[Federal Register Volume 81, Number 163 (Tuesday, August 23, 2016)]
[Rules and Regulations]
[Pages 57651-57713]
[FR Doc No: 2016-19383]

Vol. 81

Tuesday,

No. 163

August 23, 2016

Part II

Department of Homeland Security

-----------------------------------------------------------------------

 Coast Guard

-----------------------------------------------------------------------

33 CFR Parts 101, 103, 104, et al.

Transportation Worker Identification Credential (TWIC)--Reader
Requirements; Final Rule

Federal Register / Vol. 81 , No. 163 / Tuesday, August 23, 2016 /
Rules and Regulations

-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

Coast Guard

33 CFR Parts 101, 103, 104, 105 and 106

[Docket No. USCG-2007-28915]
RIN 1625-AB21

Transportation Worker Identification Credential (TWIC)--Reader
Requirements

AGENCY: Coast Guard, DHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Coast Guard is issuing a final rule to require owners and
operators of certain vessels and facilities regulated by the Coast
Guard to conduct electronic inspections of Transportation Worker
Identification Credentials (TWICs) as an access control measure. This
final rule also implements recordkeeping requirements and security plan
amendments that would incorporate these TWIC requirements. The TWIC
program, including the electronic inspection requirements in this final
rule, is an important component of the Coast Guard's multi-layered
system of access control requirements designed to enhance maritime
security.
    This rulemaking action builds upon existing regulations designed to
ensure that only individuals who hold a valid TWIC are granted
unescorted access to secure areas of Coast Guard-regulated vessels and
facilities. The Coast Guard and the Transportation Security
Administration have already promulgated regulations pursuant to the
Maritime Transportation Security Act that require mariners and other
individuals to hold a TWIC prior to gaining unescorted access to a
secure area. By requiring certain high-risk vessels and facilities to
perform electronic TWIC inspections, this rule enhances security at
those locations. This rule also implements the Security and
Accountability For Every Port Act of 2006 electronic reader
requirements.

DATES: This final rule is effective August 23, 2018.

ADDRESSES: Comments and materials received from the public, as well as
documents mentioned in this preamble as being available in the docket,
are part of docket USCG-2007-28915 and are available using the Federal
eRulemaking Portal. You can find this docket on the Internet by going
to http://www.regulations.gov, entering ``USCG-2007-28915'' and then
clicking ``Search.''

FOR FURTHER INFORMATION CONTACT: For information about this document,
call or email LCDR Kevin McDonald, Coast Guard; telephone<PHONE_NUMBER>,
email<EMAIL_ADDRESS>
SUPPLEMENTARY INFORMATION:

Table of Contents for Preamble

I. Abbreviations
II. Regulatory History and Information
III. Executive Summary
    A. Basis and Purpose
    B. Summary of Costs and Benefits
IV. Background
V. Discussion of Comments and Changes to the Final Rule
    A. General Matters Relating to TWIC
    1. Purpose and Efficacy of the TWIC Program
    2. Risk Analysis Methodology
    B. Electronic TWIC Inspection
    1. Electronic TWIC Inspection Does Not Necessarily Require a
TWIC Reader
    2. Integrating Electronic TWIC Inspection Into a PACS
    a. List of Acceptable TWIC Readers
    b. PIN Pads and Biometric Input Methods
    3. Comments Related to Troubleshooting TWIC
    a. Lost, Stolen, or Damaged TWIC
    i. Vessels and Facilities Using a PACS
    ii. Vessels and Facilities Using TWIC Readers
    b. Transportation Worker Forgets to Bring TWIC to Work Site
    c. Inaccessible Biometrics
    d. Malfunctioning Access Control Systems
    e. Requirements for Varying MARSEC Levels
    4. Recordkeeping Requirements
    C. When to Conduct Electronic TWIC Inspection
    1. Secure, Restricted, Public Access, Passenger Access, and
Employee Access Areas
    a. ``Prior to Each Entry'' for Risk Group A Facilities
    b. Recurring Unescorted Access
    2. Risk Group A Vessels
    3. Risk Groups B and C
    4. Miscellaneous Questions Regarding the Locations of Electronic
TWIC Inspection
    D. Determination of Risk Groups
    1. Risk Group A Facilities
    a. Alternative Security Programs
    b. Determining Risk Group A Facilities
    2. The Crewmember Exemption Does Not Apply to Facilities
    3. The Low Number of Crewmembers Exemption
    4. Calculating the Total Number of TWIC-holding Crewmembers
    5. Threshold for the Crewmember Exemption of Vessels
    6. Outer Continental Shelf Facilities
    7. Vessels and Facilities Not in Risk Group A
    8. Barge Fleeting Facilities
    9. Switching Risk Groups
    E. Responses to Economic Comments
    1. Costs of TWIC Readers
    2. Number of TWIC Readers at Vessels and Facilities
    3. Transaction Times
    4. Security Personnel
    5. Other Cost Comments
    6. Costs Exceeding Benefits, Cost-effectiveness, and Risk
Reduction
    7. Cumulative Costs of Security-related Rulemakings
    8. Small Business Impact
    F. Other Issues
    1. The GAO Report and the TWIC Pilot Program
    2. Additional Comments
    a. General Comments on the TWIC Program
    b. Clarification of Specific Items
    c. Comments Outside the Scope of this Rulemaking
VI. Regulatory Analyses
    A. Regulatory Planning and Review
    B. Small Entities
    C. Assistance for Small Entities
    D. Collection of Information
    E. Federalism
    F. Unfunded Mandates Reform Act
    G. Taking of Private Property
    H. Civil Justice Reform
    I. Protection of Children
    J. Indian Tribal Governments
    K. Energy Effects
    L. Technical Standards
    M. Environment

I. Abbreviations

AHP--Analytical Hierarchy Process
ANPRM--Advanced Notice of Proposed Rulemaking
ASP--Alternative Security Program
CCA--Certificate for Card Authentication
CCL--Canceled Card List
CCTV--Closed-Circuit Television
CDC--Certain Dangerous Cargoes
CFR--Code of Federal Regulations
CHUID--Card Holder Unique Identifier
COI--Certificate of Inspection
DHS--Department of Homeland Security
DRAA--Designated Recurring Access Area
E.O.--Executive Order
FASC--N Federal Agency Smart Credential--Number
FR--Federal Register
FSP--Facility Security Plan
ICE--Initial Capability Evaluation
MARSEC--Maritime Security
MISLE--Marine Information for Safety and Law Enforcement
MSRAM--Maritime Security Risk Analysis Model
MTSA--Maritime Transportation Security Act of 2002
NIST--National Institute of Standards and Technology
NPRM--Notice of Proposed Rulemaking
NTTAA--National Technology Transfer and Advancement Act
NVIC--Navigation and Vessel Inspection Circular
OCS--Outer Continental Shelf
OMB--Office of Management and Budget
PAC--Policy Advisory Council
PACS--Physical Access Control System
PVA--Passenger Vessel Association
PII--Personal Identifying Information
PIN--Personal Identification Number
Pub. L.--Public Law
QTL--Qualified Technology List
RA--Regulatory Analysis
RUA--Recurring Unescorted Access
SAFE--Port Act Security and Accountability For Every Port Act of
2006

SBA--Small Business Administration
SSI--Sensitive Security Information
TSA--Transportation Security Administration
TSAC--Towing Safety Advisory Committee
TSI--Transportation Security Incident
TWIC--Transportation Worker Identification Credential
U.S.C.--United States Code
VSP--Vessel Security Plan

II. Regulatory History and Information

    On May 22, 2006, the Coast Guard and the Transportation Security
Administration (TSA) jointly published a Notice of Proposed Rulemaking
(NPRM) entitled ``Transportation Worker Identification Credential
(TWIC) Implementation in the Maritime Sector; Hazardous Materials
Endorsement for a Commercial Driver's License.'' \1\ On January 25,
2007, the Coast Guard and TSA published the final rule, also entitled
``Transportation Worker Identification Credential (TWIC) Implementation
in the Maritime Sector; Hazardous Materials Endorsement for a
Commercial Driver's License.'' \2\
---------------------------------------------------------------------------

    \1\ 71 FR 29396.
    \2\ 72 FR 3492.
---------------------------------------------------------------------------

    Although the May 22, 2006 NPRM proposed certain TWIC reader
requirements, after reviewing the public comments, the Coast Guard
decided to remove the proposed TWIC reader requirements from the
January 25, 2007 final rule, address them in a separate rulemaking, and
conducted a pilot program to address the feasibility of reader
requirements before issuing a final rule.\3\ For a detailed discussion
of those public comments and Coast Guard responses, please refer to the
January 25, 2007 final rule.\4\
---------------------------------------------------------------------------

    \3\ The TWIC Reader Pilot was established pursuant to Section
104 of the Security and Accountability For Every Port Act of 2006
(SAFE Port Act) (P.L. 109-347), which was codified at 46 U.S.C.
70105 (k)(4).
    \4\ 72 FR 3511.
---------------------------------------------------------------------------

    On March 27, 2009, the Coast Guard published an Advanced Notice of
Proposed Rulemaking (ANPRM) for this rulemaking.\5\ On March 22, 2013,
the Coast Guard published the NPRM for this rulemaking.\6\
Additionally, we held four public meetings across the country in 2013.
---------------------------------------------------------------------------

