present a TWIC for any reason other than
those outlined in the immediately preceding paragraph, the individual
may not be granted unescorted access to secure areas. In order to
access secure areas, the individual would need to be escorted by a
TWIC-holder authorized to be in the secure area.
    In some instances, when an individual has poor quality
fingerprints, a TWIC reader may not be able to consistently perform the
biometric identity verification function. Also, a small number of TWICs
will be issued that contain either poor quality fingerprint templates,
mostly due to badly damaged fingers, or no fingerprint minutiae, in the
case of amputations. We expect owners and operators to describe the
exception handling process to be used in such cases in their security
plans. The exception handling process may include granting unescorted
access after the individual has successfully provided a PIN.
Alternatively, an owner or operator may require the individual to
present an alternative biometric, such as a retina scan or other
biometric that has been incorporated into a PACS.\77\
---------------------------------------------------------------------------

    \77\ Section 814 of the CGAA 2010 allows the Secretary to use a
secondary authentication system to verify the identification of
individuals using TWIC when the individual's fingerprints are not
able to be taken or read.
---------------------------------------------------------------------------

    If a TWIC reader malfunctions, an owner or operator would still be
permitted to grant the individual unescorted access to secure areas,
provided that certain conditions are met. First, the individual would
be required to have previously been granted unescorted access to secure
areas in the past, and the individual would be required to be known to
have a TWIC. Second, the owner or operator would be required to perform
identity verification, card validation and card authentication by
visual inspection. An owner or operator may rely on this alternative
for a period of 7 calendar days while the TWIC reader malfunction is
corrected.
    TWIC requirements in 33 CFR 104.265, 105.255, and 106.260 currently
contain provisions regarding disciplinary measures to prevent fraud and
abuse, coordination of access control with other vessels and
conveyances, and security plan requirements. We propose to relocate
those provisions to 33 CFR 101.535(f)-(h).

H. Compliance Deadlines

    We propose to amend 33 CFR 104.115 and 105.115 to set forth the
required compliance deadlines with respect to TWIC reader requirements.
Within 2 years after publication of the TWIC reader final rule, owners
and operators would be required to be operating in accordance with the
requirements contained in that final rule. Also, within 2 years after
publication of the TWIC reader final rule, owners and operators would
have to amend their security plans to indicate how they implement the
TWIC reader requirements contained in the applicable sections of 33 CFR
parts 101, 104, and 105.
    In the ANPRM, we were not proposing to amend the section on ASPs to
require amendments within 2 years of the final rule. Instead, in the
ANPRM, we said we would exercise our authority under 33 CFR
101.120(d)(1)(ii) to require those entities using ASPs to amend them to
incorporate TWIC requirements. For the purpose of consistency with the
other vessels and facilities subject to 33 CFR parts 104, 105, and 106,
this NPRM eliminates the ANPRM's proposed approach to treat entities
with approved ASPs differently. Accordingly, this NPRM proposes to
require entities to update their ASPs in the same manner and on the
same schedule as the other vessels and facilities subject to 33 CFR
parts 104, 105, and 106.
    We recognize that in addition to this NPRM, there are a number of
ongoing Coast Guard rulemakings (e.g., Updates to 33 CFR Subchapter H:
Maritime Security (RIN 1625-AB30) and Consolidated Cruise Ship Security
Measures (RIN 1625-AB38)) that could affect vessel, facility, and OCS
facility security plans in the near future. In 2011, a majority of
facilities that would be subject to these proposed requirements already
updated and submitted for approval security plans in accordance with 33
CFR subchapter H. If each of the ongoing rulemaking projects required
an update to security plans, there could be a significant increase in
workload for owners and operators, as well as at the Coast Guard Marine
Safety Center, Districts, and Sectors. We are currently examining
several options to coordinate the rulemakings and manage the plan
submission and re-approval process to ensure that plan changes occur
only as often as necessary to incorporate any new regulatory
requirements. While this NPRM proposes a 2-year deadline for updated
security plans, we invite comments or suggestions from the public on
how to streamline and reduce the level of effort for all stakeholders.

I. Recordkeeping

    We propose to amend 33 CFR 104.235 and 105.225 to set forth TWIC
reader recordkeeping requirements. These recordkeeping requirements
would apply when TWIC readers are used, and not in the special
circumstances described in the proposed regulations when the owner or
operator is permitted to rely on visual TWIC inspection. Owners and
operators using TWIC readers, with or without a PACS, would be required
to maintain certain records for at least 2 years. During that time,
owners and operators would be required to make those records available
to the

Coast Guard upon request. Those records include, with respect to each
individual granted unescorted access to a secure area: (1) FASC-N; (2)
date that access was granted; (3) time that access was granted; and (4)
if captured, the name of the individual to whom access was granted. If
a TWIC reader or PACS captures the required data when the TWIC is
scanned, and can retain and reproduce that data, the recordkeeping
requirement would be met. Owners and operators would be required to
also maintain records to demonstrate that they have performed the
required card validity check using the CCL on each individual. Finally,
we propose to include a regulatory provision indicating that TWIC
reader records are SSI, and would be required to be protected in
accordance with 49 CFR part 1520.

J. Risk Group Classifications

    We propose to add new 33 CFR 104.263, 105.253, and 106.258 to set
forth the risk group classifications for vessels and facilities. The
risk group classifications proposed in the NPRM are the same as those
proposed in the ANPRM, with minor technical changes, as follows:
    For vessels subject to 33 CFR part 104, this NPRM proposes the
following risk group classifications:
    Risk Group A
    (1) Vessels that carry Certain Dangerous Cargoes (CDC) in bulk.
    (2) Vessels certificated to carry more than 1,000 passengers.
    (3) Towing vessels engaged in towing a barge or barges subject to
(1) of this section or vessels subject to (2) of this section.
Risk Group B
    (1) Vessels that carry hazardous materials other than CDC in bulk.
    (2) Vessels subject to 46 CFR chapter I, subchapter D, that carry
any flammable or combustible liquid cargoes or residues.
    (3) Vessels certificated to carry 500 to 1,000 passengers.
    (4) Towing vessels engaged in towing a barge or barges subject to
(1), (2), or vessels subject to (3) of this section.
Risk Group C
    (1) Vessels carrying non-hazardous cargoes that are required to
have a vessel security plan (VSP).
    (2) Vessels certificated to carry less than 500 passengers.
    (3) Towing vessels engaged in towing a barge or barges subject to
(1) of this section or vessels subject to (2) of this section.
    (4) Mobile Offshore Drilling Units (MODUs).
    (5) Offshore Supply Vessels (OSVs) subject to 46 CFR chapter I,
subchapter L or I.
    For facilities subject to 33 CFR part 105, this NPRM proposes the
following risk group classifications:
Risk Group A
    (1) Facilities that handle Certain Dangerous Cargoes (CDC) in bulk.
    (2) Facilities that receive vessels certificated to carry more than
1,000 passengers.
    (3) Barge fleeting facilities that receive barges carrying CDC in
bulk.
Risk Group B
    (1) Facilities that receive vessels that carry hazardous materials
other than CDC in bulk.
    (2) Facilities that receive vessels subject to 46 CFR chapter I,