    \5\ 74 FR 13360.
    \6\ 78 FR 17782.
---------------------------------------------------------------------------

III. Executive Summary

A. Basis and Purpose

    In accordance with the Maritime Transportation Security Act of 2002
(MTSA) and the Security and Accountability For Every Port Act of 2006
(SAFE Port Act), the Coast Guard is establishing rules requiring
electronic readers for use at high-risk vessels and at facilities.
These rules will ensure that prior to being granted unescorted access
to a designated secure area, an individual will have his or her TWIC
authenticated, the status of that credential validated against an up-
to-date list maintained by the TSA, and the individual's identity
confirmed by comparing his or her biometric (i.e. fingerprint) with a
biometric template stored on the credential. By promulgating these
rules, the Coast Guard is complying with the statutory requirement in
the SAFE Port Act, improving security at the highest risk maritime
transportation-related vessels and facilities, and making full use of
the electronic and biometric security features integrated into the TWIC
and mandated by Congress in MTSA.
    The TWIC is currently being used as a visual identity badge on many
vessels and facilities. Essentially, DHS requires that a security guard
examines the security features (hologram and watermark) embedded on the
surface of the credential, checks the expiration date listed on the
card, and compares the photograph to the person presenting the
credential. While this system of ``visual TWIC inspection'' provides
some benefits, it does not address all security concerns, nor does it
make full use of the security features contained in the TWIC. For
example, if a TWIC is stolen or lost, an unauthorized individual could
make use of the credential, and provided that individual resembles the
picture on the TWIC, could gain access to a secure area. Additionally,
if a TWIC is revoked because the individual has committed a
disqualifying offense, such as the theft of explosives, there is no way
for security officers on a vessel or at a facility to determine that
fact from the face of the TWIC. Finally, a sophisticated adversary
could forge a realistic replica of a credential. It is also worth
noting that since a TWIC-holder is required to renew his or her
credential every 5 years, the TWIC-holder's resemblance to the picture
on the TWIC may decrease over time, rendering visual inspection a
somewhat less accurate means to confirm identity. Through the process
of ``electronic TWIC inspection,'' by which TWICs are authenticated,
validated, and the individual's identity confirmed biometrically, all
of these scenarios would be thwarted or mitigated.
    In this rulemaking process, the Coast Guard published an ANPRM,
published an NPRM, hosted a series of public meetings around the
country to solicit public input, and worked with the Transportation
Security Administration to conduct a pilot program. As a result of this
input, the Coast Guard made a number of changes and clarifications in
this final rule that we believe provide a robust system that improves
security, addresses industry, labor, and Congressional concerns, and
clarifies numerous issues relating to the operational nature of the
electronic TWIC inspection program. Primarily, this rule allows for an
even more flexible implementation of the electronic TWIC inspection
requirements than the proposed rule that will allow new systems to be
integrated into existing security and access control systems. We
believe that this flexibility will provide robust security without
causing unnecessary costs or significantly disrupting business
operations. A brief summary of the main changes from the proposed rule
to the final rule follows.
     This final rule provides additional flexibility with
regard to the purchase, installation, and use of electronic readers.
Instead of requiring the use of a TWIC reader on the TSA's Qualified
Technology List (QTL), owners and operators can choose to fully
integrate electronic TWIC inspection and biometric matching into a new
or existing Physical Access Control System (PACS).
     We clarify that this final rule only affects Risk Group A
vessels and facilities, and that no changes to the existing business
practices of other MTSA-regulated vessels and facilities are required.
     This final rule eliminates the distinction between Risk
Groups B and C for both vessels and facilities. If and when a
requirement for electronic TWIC inspection may be considered for MTSA-
regulated vessels and facilities not currently in Risk Group A, we will
provide an updated analysis of the costs and benefits of such an action
and define new Risk Groups accordingly.
     This final rule clarifies that for Risk Group A
facilities, electronic TWIC inspection is required each time a person
is granted unescorted access to a secure area (a limited exception is
permitted for Recurring Unescorted Access, or RUA). For Risk Group A
vessels, electronic TWIC inspection is only required when boarding the
vessel, even if only parts of the vessel are considered secure areas.
     This final rule eliminates the special requirement that
barge fleeting facilities that handle or receive barges carrying
Certain Dangerous Cargoes (CDC) in bulk be classified as Risk Group A.
Barge fleeting facilities are instead classified the same as all other
facilities. This change will effectively eliminate most isolated barge
facilities

from the electronic TWIC inspection requirements due to a lack of a
secure area.
     This final rule increases the exemption from electronic
TWIC inspection requirements to vessels with 20 or fewer TWIC-holding
crewmembers and defines that number as the minimum manning requirement
specified on a vessel's Certificate of Inspection.
     This final rule provides additional flexibility for
ferries and other vessels that use dedicated terminals in Risk Group A
to integrate their electronic TWIC inspection programs with their
terminals' programs.

B. Summary of Costs and Benefits

    Of the approximately 13,825 vessels, 3,270 facilities, and 56 Outer
Continental Shelf (OCS) facilities regulated by MTSA, this final rule
impacts only certain ``Risk Group A'' vessels and facilities, which
currently number 1 vessel \7\ and 525 facilities under the revised
applicability definitions for the final rule. No OCS facilities are
affected by this final rule. We estimate the annualized cost of this
final rule to be approximately $22.5 million, while the 10-year cost is
$157.9 million, discounted at 7 percent. The main cost drivers of this
rule are the acquisition, installation, and integration of TWIC readers
into access control systems. Annual costs will be driven by costs
associated with updates of the list of cancelled TWICs, recordkeeping,
training, system maintenance, and opportunity costs associated with
failed TWIC reader transactions. The estimated annualized cost of this
final rule discounted at 7 percent is approximately $5.1 million less
than the estimated cost of the NPRM.
---------------------------------------------------------------------------

    \7\ We note that the number of vessels affected by the provision
is low, as most ``Risk Group A'' vessels are exempt from the
electronic TWIC inspection requirements due to a low crewmember
count.
---------------------------------------------------------------------------

    The benefits of this final rule include the enhancement of the
security of vessels, ports, and other facilities by ensuring that only
individuals who hold TWICs are granted unescorted access to secure
areas at those locations. The main benefit of this regulation,
decreased risk of a Transportation Security Incident (TSI), cannot be
quantified given current data limitations. We used a risk-based
approach to apply these regulatory requirements to less than 5 percent
of the MTSA-regulated population, which represents approximately 80
percent of the potential consequences of a TSI. The provisions in this
final rule target the highest risk entities while maximizing the net
benefits of the rule.
    Table 1 provides the estimated costs and functional benefits
associated with the requirements of the TWIC reader.

     Table 1--Estimated Costs and Functional Benefits of TWIC Reader
                              Requirements
------------------------------------------------------------------------
                Category                            Final Rule
------------------------------------------------------------------------
Applicability..........................  High-risk MTSA-regulated
                                          facilities and high risk MTSA-
                                          regulated vessels with greater
                                          than 20 TWIC-holding
                                          crewmembers.
Affected Population....................  1 vessel.
                                         525 facilities.
Costs ($ millions, 7% discount rate)...  $22.5 (annualized).
                                         $157.9 (10-year).
Costs (Qualitative)....................  Time to retrieve or replace
                                          lost PINs for use with TWICs.
Benefits (Qualitative).................  Enhanced access control and
                                          security at U.S. maritime
                                          facilities and on board U.S.-
                                          flagged vessels.
                                         Reduction of human error when
                                          checking identification and
                                          manning access points.
------------------------------------------------------------------------

    For a more detailed discussion of costs and benefits, see the full
Final Regulatory Analysis and Final Regulatory Flexibility Analysis
available in the online docket for this rulemaking. Appendix G of that
document outlines the costs by provision and also discusses the
complementary nature of the provisions.

IV. Background

    The MTSA provides a multi-layered approach to maritime security
which includes measures to consider broader security issues at U.S.
ports and waterways, the coastal zone, the open ocean, and foreign
ports. Under this multi-layered system, the Coast Guard is authorized
to regulate vessels and facilities, and owners and operators of MTSA-
regulated vessels or facilities are required to submit for Coast Guard
approval a comprehensive security plan detailing the access control and
other security policies and procedures implemented on each vessel and
facility. Security plans must identify and mitigate vulnerabilities by
detailing the following items: (1) Security organization of the vessel
or facility; (2) personnel training; (3) drills and exercises; (4)
records and documentation; (5) response to changes in Maritime Security
(MARSEC) Level; (6) procedures for interfacing with other facilities
and/or vessels; (7) Declarations of Security; (8) communications; (9)
security systems and equipment maintenance; (10) security measures for
access control; (11) security measures for restricted areas; (12)
security measures for handling cargo; (13) security measures regarding
vessel stores and bunkers; (14) security measures for monitoring; (15)
security incident procedures; (16) audits and security plan amendments;
(17) Security Assessment Reports and other security reports; and (18)
TWIC procedures.\8\
---------------------------------------------------------------------------

    \8\ See 33 CFR 104.405 and 33 CFR 105.405.
---------------------------------------------------------------------------

    For the purposes of MTSA, the term ``facility'' means ``any
structure or facility of any kind located in, on, under, or adjacent to
any waters subject to the jurisdiction of the United States.'' \9\ For
the purposes of MTSA, the term ``vessel'' includes ``every description
of watercraft or other artificial contrivance used, or capable of being
used, as a means of transportation on water.'' \10\ Coast Guard
regulations implementing MTSA with respect to vessels \11\ apply to:
Mobile Offshore Drilling Units, cargo vessels, or passenger vessels
subject to the International Convention for Safety of Life at Sea, 1974
(SOLAS), chapter XI-1 or Chapter XI-2; foreign cargo vessels greater
than 100 gross register tons; generally, self-propelled U.S. cargo
vessels greater than 100 gross tons; offshore supply vessels; vessels
subject to the Coast Guard's regulations regarding passenger vessels;
passenger

vessels certificated to carry more than 150 passengers; passenger
vessels carrying more than 12 passengers engaged on an international
voyage; barges carrying, in bulk, cargoes regulated under the Coast
Guard's regulations regarding tank vessels or CDC; \12\ barges carrying
CDC or cargo and miscellaneous vessels engaged on an international
voyage; tank ships; and generally, towing vessels greater than 8 meters
in register length engaged in towing barges.
---------------------------------------------------------------------------

    \9\ 46 U.S.C. 70101(2).
    \10\ 46 U.S.C. 115; 1 U.S.C. 3.
    \11\ See 33 CFR 104.105(a).
    \12\ The term ``Certain Dangerous Cargoes'' is defined in 33 CFR
101.105 by reference to 33 CFR 160.204, which lists all of the
covered substances.
---------------------------------------------------------------------------

    TWIC requirements in those regulations do not apply to: Foreign
vessels; mariners employed aboard vessels moored at U.S. facilities
only when they are working immediately adjacent to their vessels in the
conduct of vessel activities; except pursuant to international treaty,
convention, or agreement to which the U.S. is a party, to any foreign
vessel that is not destined for, or departing from, a port or place
subject to the jurisdiction of the U.S. and that is either (a) in
innocent passage through the territorial sea of the U.S., or (b) in
transit through the navigable waters of the U.S. that form a part of an
international strait.\13\
---------------------------------------------------------------------------

    \13\ See 33 CFR 104.105(d)-(f).
---------------------------------------------------------------------------

    Coast Guard regulations implementing MTSA with respect to
facilities \14\ apply to: waterfront facilities handling dangerous
cargoes (as generally defined in 49 CFR parts 170 through 179);
waterfront facilities handling liquefied natural gas and liquefied
hazardous gas; facilities transferring oil or hazardous materials in
bulk; facilities that receive vessels certificated to carry more than
150 passengers; facilities that receive vessels subject to SOLAS,
Chapter XI; facilities that receive foreign cargo vessels greater than
100 gross register tons; generally, facilities that receive U.S. cargo
and miscellaneous vessels greater than 100 gross register tons; barge
fleeting facilities that receive barges carrying, in bulk, cargoes
regulated under the Coast Guard's regulations regarding tank vessels or
CDC; and fixed or floating facilities operating on the OCS for the
purposes of engaging in the exploration, development, or production of
oil, natural gas, or mineral resources.
---------------------------------------------------------------------------

    \14\ See 33 CFR 105.105 and 106.105.
---------------------------------------------------------------------------

    Those regulations do not apply to: A facility owned or operated by
the U.S. that is used primarily for military purposes; an oil and
natural gas production, exploration, or development facility regulated
by 33 CFR parts 126 or 154 if (a) the facility is engaged solely in the
exploration, development, or production of oil and natural gas, and (b)
the facility does not meet or exceed the operating conditions in 33 CFR
106.105; a facility that supports the production, exploration, or
development of oil and natural gas regulated by 33 CFR parts 126 or 154
if (a) the facility is engaged solely in the support of exploration,
development, or production of oil and natural gas and transports or
stores quantities of hazardous materials that do not meet or exceed
those specified in 49 CFR 172.800(b)(1) through (b)(6), or (b) the
facility stores less than 42,000 gallons of cargo regulated by 33 CFR
part 154; a mobile facility regulated by 33 CFR part 154; or an
isolated facility that receives materials regulated by 33 CFR parts 126
or 154 by vessel due to the lack of road access to the facility and
does not distribute the material through secondary marine
transfers.\15\ Additionally, the TWIC requirements in those regulations
do not apply to mariners employed aboard vessels moored at U.S.
facilities only when they are working immediately adjacent to their
vessels in the conduct of vessel activities.\16\
---------------------------------------------------------------------------

    \15\ See 33 CFR 105.105(c).
    \16\ See 33 CFR 105.105(d) and 106.105(b).
---------------------------------------------------------------------------

    This rulemaking applies to the above-described vessels and
facilities regulated by the Coast Guard pursuant to the authority
granted in MTSA, and will further increase the security value of TWIC
to the nation by making use of the statutorily-mandated biometric
identification function and other security features. A complete
statutory and regulatory history of this rulemaking can be found in
Section III.B of the NPRM published on March 22, 2013.\17\
---------------------------------------------------------------------------

    \17\ 78 FR 17789.
---------------------------------------------------------------------------

    The TWIC program falls under the access control requirements as one
component of MTSA. Since April 15, 2009, the TWIC has been used
throughout the maritime sector for access to secure areas of MTSA-
regulated facilities and vessels. Its purpose is to ensure a vetted
maritime workforce by establishing security-related eligibility
criteria, and by requiring each TWIC-holder to undergo a security
threat assessment from the TSA as part of the process of applying for
and obtaining a TWIC.
    In addition to its visible security features, the TWIC stores two
electronically readable reference biometric templates (i.e.,
fingerprint templates), a PIN, a digital facial image, authentication
certificates, and a Federal Agency Smart Credential-Number (FASC-N).
These features enable the TWIC to be used in different ways for (1)
card authentication, (2) card validation, and (3) identity
verification.
    Card authentication ensures that the TWIC is not counterfeit.
Security personnel can authenticate a TWIC by visually inspecting the
security features on the card. An electronic reader provides enhanced
authentication by performing a challenge/response protocol using the
Certificate for Card Authentication (CCA) and the associated card
authentication private key stored in the TWIC. The electronic reader
will read the CCA from the TWIC and send a command to the TWIC
requesting the card authentication private key be used to sign a random
block of data (created and known to the electronic reader). The
electronic reader software will use the public key embedded in the CCA
to verify that the signature of the random data block returned by the
TWIC is valid. If the signature is valid, the electronic reader will
trust the TWIC submitted and will then pull the FASC-N and other
information from the card for further processing. The CCA contains the
FASC-N and a certificate expiration date harmonized to the TWIC
expiration date. This minimizes the need for the electronic reader to
pull more information from the TWIC (unless required for additional
checking).
    The card validity check ensures that the TWIC has not expired or
been cancelled by TSA, or reported as lost, stolen, or damaged.
Security personnel can validate whether a TWIC has expired by visually
checking the TWIC's expiration date. Currently, a TSA-canceled TWIC is
placed on TSA's official CCL, which is updated daily. TSA's CCL is
available online at: https://universalenroll.dhs.gov/. Currently, the
process of TWIC visual inspection does not require the security guard
to compare the cardholder's name to the CCL and therefore facilities do
not know when specific card holders have had their credentials
cancelled and may continue to grant access unknowingly. Using an
electronic reader, card validity is further confirmed by finding no
match on the CCL and electronically checking the expiration date on the
TWIC. Checks against the CCL may be performed electronically by
downloading the list onto a TWIC reader or integrated PACS.
    Identity verification entails comparing the individual presenting
the TWIC to the same person to whom the TWIC was issued. Identity can
be verified by visually comparing the photo on the TWIC to the TWIC-
holder. Using an electronic reader, identity can be

verified by matching one of the biometric templates stored in the TWIC
to the TWIC-holder's live sample biometric, matching to the PACS
enrolled reference biometrics linked to the FASC-N of the TWIC, or
requiring the TWIC-holder to place the TWIC into a TWIC reader
(currently a PIN can only be accessed using a TWIC reader with a
contact interface) and entering their PIN to release the digital facial
image from the TWIC. This avoids the vulnerabilities of visual
inspection by using the biometric capabilities mandated by Congress.

V. Discussion of Comments and Changes to the Final Rule

    In response to publication of the March 22, 2013 NPRM, the Coast
Guard received over 100 comment letters, consisting of over 1,200
unique comments. Commenters provided numerous opinions, arguments,
questions, and recommendations regarding the proposed TWIC reader
requirements. In this section, we describe the comments received, as
well as how they influenced the decisions made in this final rule.
Overall, we have grouped our discussion into five sections, as
discussed below.
    In Section A, we address comments relating to the TWIC program
generally, and electronic TWIC inspection specifically. This section
includes comments relating to what the program's purpose is, how it
affects security, and how it is tailored to achieve these goals in the
most cost-effective and least-burdensome manner. We also discuss the
risk analysis methodology in this section, in order to address comments
relating to the specific types of threats the electronic TWIC
inspection program is designed to combat.
    Sections B through D of this discussion respond to comments
relating to the operational aspects of the electronic TWIC inspection
program. Most comments received were of a practical nature, especially
those asking for clarifications on exactly how the regulations would
apply in a large variety of specific situations. Section B addresses
the specific nature of what an ``electronic TWIC inspection'' is,
including what must be carried out, how such an inspection can be
carried out using a PACS, recordkeeping requirements arising from
electronic TWIC inspections, and how specific problems, such as a
misplaced TWIC, would be addressed in the regulations.
    Section C addresses when an electronic TWIC inspection must take
place, including the specific locations on a facility or vessel where
electronic readers must be located, and the parameters of an RUA
configuration. Section D responds to comments relating to the
classification of vessels and facilities into Risk Groups, including
questions relating to barge fleeting facilities, shifting Risk Groups,
and the exemption from electronic TWIC inspection requirements for
vessels with a low number of crewmembers.
    Items relating to the economic issues of electronic TWIC inspection
are addressed in Section E. Comments on these issues related to the
costs of TWIC readers, throughput times for TWIC transactions, and
potential changes in security staffing needs.
    Finally, Section F addresses several miscellaneous issues. Primary
among these issues are comments relating to the TWIC Pilot Program and
the Government Accountability Office (GAO) report on TWIC readers,
issued in 2013 shortly before publication of the NPRM and accompanying
analysis.\18\ Additionally, this section addresses all other comments
and questions that were not included in other sections.
---------------------------------------------------------------------------

    \18\ ``Transportation Worker Identification Credential: Card
Reader Pilot Results Are Unreliable; Security Benefits Need to Be
Reassessed'' (GAO-13-198).
---------------------------------------------------------------------------

A. General Matters Relating to TWIC

    In response to the NPRM, the Coast Guard received a large variety
of comments relating to the TWIC program. In this section, we begin
with those comments that address the TWIC program as a whole. Multiple
commenters expressed dissatisfaction with the TWIC program as a whole
and suggested that it be dismantled. Many of these commenters noted
that specific facilities or vessels had not been targeted by
terrorists, and argued that the costs of the program were unnecessary.
For a variety of reasons described extensively throughout this
document, we believe that the targeted measures established in this
final rule provide a cost-effective mitigation of various threats that
could result in a TSI. For example, in the Regulatory Analysis (RA), we
describe three hypothetical yet plausible scenarios in which an
individual could gain access to a vessel or facility using a forged or
stolen TWIC,\19\ threats that could specifically be reduced by
electronic TWIC inspection. Congress has mandated, and we agree, that
preventing unauthorized individuals from accessing secure areas of the
nation's transportation infrastructure is part of a necessary security
program. While we also agree with many commenters who suggested that it
does not prevent every possible security threat, that is not the
purpose of this final rule. The purpose of this final rule is to
improve security at the highest risk maritime transportation-related
vessels and facilities through the use of an electronic reader.
---------------------------------------------------------------------------

    \19\ RA, p. 88.
---------------------------------------------------------------------------

    One commenter criticized the Maritime Security Risk Analysis Model
(MSRAM) threat analysis methodology, because it did not address the
security issues raised by cargo containers, which include the potential
for concealed threats within the containers. While we note that MSRAM
does include scenarios associated with threats from cargo containers,
for the purposes of the current analysis of electronic TWIC inspection,
we limited our consideration to attack scenarios that require physical
proximity to the intended target and for which access control would
affect the ability to conduct an attack. Controlling access to a target
is an essential component of security from such attacks because access
control helps to detect and perhaps interdict or at least delay the
attackers before they reach the target. TWIC readers enhance the
reliability of access control measures, thereby increasing the
likelihood of identifying and denying/delaying access to an individual
or group attempting nefarious acts. For this reason, our analysis in
this final rule focuses on threats that could be prevented or mitigated
through use of electronic TWIC inspection. Concealed items or persons
smuggled inside cargo containers are not attack scenarios that
transportation worker identity verification (and electronic TWIC
inspection in particular) addresses. Therefore, analyzing those
scenarios would not be useful for this rule. Coast Guard regulations
address security measures for those attack scenarios in other ways.
Vessel and facility security plans must describe in detail how they
meet all relevant security requirements, including the security
measures in place for handling cargo.\20\
---------------------------------------------------------------------------

    \20\ See 33 CFR 104.405; 33 CFR 105.405; 33 CFR part 104,
subpart B; and 33 CFR part 105, subpart B.
---------------------------------------------------------------------------

    Multiple commenters expressed concern over the application process
for obtaining a new or renewal TWIC, stating that delays have saddled
workers with an undue burden. The Coast Guard understands the
challenges encountered during the initial implementation of TWIC, and
during the more recent surge of renewals. We note the progress that has
been made in the TWIC application process since publication of the
NPRM.

Furthermore, we note that comments relating to the card application
process are outside the scope of this rulemaking, which pertains to
electronic TWIC inspection requirements only.
    One commenter sought clarification as to why the TWIC was not an
acceptable form of identification for entry to U.S. Navy or Coast Guard
bases, and stated that the TWIC should be recognized by the agency that
is requiring its use within the maritime sector. This comment is also
outside the scope of this rulemaking as it does not address TWIC
readers or their application to maritime rather than Federal facilities
(e.g., Coast Guard or Navy military bases).
    One commenter expressed concern with requiring electronic readers
on vessels, stating that anyone boarding a vessel would need to first
pass through a facility. The same commenter stated that seafarers
should not be prevented from taking shore leave, and suggested that
additional regulations be put in place to avoid unlawful charges to
seafarers to transit facilities for shore leave. The Coast Guard
understands these concerns and has applied this rulemaking to those
vessels presenting the highest risk and to those vessels which, in most
cases, will regularly visit international ports not regulated under
MTSA. Additionally, Congress mandated seafarers' access in section 811
of the Coast Guard Authorization Act of 2010. This mandate requires
each Facility Security Plan to ``provide a system for seamen assigned
to a vessel at that facility, pilots, and representatives of seamen's
welfare and labor organizations to board and depart the vessel through
the facility in a timely manner at no cost to the individual.'' \21\
The Coast Guard is currently conducting a separate rulemaking to
implement section 811.\22\
---------------------------------------------------------------------------

    \21\ See the Seafarers' Access to Maritime Facilities Notice of
Proposed Rulemaking (79 FR 77981, 77985 (Dec. 29, 2014)).
    \22\ The docket for the Seafarers' Access rulemaking is
available online at www.regulations.gov by entering ``USCG-2013-
1087'' in the Search box.
---------------------------------------------------------------------------

    Several commenters requested more flexibility within this final
rule rather than a ``one size fits all'' approach. This final rule
incorporates additional flexibility for vessel and facility operators
in direct response to comments in which specific requests for
flexibility were made. The Coast Guard wholly agrees that there is no
``one size fits all'' approach for maritime security given the vast
range of facility and vessel operations which, in many cases, overlap
or occur in close proximity to each other. This final rule moves to a
more performance-based approach by defining the criteria for electronic
inspection requirements that meet the TWIC access control measures.
Additionally, this rule sets flexible baseline requirements for
electronic reader implementation for those vessels and facilities. We
believe that the increased flexibility will decrease the burden on
industry by allowing the use of existing systems with minor
modifications, increasing the pool of available electronic reader
technology, and allowing the individual operators to determine the
approach to meet the regulatory requirement that best facilitates their
business needs.
    Some commenters suggested that the TWIC should be a standardized
credential that can be used at multiple facilities, and that having
this Federal credential should be a standard credential, rather than
requiring truck drivers and others who need access to secure areas to
obtain individual site-specific badges. The commenters argued that the
use of the credential could alleviate redundant and overlapping
background checks for workers, such as drivers, that access multiple
facilities. We partially agree with this argument, but believe we
should elaborate more closely on the role that TWIC and other
identification credentials play in ensuring security at maritime
facilities. We disagree with the suggestion that the TWIC should be
used as an ``all-access'' credential that would override the property
rights and security responsibilities of vessel and facility owners. We
believe (like many other commenters), that possession of TWIC should
not automatically grant an individual access to secure areas because
the mere possession of a TWIC does not entitle the holder to access
another person's property. The decision to grant access to a secure
area of a vessel or facility appropriately lies with the owner or
operator of that vessel or facility. We expect vessel and facility
operators to limit access to their secure spaces to those who need such
access, and to ensure that only those with a valid TWIC are granted
unescorted access.
    However, we note that controlling access to facilities can be
carried out in several ways. For example, a facility may grant
unescorted access to employees who enter the facility multiple times
per day on a regular basis, and also grant access to truck or bus
drivers who may only enter the facility on an occasional basis. Such a
facility may use different ways to control access, and ensure that all
individuals granted unescorted access possess a valid TWIC. The
facility may vary how it does this depending on the operator's business
needs and on the reasons why different individuals are requesting
unescorted access. In this example, the facility might have one
entrance for employees who use a PACS card to enter secure areas of the
facility, and have another entrance for truck or bus drivers, who would
present a TWIC for inspection. A single access point could also contain
both a PACS reader and a TWIC reader, the latter for use by contractors
or visitors who may not have been issued a facility-specific access
card.
    In this final rule we have granted flexibility that allows
operators to use a variety of means to grant unescorted access,
including the use of the TWIC as a means of identification. However,
this final rule does not require operators to grant unescorted access
to any TWIC-holder. As is currently the case, access to any vessel or
facility is granted by the owner or operator, who has the authority and
responsibility to determine if the individual requesting access has a
legitimate business purpose.
1. Purpose and Efficacy of the TWIC Program
    Several commenters questioned the overall efficacy of the TWIC
program, questioning whether the program, with or without electronic
readers, does anything to improve security. The Coast Guard understands
that there have been many challenges with the implementation of the
TWIC program, but does believe that TWIC has improved access control at
vessels and at maritime facilities across the country. The TWIC
program's single standard and nationwide recognition is intended to
ensure a secure, consistent biometrically enabled credential, and
facilitate an efficient, resilient, mobile transportation workforce
during routine and emergency situations. However, an individual
successfully obtaining a TWIC is only the first half of a two-part
process. First, vessel and facility security personnel must determine
that an individual possesses a valid TWIC, meaning that they have been
vetted. Second, they must verify the individual's authorization for
entering a vessel or facility before granting the person unescorted
access. As mentioned above, the mere possession of a valid TWIC alone
is not sufficient to gain the holder of that credential access to
secure areas on vessels or facilities across the country. The TWIC
provides a means by which a vessel or facility security officer can
determine that an individual has been vetted to an established and
accepted standard. This determination

helps inform the vessel or facility security officer's decision to
grant unescorted access to an individual. Vessel and facility personnel
may then evaluate a TWIC-holder's authorization and determine whether
the TWIC-holder should be granted unescorted access.
    One commenter took issue with a statement in the NPRM that read
``TWIC readers will not help identify valid cards that were obtained
via fraudulent means, e.g., through unreported theft or the use of
fraudulent IDs.'' \23\ The commenter stated that TWIC readers can
identify cards that were obtained through unreported theft of the TWIC
card by performing biometric identification of the TWIC-holder. We
believe the commenter misunderstood the statement in the NPRM, which
referred to the use of fake or stolen (but unreported) identification
documents, such as drivers licences and birth certificates, to
fraudulently obtain an authentic TWIC from the TSA. The use of such
fraudulently acquired, but genuine TWICs was one issue highlighted by
the GAO and by several commenters as a shortcoming in the TWIC program,
and we acknowledge that the use of electronic TWIC inspection will not
address that particular scenario. However, we agree with the commenter
that if a valid TWIC was stolen after it was produced, electronic TWIC
inspection would help to identify such a card if an unauthorized person
attempted to use it. Although visual TWIC inspection could also detect
such unauthorized use, electronic TWIC inspection would do so more
effectively by using the TWIC's biometric and other security features.
---------------------------------------------------------------------------

    \23\ 78 FR 17787.
---------------------------------------------------------------------------

    Some commenters argued that visual TWIC inspection does not provide
``adequate security,'' and that electronic TWIC inspection should be
the standard procedure for all TWIC inspections, rather than used only
for high-risk vessels and facilities. The commenter made several
arguments as to why visual TWIC inspection should not be used. The
commenter quoted guidance from the National Institute of Standards and
Technology (NIST), issued with regard to identification for Federal
employees when entering Federal facilities, which stated that visual
inspection of an identification card offers little to no assurance that
the claimed identity of the individual matches the identification. The
commenter stated that visual inspection is a weak authentication
mechanism and does not provide the level of assurance that an
electronic inspection can provide. Another commenter cited the 2011 GAO
report on the TWIC program, which stated that visual TWIC inspection
was not a particularly effective means of identity verification.\24\
While we agree that electronic TWIC inspection provides a more reliable
means of identity verification than visual TWIC inspection, we disagree
with the assertion that the visual inspection provides no security
benefit. Many industries rely on photographic identification cards to
verify a card-holder's identity before granting access to accounts or
locations. Some situations may require, and justify the cost of,
additional layers of security. For example, the heightened risk at Risk
Group A vessels and facilities warrant the greater security afforded by
electronic TWIC inspection, along with the attendant costs. As
explained in this preamble and the accompanying RA, we do not believe
such costs are justified for vessels and facilities outside of Risk
Group A at this time.
---------------------------------------------------------------------------

    \24\ GAO-11-657, ``Transportation Worker Identification
Credential: Internal Control Weaknesses Need to Be Corrected to Help
Achieve Security Objectives''
---------------------------------------------------------------------------

    The commenter made several other arguments relating to visual TWIC
inspection. First, the commenter noted that there is no way for visual
TWIC inspection to determine if a TWIC has been cancelled. While we
agree that visual TWIC inspection will not perform an electronic check
against the TSA's list of cancelled TWICs, we disagree with the
suggestion that visual inspection has no value in performing the card
validity check. Security personnel perform the basic card validity
check to ensure that a TWIC has not expired by checking the card's
expiration date. A TWIC reader does the same validity check
electronically, but will further confirm card validity by finding no
match on the list of cancelled TWICs. We explain in the RA that the
costs associated with this added layer of security are warranted only
for Risk Group A vessels and facilities.
    The commenter also stated visual TWIC inspection creates
vulnerability because it relies on a ``repetitive human process,''
where the staff may become distracted or less attentive. While we agree
generally that electronic TWIC inspection is more reliable than visual
TWIC inspection, we disagree with the suggestion that visual TWIC
inspection is unreliable. We are requiring TWIC readers for Risk Group
A, in part, due to the potentially reduced human error that TWIC
readers afford. As explained in the RA, that added benefit does not
outweigh the costs associated with requiring TWIC readers outside of
Risk Group A at this time.
    One commenter stated that the background check does not ensure that
facilities are protected from crime. The Coast Guard agrees that crimes
can still be committed despite background checks, although we note that
MTSA specifically prohibits certain persons with extensive criminal
histories from receiving TWICs.\25\ However, the purpose of requiring
electronic TWIC inspection is not to prevent all crime, but to prevent
TSIs at high-risk vessels and maritime facilities. In that regard, we
believe that TWIC is a critical part of the layered approach to port
security because it establishes a minimum, uniform vetting and threat
assessment process for mariners and port workers across the country
aimed at preventing a TSI. The existing TWIC Program ensures that
workers needing routine, unescorted access to secure areas of
facilities and vessels undergo lawful status checks (for non-U.S.
citizens) and that they are vetted against a specific list in statute
of terrorism associations and criminal convictions.\26\ It provides a
standard baseline for determining an individual's suitability to enter
the secure area of a vessel or facility regulated under the MTSA. We
note that the program does not exclude everyone with a criminal record
and that most, but not all, of the permanent disqualifying crimes for a
TWIC can be waived in extraordinary circumstances.\27\ However, there
are aggressive procedures to remove a TWIC from any TWIC-holder found
to have committed one of these crimes after receiving their TWIC, or to
remove a TWIC from a TWIC-holder who is later added to any of the
terrorism associated databases.
---------------------------------------------------------------------------

    \25\ See 46 U.S.C. 70105(c) for the list of disqualifying
criminal offenses.
    \26\ 46 U.S.C. 70105 and 49 CFR 1572.103.
    \27\ 46 U.S.C. 70105 and 49 CFR part 1515.
---------------------------------------------------------------------------

    Multiple commenters suggested that the risk analysis for the NPRM
did not adequately address cargo containers and the related cargo
container facilities. One commenter suggested that container terminals
were the primary focus of the enactment of the MTSA and SAFE Port Act,
yet they are not subject to the highest level of TWIC scrutiny. The
Coast Guard disagrees that container terminals were the primary focus
of the Acts, noting that there was substantial discretion permitted by
the statutory language to implement electronic TWIC inspection
requirements. We reiterate that with regard to threats carried within
cargo

containers, electronic TWIC inspection is not particularly effective
for threat mitigation since scenarios involving container contents
(e.g., weapons, personnel) in an attack in the United States do not
require access to the container inside the secure area. The risk
analysis evaluated the consequence of an attack on the maritime
facilities themselves, deeming it reasonable to confine attack
scenarios to the facility because offsite scenarios (e.g., transfer of
container contents) are not mitigated by TWIC, but are instead the
focus of additional layers of protections in the larger MTSA regulatory
regime. Based on the MSRAM calculations relating to the effect of an
attack on a cargo container facility, the efficacy of electronic TWIC
inspections in disrupting such attacks, and considering the costs of
requiring electronic TWIC inspections, we arrived at the conclusion
that it would not be the most cost-effective approach to improving
public safety to require electronic TWIC inspection at these facilities
at this time. We would refer interested parties to the accompanying RA
for a detailed discussion of alternative regulatory approaches
considered in this rulemaking. Furthermore, we note that under existing
guidance, any facility not covered by this final rule may implement
electronic TWIC inspection on a voluntary basis for any reason.
    One commenter stated that the classification for large general
cargo container terminals was counterintuitive, because disruption to
any one of these facilities could have significant negative
consequences for the nation's economy. We understand the commenter's
perspective. However, for this rule, as part of the MSRAM analysis, we
evaluated the risk of a TSI that (1) occurs at cargo container
facilities and (2) would be less likely to occur through TWIC reader
implementation, and for these scenarios, the likelihood of long-term
disruptions to the nation's economy is assessed to be minimal.
    One commenter suggested that not placing container terminals in
Risk Group A, and thus not requiring electronic TWIC inspection, would
threaten the supply chain by allowing TWIC-holders, who have
subsequently been determined by the TSA to be a security threat to the
United States, to have unescorted access to the nation's critical
infrastructure with impunity. We disagree that not placing container
facilities in Risk Group A is tantamount to exposing those facilities
to security threats. We note that the general TWIC requirements located
in Sec.  101.515, which prohibit those who do not hold a valid TWIC
from receiving unescorted access to a secure area, is still effective
for these facilities. Container facilities may voluntarily institute
requirements for electronic verification, for example, for business
reasons. Furthermore, such facilities are subject to spot checks by the
U.S. Coast Guard where such invalidated TWIC-holders could be
discovered through the use of portable TWIC readers by Coast Guard
personnel.
    One commenter suggested that terrorists might use a small facility
to transport a weapon, thus bypassing electronic TWIC inspection
programs. Pursuant to existing requirements, unescorted access to a
secure area of any MTSA-regulated maritime facility requires a TWIC, so
all workers seeking unescorted access, not just those at high-risk
facilities, are subject to background checks. However, we note that
electronic TWIC inspection is not designed to directly protect against
smuggling, including the smuggling of terrorist weapons. Electronic
TWIC inspection is designed to ensure that unauthorized persons, who
have not been provided a TWIC, are not provided unescorted access to
high-risk vessels and facilities. Many, if not most, smuggling
scenarios do not require adversary access to secure areas for success,
and thus the enhanced access control afforded by electronic TWIC
inspection does little to reduce the risk for these scenarios.
    One commenter added that facilities are poor targets for terrorist
attacks and thus, screening workers on those facilities adds little
value. We disagree, and note that we have tailored this rule to
specifically encompass only those maritime facilities where the dangers
of a TSI are heightened, such as those that handle or receive vessels
carrying CDC in bulk. We have determined that the facilities in Risk
Group A could be attractive targets for terrorist attacks due to the
substantial loss of life and environmental effects that could result
from a TSI. Furthermore, we tailored the requirements to only require
electronic TWIC inspection when such inspection would have a
substantial effect on reducing the likelihood of such an attack (the
``TWIC utility'' prong of the risk analysis, described in detail in the
NPRM). See 78 FR 17791.
2. Risk Analysis Methodology
    Multiple commenters expressed concern with the risk analysis for
this rulemaking. While we have considered the commenters' concerns, our
risk analysis model remains unchanged from that proposed in the NPRM.
We believe that the existing risk analysis model, which considered a
wide range of targets, attacks, and consequences, remains the most
comprehensive and logical means available to implement the electronic
TWIC inspection program. In this process, the Coast Guard analyzed 68
distinct types of vessels and facilities using the MSRAM database based
on their purposes or operational descriptions. The Coast Guard
initially separated this list of vessels and facilities into proposed
Risk Groups A, B, and C in the ANPRM and have ultimately used this
baseline to inform the classification of Risk Group A vessels and
facilities in this final rule. We identify these vessels and facilities
as those that can best be protected by electronic TWIC inspection.
    The risk analysis methodology used in this rulemaking consists of
three distinct analytical factors. The first factor, which we described
in the NPRM as the ``maximum consequences to [a] vessel or facility
resulting from a terrorist attack,'' is the direct consequence of a
type of attack that could be prevented or mitigated by use of
electronic TWIC inspection. This factor was assessed for each class of
vessel and facility. The second factor, which we described as the
``criticality to the nation's health, economy, and national security,''
considered the impact of the loss of a vessel or facility beyond the
direct consequences, taking into consideration regional or national
impact on health and security. Finally, we considered TWIC utility,
which we describe as the effectiveness of the TWIC program in reducing
a vessel or facility's vulnerability to a terrorist attack.''
    It is important to note that the electronic TWIC inspection program
is not the only security measure protecting vessels and maritime
facilities, and is not designed to counter every conceivable threat to
them. In the preliminary RA, we explained that there were three
specific attack scenarios most likely to be mitigated by electronic
TWIC inspection, and thus used in our analysis. These scenarios were:
(1) A truck bomb, (2) a terrorist assault team, and (3) an explosive
attack carried out by a passenger or passerby (with the specific caveat
that the terrorist is not an ``insider'').\28\ While several commenters
criticized certain aspects of the TWIC program for not countering
additional threats, we note that benefits outside the scope of the
above threats were not considered to be likely successes of the TWIC
program and were not considered in our analysis. One commenter
suggested that the truck bomb scenario was unrealistic, as it would be
easier to

place a bomb in a container itself. We note that these are two distinct
scenarios, and that the risk identified in the latter scenario is one
that is not mitigated by electronic TWIC inspection.
---------------------------------------------------------------------------

    \28\ Preliminary RA, p.72.
---------------------------------------------------------------------------

    The first factor of the analysis was the most comprehensive, which
was to determine the direct primary and secondary consequences of the
total loss of a vessel or facility. To conduct this stage of the
analysis, we used MSRAM data. MSRAM collects data from a wide variety
of vessels and facilities and includes calculations of damages for each
individual vessel or facility. The damages incorporated into the MSRAM
analysis include: (1) Death and serious injuries; (2) direct property
damage and the costs of business interruptions; (3) environmental
consequences; (4) national security consequences; and (5) secondary
economic consequences, such as damage done to the supply chain.\29\ To
finish the first stage of analysis, we aggregated the MSRAM data from
the individual vessels and facilities into averages for each of the 68
identified classes.
---------------------------------------------------------------------------

    \29\ Preliminary RA, p.75.
---------------------------------------------------------------------------

    The second factor in the analysis considered the impact of the
total loss of the vessel or facility beyond the immediate local
consequences. This involved examining the regional and national effects
of such a loss on the state of human health, the economy, and national
security. The third factor in the analysis focused on the effectiveness
of the TWIC program in actually reducing the vessel or facility class'
vulnerability to a terrorist attack. In instances where electronic TWIC
inspection would substantially reduce the effect or likelihood of an
attack, this factor was assigned a greater value.
    Once the three analytical factors were determined, the Coast Guard
combined the scores using the Analytic Hierarchy Process (AHP),
developing a total score that combined the severity of an attack and
the effectiveness of the TWIC program in countering that attack for
each of the classes of vessels and facilities. These overall rankings
were then used to determine the Risk Groups used in developing this
rulemaking. We believe that this approach used in this risk analysis
methodology is highly effective, and represents the best method
available for assessing the benefits of the electronic TWIC inspection
program to the specific vessels and facilities under consideration.
    One commenter suggested that the Coast Guard should not finalize
this rule, and that a panel of private industry representatives should
be included in an objective review of where the risks and
vulnerabilities are in order to develop the best tool for mitigation.
The Coast Guard has taken a collaborative approach toward developing
this final rule, and has considered information from numerous
stakeholders in this rulemaking, including the large number of comments
on both the ANPRM and NPRM. As a result, the Coast Guard has amended
this final rule, targeting the affected population to those vessels for
which the use of electronic TWIC inspection provides the greatest
benefit at minimum cost. This would not have been possible without the
extensive public input received.
    One commenter suggested that previous risk assessments of their
operation had never identified a scenario in which rogue employees
played a role. We do not agree with the commenter that this weakens the
case for the implementation of electronic TWIC inspection requirements.
We note that ``rogue employees'' (no precise definition of this term
was supplied, but we assume it means an employee who intends to carry
out a TSI) are unlikely to be a threat mitigated by this final rule.
This final rule is primarily designed to identify and intercept those
adversaries who are not employees, but are attempting to use a stolen
or otherwise invalid card to gain access to a secure area. A ``rogue
employee'' with a valid TWIC would not be intercepted by electronic
TWIC inspection. The ``rogue employee'' scenario is partially addressed
by the security threat assessment that each employee must undergo
before obtaining a TWIC, and is also addressed by other layers of
security. For example, 33 CFR 104.285 and 105.275 require owners and
operators to have the capability to continuously monitor their vessels
and facilities through the use of lighting, security guards, waterborne
patrols, automatic intrusion devices, or surveillance equipment.
    The same commenter asserted that there are no facts, objective risk
assessments, or examples provided to support how a TWIC reader would
enhance security absent a known risk or vulnerability. Additionally,
the commenter broadly suggested that an owner or operator should be
allowed to self-assess and determine its own risk group category after
taking into account the security measures already in place at their own
location. We disagree with both comments. MSRAM is a fact-based,
objective tool for assessing TSI risk in the maritime domain. MSRAM
incorporates specific examples of vessels and facility types and
various attack modes. As explained in great detail in the ANPRM, NPRM,
and elsewhere in this preamble, MSRAM is an analysis tool designed to
estimate risk for potential terrorist targets. We consider MSRAM to be
the best available tool for determining which vessels and facilities
should be considered high-risk for the purpose of TWIC reader
requirements. Because electronic TWIC inspection is generally more
reliable than visual TWIC inspection, TWIC readers enhance access
control more than visual inspection, increasing the likelihood of
identifying an aggressor and denying access to secure areas. While the
above rationale applies generally to Risk Group A, the Coast Guard also
recognizes that the nature or operating conditions of certain vessels
and facilities may warrant a waiver from certain regulatory
requirements. The existing regulations in 33 CFR 104.130 and 105.130
provide that owners and operators may apply for a waiver of any
requirement of the security regulations in 33 CFR parts 104 and 105
(including the TWIC reader requirements) in appropriate circumstances
and where the waiver will not reduce overall security.
    Several commenters noted that while the Coast Guard used the MSRAM
data to conduct its risk analysis, a number of TWIC Pilot Program
participants were not contacted during this assessment. They argued
that these participants could have provided local knowledge to produce
supportable conclusions relative to risks and risk mitigation
strategies in particular locations. We believe that these commenters
misunderstand how MSRAM data were used. The Coast Guard carefully
reviewed the pilot project in writing this final rule. MSRAM datawere
used to help determine the consequences of a TSI. This was one factor
used in determining the overall risk to the various classes of
facilities analyzed in the Coast Guard's risk analysis. The Coast Guard
uses MSRAM in a variety of risk analysis applications and does not
engage in discussion with each participant every time the data are
utilized.
    Some commenters also argued that they were the subject of several
counterterrorism studies, and that these studies had not identified
TWIC as risk mitigation tool, nor had they identified a scenario in
which an employee bringing harm to a ferry was an identified
vulnerability. These studies were not provided by the commenter but,
from their descriptions, seem to have focused on risks other than those
posed by persons impersonating

employees. We note that while previous studies may not have identified
TWIC as a risk mitigation tool, we have considered various scenarios in
which electronic TWIC inspection would mitigate risk, and used them as
the basis for our risk analysis. Furthermore, we note that electronic
TWIC inspection is not designed to prevent a valid and cleared employee
from bringing harm to a vessel or facility. Instead, it is specifically
designed to prevent access to a secure area by an unauthorized person
who is attempting to gain access by using a stolen or counterfeited
TWIC. We believe that electronic TWIC inspection is an appropriate and
cost-effective tool to mitigate such risks.

B. Electronic TWIC Inspection

    Electronic TWIC inspection is the process by which the TWIC is
authenticated, validated, and the individual presenting the TWIC is
matched to the stored biometric template. This process consists of
three discrete parts: (1) Card authentication, in which the TWIC at
issue is identified as an authentic card issued by the TSA; (2) the
card validity check, in which the TWIC is compared to the TSA-supplied
list of cancelled TWICs \30\ to ascertain that it has not been revoked,
and is not expired; and (3) identity verification, in which the TWIC is
matched to the person presenting identification through use of a
biometric template stored on the TWIC.
---------------------------------------------------------------------------

    \30\ We note that at this time, this list is the Cancelled Card
List (CCL). However, there are also several specific Certificate
Revocation Lists maintained by TSA, which differ from the CCL. In
order to provide a regulation that is flexible in terms of future
technology adaptations, in this final rule, we have described the
list in the regulatory requirement generically as the ``list of
cancelled TWICs.'' See sections 101.520(b) and 101.525 of the final
rule regulatory text. This allows TSA to continue to use the CCL,
but will also allow additions from various Certificate Revocation
Lists if and when that becomes feasible and efficient. Any such
change in the list of cancelled TWICs would be a ``back end'' change
on TSA's part and would not impact the burdens or operations of
private parties, who would still only be required to check a TWIC
against the list as part of the card validity check. In this
document, we generally refer to the ``list of cancelled TWICs'' when
referring to the regulatory requirements in the final rule, while
still using the ``CCL'' terminology when discussing comments on the
Cancelled Card List or discussions in the NPRM that used that
terminology.
---------------------------------------------------------------------------

    The purpose of electronic TWIC inspection is to improve the
inspection of TWICs, as compared to visual TWIC inspection. We note
that visual TWIC inspection accomplishes the same three tasks as
electronic TWIC inspection, but in different ways, and generally not as
thoroughly or reliably as electronic TWIC inspection. Visual card
authentication is accomplished by visually inspecting the security
features on the card (such as the watermark). A visual card validity
check is accomplished by checking the expiration date on the face of
the card, although there is no way to visually check if the TWIC has
been revoked by the TSA since it was issued. Finally, visual identity
verification is conducted by comparing the photograph on the TWIC with
the individual's face.
    Electronic TWIC inspection improves upon the visual inspection
checks, and adds two additional benefits. In electronic TWIC
inspection, the authenticity of the card is verified by issuing a
challenge/response to the TWIC's unique electronic identifier, called a
Card Holder Unique Identifier (CHUID). The card's validity is
determined by checking the TWIC against the most recently updated list
of cancelled TWICs. Finally, the identity of the TWIC-holder is
verified by matching the biometric template stored on the TWIC to the
individual's biometrics. Each of these methods is an improvement upon
visual TWIC inspection as the electronic TWIC inspection uses methods
of validation that are not easily manipulated through means such as
counterfeiting or altering the surface of the TWIC. Additionally,
electronic TWIC inspection ensures that the card being presented has
not been invalidated by a means other than being expired, such as the
card having been reported lost, or the TWIC being revoked due to a
criminal conviction.
    TWIC inspection, either electronic or visual, provides a baseline
of information to determine who may be provided unescorted access to
secure areas of MTSA-regulated vessels and facilities. While not every
TWIC-holder is authorized unescorted access, the TWIC ensures that
facility security personnel do not grant unescorted access to
individuals that have not been vetted or have been adjudicated unfit
for access to secure areas.
    Several commenters suggested that the sole purpose of TWIC is for a
worker to be vetted through security and criminal checks, and that
access control is not a purpose of the TWIC program. We disagree with
this description of a fundamental principle of the TWIC program. The
controlling statute, 46 U.S.C. 70105(a)(1) reads, in part, ``[t]he
Secretary shall prescribe regulations to prevent an individual from
entering an area of a vessel or facility that is designated as a secure
area . . . unless the individual holds a transportation security card
issued under this section. . .''. This is a clear mandate for an access
control program. We have implemented this mandate by requiring maritime
workers to obtain a TWIC, and by requiring owners and operators to
inspect each individual's TWIC prior to granting access to secure
areas. Using the biometric template, TWIC provides a highly secure
means for security personnel to verify the identity of an individual
seeking access to a secure vessel or facility and implementing this
core requirement of the MTSA.
    In this final rule, we are revising the regulatory text to add
flexibility and more accurately reflect the electronic TWIC inspection
process. In the NPRM, we did not describe the process as ``electronic
TWIC inspection,'' but stated in proposed Sec.  101.520(a) that ``all
persons must present their TWICs for inspection using a TWIC reader,
with or without a . . . PACS. . .''. \31\ In this final rule, we are
modifying the process from presentation of a TWIC to a TWIC reader to
the concept of electronic TWIC inspection. As stated below, and as
defined in section 101.105 of this final rule, ``Electronic TWIC
inspection'' means the process by which the TWIC is authenticated,
validated, and the individual presenting the TWIC is matched to the
stored biometric template. In doing so, we have laid out the exact
requirements for this process in revised Sec.  101.520.
---------------------------------------------------------------------------

    \31\ 78 FR 17829.
---------------------------------------------------------------------------

    In this section, we address the comments and concerns submitted in
response to the NPRM, and describe in detail how electronic TWIC
inspection will work in a wide variety of operational situations. Table
2 provides a summary of the acceptable implementation options for
owners and operators to perform electronic TWIC inspection. The owner
or operator of a vessel or facility must ensure the options chosen to
meet the electronic TWIC inspection requirements perform the required
card authentication, card validity, and identity verification required
in revised Sec.  101.520.

                     Table 2--Implementation Options
------------------------------------------------------------------------
            Option                            Description
------------------------------------------------------------------------
TWIC Reader (QTL)............  Owner/operator uses a TWIC reader listed
                                on TSA's QTL. To gain entry to a secure
                                area, employee presents TWIC and
                                biometric for electronic inspection.
TWIC Reader (non-QTL)........  Owner/operator uses a TWIC reader that
                                adequately performs the three required
                                electronic checks (card authentication,
                                card validity check, identity
                                verification). To gain entry to a secure
                                area, employee presents TWIC and
                                biometric for electronic inspection.
Transparent Reader...........  Similar to non-QTL TWIC reader, except
                                the Transparent Reader does not
                                independently perform card validation,
                                card authentication, and identity
                                verification. Instead, the Transparent
                                Reader transmits information from the
                                employee's TWIC and biometric to a back
                                end system containing software that
                                performs the TWIC check.
                               Once the TWIC check is complete, the back
                                end system shall perform what processes
                                are required to either grant or deny
                                access.
PACS (with facility access     Employee is issued a facility access card
 card).                         after initially registering employee's
                                TWIC and biometric into the facility's
                                access control database. To gain entry
                                to a secure area, employee presents
                                facility access card and biometric for
                                electronic inspection to match against
                                employee's record in the facility's
                                database.
PACS (with biometric only)...  Employee's TWIC and biometric are
                                initially registered into the facility's
                                access control database. To gain entry
                                to a secure area, employee presents
                                biometric (e.g., fingerprint) for
                                electronic inspection to match against
                                employee's record in the facility's
                                database.
------------------------------------------------------------------------

1. Electronic TWIC Inspection Does Not Necessarily Require a TWIC
Reader
    Many commenters expressed concerns regarding the costs of
purchasing, installing, and using TWIC readers that have been approved
by the TSA. They argued that the costs of the TWIC readers were high,
and that there were problems with the reliability of TWIC readers and
cards. Many commenters requested that the Coast Guard extend guidance
issued in Navigation and Vessel Inspection Circular (NVIC) 03-07 and
Policy Advisory Council (PAC) Decision 08-09, change 1, in which we
outlined how an existing PACS could be used in lieu of a TWIC reader
until the TWIC final rule was issued.
    In NVIC 03-07, we described how TWIC could be incorporated into an
access control system even if the person accessing the secure area did
not physically use the TWIC as an access control card. We stated that:

    Example: A facility employee who possesses a valid TWIC is
registered into the facility's access control database and is issued
a facility access card after the TWIC is verified visually as
described in 3.3 a. (7) [of NVIC 03-07]. To gain entry into a secure
area, the employee inserts or scans his/her facility access card at
a card reader, which verifies the access card as a valid card for
the facility. The TWIC does not need to be used as a visual identity
badge at each entry once the facility-specific card is issued. The
card reader then verifies the individual by matching the facility
access card to the individual's record in the facility database and
allows access to secure areas as dictated by the permissions
established by the owner/operator in the access control system. By
virtue of the fact that the employee would not be issued a vessel or
facility-specific card without first having a TWIC, the requirement
to possess a TWIC for unescorted access to secure areas is met.\32\
---------------------------------------------------------------------------

    \32\ Enclosure (3) to NVIC 03-07, p. 1515 (Available in the
docket by following the instructions in the ADDRESSES section of
this preamble).

    Many commenters noted, and we are aware that, the proposed
regulatory text in the NPRM was worded in such a way that rendered this
method of compliance impossible. The proposed regulatory text in Sec.
101.520(a)(1) stated ``Prior to each entry, all persons must present
their TWICs for inspection using a TWIC reader, with or without a
physical access control system (PACS), before being granted unescorted
access to secure areas.'' \33\ Similarly, proposed Sec. Sec.  101.525
and 101.530 required visual inspections of TWICs before permitting
access. Many commenters took issue with the change in approach from
current requirements as described in the NVIC.
---------------------------------------------------------------------------

    \33\ 78 FR 17829.
---------------------------------------------------------------------------

    In this final rule, we are revising the regulatory text to allow
electronic TWIC inspection to be conducted by either a TWIC reader or a
PACS at vessels and facilities. This regulatory language will supersede
previous guidance documents such as PAC 08-09, change 1 and NVIC 03-07.
Under the new language in revised section 101.520 we are providing
greater flexibility on the type of equipment used, as long as the three
parts of electronic TWIC inspection are performed satisfactorily.
    Multiple commenters discussed the scenario where an owner or
operator has a PACS which cross-checks successful electronic TWIC
inspections against employment records and other internal security
systems and records to verify that the cardholder works for the
company, holds current certifications, and should be allowed into the
facility. As explained in this document in Section V.B., such a system
could meet the requirements for electronic TWIC inspection as revised
for this final rule.
    Two commenters at a public meeting suggested that if a facility
could prove its PACS is superior to the TWIC requirements, then the
facility should be exempt from them. Similarly, other commenters
suggested alternatives the Coast Guard could require, including a
color-coded system analogous to the former Homeland Security Advisory
System. In this final rule, we are not providing a generalized
exemption from electronic TWIC inspection requirements as suggested by
the commenters. However, as explained, such requirements can be
performed by a PACS, thus potentially eliminating the need for these
particular commenters to purchase entirely new equipment or the need
for an exemption from the electronic TWIC inspection requirements.
    Multiple commenters stated that it would be more cost effective in
some cases to purchase one or two stationary TWIC readers, but also to
purchase several portable TWIC readers for multiple temporary gates or
entrances. One commenter asked whether the final rule requires fixed
card readers at every point of access, even a temporary or infrequently
used one. The same commenter asked whether portable TWIC readers would
meet the TWIC reader requirements on an OCS facility. We clarify that
neither the NPRM nor final rule required stationary TWIC readers. The
final rule, as described above, allows for flexibility in terms of
equipment.
    The arrangements the commenters suggested could all be accommodated
by this final rule. In this final rule, we are removing prescriptive
requirements regarding the permanence, type, and placement of
electronic readers. If a

vessel or facility has an existing access control system, of any
variety, whose electronic readers perform the requirements of the
electronic TWIC inspection (including identity verification), and are
approved under the relevant security plan, then the PACS is
permissible.
    In response to the many comments we received on this issue, in this
final rule, we are substantially altering the TWIC reader requirements
to accomplish the goals set out by the TWIC reader program, but in a
manner that provides more flexibility in terms of how those goals are
met. The requirements in this final rule are designed to allow as much
flexibility in design of an access control system as possible while
still achieving the goals of the TWIC reader program.
    We believe that the increased flexibility offered by the revised,
performance-based regulations is responsive to the many commenters who
described existing access control systems that they believe are better
suited for their individual vessels and facilities than those proposed
in the NPRM. Under these final regulations, a system that accomplishes
the goals of the TWIC program and uses the three electronic checks
mandated by the regulation will be considered by the Coast Guard when
reviewing the security plans. As long as the Coast Guard agrees that
the proposed security plan accomplishes the goals in a robust fashion,
we will not limit the choices of the means to do so.
2. Integrating Electronic TWIC Inspection Into a PACS
    NVIC 03-07 and PAC 08-09 change 1 explain that they are valid
guidance until a TWIC reader final rule is issued, but many commenters
requested that these documents remain valid even after the final rule
becomes effective. Because this final rule significantly changes the
TWIC inspection process for Risk Group A vessels and facilities, the
TWIC-specific guidance provided in those documents will not continue to
apply to Risk Group A. However, because we are not making any changes
to the TWIC requirements for those vessels and facilities not in Risk
Group A, the guidance documents still retain their validity with regard
to those entities. We will update and post these guidance documents
online at https://homeport.uscg.mil/ prior to the effective date of
this final rule.
    In this final rule, we no longer require facility and vessel
operators to use a TWIC reader listed on the QTL each time a person is
granted unescorted access to a secure area. Instead, we are permitting
multiple options as previously described, including the use of a PACS
approved in the required Facility Security Plan (FSP) or Vessel
Security Plan (VSP), if the PACS can perform the electronic TWIC
inspection requirements.

    Example: A facility employee who possesses a valid TWIC is
registered into the facility's access control database and is issued
a facility access card after the TWIC is verified in accordance with
33 CFR 101.530. After the TWIC and holder of the TWIC are validated
to ensure the TWIC is issued by TSA and the holder of the TWIC is
bound to the TWIC, a biometric template of the employee is taken and
stored on the facility access control system. To gain entry into a
secure area, the employee inserts or scans his or her facility
access card at a card reader, which verifies the access card as a
valid card for the facility. The card reader then matches the
facility access card to the employee's record in the facility
database. A biometric sample from the employee is taken and matched
to the associated biometric template stored on the facility's access
control system. The facility's access control system then checks the
TWIC's CHUID to assure that the TWIC is still valid (unexpired) as
well as checks the list of cancelled TWICs to ensure that it has not
been cancelled for any other reason. Upon verification that the TWIC
is valid and the employee's biometric matches the associated
template, the facility access control system allows access to secure
areas as dictated by the permissions established by the owner or
operator in the access control system. By virtue of the fact that
the employee would not be issued a facility-specific card without
first having a TWIC, the requirement to possess a TWIC for
unescorted access to secure areas is met. The requirement for a
biometric match of the employee is met through the performance of a
match to the biometric template stored on the facility access
control system.

    We note that the requirement for electronic TWIC inspection can be
met even without the use of any sort of card reader, so long as the
three parts of the electronic TWIC inspection are met. Such a system
could be designed to use an individual's biometric check as a means of
identification, such as described below.

    Example:  A facility employee who possesses a valid TWIC is
registered into the facility's access control database and a
biometric template of the employee is taken and stored on the
facility access system. (We note that this is done after the TWIC
and holder of the TWIC are validated to ensure the TWIC is issued by
TSA and the holder of the TWIC is bound to the TWIC). To gain entry
into a secure area, the employee presents a biometric (e.g.,
fingerprint) to a biometric reader connected to the facility's
access control system. The access control system identifies the
employee from the fingerprint and then matches it to the biometric
template and the employee's TWIC information in the facility
database. The facility's access control system then checks the
TWIC's CHUID to assure that the TWIC is still valid (unexpired) as
well as checks the list of cancelled TWICs to ensure that it has not
been revoked for any other reason. Upon verification that that the
TWIC is valid and the employee's biometric matches the associated
template, the facility access control system allows access to secure
areas as dictated by the permissions established by the owner or
operator in the access control system. By virtue of the fact that
the employee would not be entered into the facility's access control
system without first having an authenticated TWIC, the requirement
to possess a TWIC for unescorted access to secure areas is met. The
requirement for a biometric match of the employee is met through the
performance of a match to the biometric template, in this case a
fingerprint stored on the facility access control system.

    Additionally, we note that although a biometric template is the
particular biometric measurement used in the TWIC application process,
an alternative biometric may be used to perform the identity
verification check required by the regulations so long as the method is
approved in the security plan. For example, as two commenters
suggested, a vascular scan could be stored on a facility's access
control system instead of a fingerprint, which could be useful in
situations where some employees have difficult-to-read fingerprints.
a. List of Acceptable TWIC Readers
    In the NPRM, the Coast Guard proposed that only certain TWIC
readers would be permitted to be used for purposes of electronic TWIC
inspection. As stated above, proposed Sec.  101.520(a)(1) read,
``[p]rior to each entry, all persons must present their TWICs for
inspection using a TWIC reader, . . .''. The term ``TWIC reader'' was
defined in proposed Sec.  101.105 as ``an electronic device listed on
TSA's Qualified Technology List . . .''. Thus, by operation of the
proposed regulatory text, TWIC readers listed on the QTL would be
required at access points to secure areas on facilities and at the
entrances to vessels requiring electronic TWIC inspection.
    TSA had not published the QTL at the time of publication of the
NPRM. Thus, in its discussion regarding the types of approved TWIC
readers, the NPRM reiterated guidance from PAC-D 01-11 regarding the
use of TWIC readers to meet the existing regulatory requirements for
effective identity verification, card validity, and card
authentication.\34\ Specifically, in that guidance document, we stated
that:
---------------------------------------------------------------------------

    \34\ 78 FR 17805.

    In accordance with 33 CFR 101.130, the Coast Guard determines
that a biometric

match using a TWIC reader from the TSA list of readers that have
passed the Initial Capability Evaluation (ICE) Test (available at:
http://www.tsa.gov/assets/pdf/twic_ice_list.pdf) to confirm that the
biometric template stored on the TWIC matches the fingerprint of the
individual presenting the TWIC meets or exceeds the effectiveness of
---------------------------------------------------------------------------
the identity verification check.

    The NPRM also noted that, in accordance with the guidance, ``TWIC
readers allowed pursuant to PAC-D 01-11 may no longer be valid after
promulgation of a TWIC reader final rule, and DHS will not fund
replacement of TWIC readers.'' \35\
---------------------------------------------------------------------------

    \35\ 78 FR 17805.
---------------------------------------------------------------------------

    In recognition of advancing technology and standards, and to
provide further flexibility to the end user that may meet business
specific needs, this final rule does not require a TWIC reader from the
TSA's QTL, accessible online at http://www.tsa.gov/stakeholders/reader-qualified-technology-list-qtl. Instead, the Coast Guard is permitting
multiple options for the implementation of electronic TWIC inspection.
The first option for meeting these needs within this final rule remains
the mechanism proposed in the NPRM, which is the use of TWIC readers
listed on the QTL. These TWIC readers are defined as ``Qualified
Readers.'' We believe that this option is most appropriate for vessels
or facilities that currently do not conduct electronic TWIC inspection
and are seeking a TWIC reader determined to be in conformance with the
TWIC Reader Hardware and Card Application Specification, available in
the online docket for this rulemaking. The QTL continues to remain
useful for this and other purposes.
    A similar option would be to use a TWIC reader that is not on the
QTL. While such electronic readers are not prohibited by this rule,
they must still meet the performance requirements of Sec.  101.520.
This performance-oriented option is intended to provide more options to
users to meet their individual needs while still relying on the TWIC as
an access control credential.
    Another option would be to use an electronic reader or combination
of separate devices--such as proximity readers, biometric readers, and
PIN pads--that would transmit the information from the TWIC and
individual seeking access to software that performs the card
authentication, card validity check, and biometric identification
functions required in Sec.  101.520. We refer to this arrangement as a
``Transparent Reader.'' In this case, for example, a Transparent Reader
would read the information from the TWIC along with the biometric
sample provided by the individual and transmit it to a back end system
containing software that performs the TWIC check. Once the TWIC check
is complete, the back end system would perform what processes are
required to either grant or deny access. This option may be highly
popular with facilities that have already invested in electronic reader
infrastructure and high tech software systems that may not be on the
QTL. In this case, much as a situation with a PACS, the operator may
have to add a biometric component, if not already in place, and modify
software to include TWIC compatibility, but would not have to replace
the entire system.
    The last option, described in detail above, would be the use of an
existing PACS, with the inclusion of biometrics, with a facility-
specific access card that uses the TWIC as the baseline credential.
This is purely a performance requirement, and would not require the use
of government-approved equipment. In this case, the PACS would be
required to match the TWIC against the list of cancelled TWICs and, if
positively matched, automatically cancel the facility access card so as
to not allow unescorted access to secure areas of the facility.
    Several commenters provided comments that addressed the specific
types of approved card readers, but we believe that many of the
concerns raised by commenters are resolved by the Coast Guard moving to
a more flexible series of options for conducting electronic TWIC
inspection. One commenter in a public meeting expressed concern that
there was not an approved card reader which he could use for cost
estimates. We note that the TSA now has a list of approved TWIC
readers, which is available on the Coast Guard's Homeport site.\36\ One
commenter suggested that this rule was not in alignment with the TSA's
Request for Information regarding development of the QTL. We disagree,
and note that the Coast Guard and TSA worked closely in developing and
implementing the electronic TWIC inspection requirements. Furthermore,
we note that with the additional flexibility afforded by this final
rule, equipment to conduct electronic TWIC inspections is available at
a wide variety of prices, depending on the manner in which electronic
TWIC inspection is conducted. Additional information on cost estimates
is provided in the final RA accompanying this final rule.
---------------------------------------------------------------------------

    \36\ We have also included the current version of the list in
the docket USCG-2007-28915.
---------------------------------------------------------------------------

    Additionally, one commenter requested that software be included on
the QTL. We note that the list of TWIC readers on the QTL includes TWIC
reader and software pairings. Beyond the physical aspects of TWIC
reader testing in terms of environmental or drop testing, a large
portion of what is tested in the QTL process is the software.
    Other commenters suggested that, based on the TWIC Pilot Program,
TWIC reader technology is still not ready for requiring TWIC readers at
facilities, and requested that this final rule be delayed. Similarly,
one commenter recommended that the Coast Guard only proceed with the
rule if it was confident in the reliability of existing TWIC readers.
We believe that not only has technology continued to improve, but also
additional flexibility has been afforded in this final rule, both of
which should alleviate problems with specific TWIC readers used in the
pilot. Vessels and facilities required to conduct electronic TWIC
inspection can choose from a wide variety of means so as to meet their
budget and operational needs. Furthermore, the flexibility built into
this final rule allows for future advancement of both card and reader
technologies in a manner that will provide for further reductions in
impact on business operations of the maritime industry.
b. PIN Pads and Biometric Input Methods
    One issue raised in the ANPRM was the use of PINs as part of the
identification process. We note that upon getting a TWIC, each TWIC-
holder is required to remember a PIN. As proposed in the NPRM, under
most circumstances, the TWIC-holder would not be required to provide
the PIN when seeking access to secure areas, except as a backup measure
when the TWIC-holder's biometric template is unreadable. For this
reason, there is no requirement that access control systems have the
capability to accept a PIN.
    Comments relating to the use of PINs were generally negative.
Several commenters specifically argued against the use of PINs. Some
commenters stated that because the PINs are rarely used, they are
seldom remembered by TWIC-holders. We agree that rarely-used PINs will
likely be forgotten, and thus the only people who would likely remember
their PINs are those who use them regularly, such as those with
impaired biometrics. Similarly, one commenter stated that 100 percent
of cardholders would need to visit one of

the TWIC enrollment centers to reset or establish a new PIN in the
event that the Coast Guard required PIN entry, implying that without
regular use of PINs, they are quickly forgotten.
    PINs would not be required or permitted as a substitute for
biometric identification of most users. Instead, this rule provides
that PINs are available as an alternative only for individuals whose
biometrics can not be read. The Coast Guard recognizes that for some
people, taking a biometric read can be problematic. For example, people
with severely injured fingers are often unable to have their
fingerprints read. For such cases, the final rule provides an
alternative means to ensure identity verification. As stated in Sec.
101.520(c)(2), the use of a PIN plus a visual TWIC inspection is an
acceptable alternative to a biometric match for individuals who are
unable to have their biometric template captured at enrollment or who
have unreadable biometrics due to injury after enrollment. For that
reason, owners and operators may find it expedient to include an
electronic reader with a PIN pad in at least some of their access
control locations to accommodate people with unreadable biometrics.
3. Comments Related to Troubleshooting TWIC
    This section elaborates on certain programmatic issues relating to
electronic TWIC inspection, specifically, how to address problems
arising if either the electronic reader or access card malfunctions. In
this section, we elaborate and expand on the provisions described in
the NPRM as well as address issues raised by commenters.
    In the NPRM, the Coast Guard proposed regulations in Sec.  101.535
that laid out requirements for TWIC inspection in special circumstances
where a malfunction in the TWIC inspection system has occurred. In
paragraph (a), we described how access could be granted in the event of
a lost, stolen, or damaged TWIC card. In paragraph (b), we proposed how
access could be granted in the event that a person's biometric template
could not be read due to either technology malfunction or the inability
of an individual to provide a biometric template. In paragraph (c), we
proposed that in the event of a TWIC reader malfunction, an individual
could still be granted unescorted access to secure areas for a period
not to exceed 7 days, provided that individual has been granted such
unescorted access in the past and is known to possess a TWIC. We note
that the period in paragraph (c) was extended to 37 days in CG-FAC
Policy Letter 12-04.
    Because the final rule, as written, sets forth a requirement for
electronic TWIC inspection rather than specifically requiring that a
TWIC be read by a TWIC reader, the text of this section needs some
alterations to account for the new flexibility. We have integrated
these alterations into the final regulatory text as detailed in the
sections below. Furthermore, we have considered the requests and
arguments of various commenters, and we are integrating many of the
ideas presented into the final rule. Finally, we have attempted to
modify and clarify the regulations where appropriate.
a. Lost, Stolen, or Damaged TWIC
    The NPRM proposed that if an individual cannot present a TWIC
because it has been lost, damaged, or stolen, the individual could be
granted unescorted access for a period of up to seven days if various
conditions were met. The conditions include the individual previously
having been granted unescorted access, being known to have had a TWIC,
being able to present alternative identification, and having reported
the TWIC as lost, stolen, or damaged to the TSA. This proposed language
was derived from existing requirements in 33 CFR parts 104 through 106.
Additionally, in CG-FAC Policy Letter 12-04, the Coast Guard allowed an
individual to be granted unescorted access for an additional 30 days
(for a total of 37 days of unescorted access), if the individual
provided proof that a replacement TWIC had been ordered. Policy Letter
12-04 also allowed unescorted access to those individuals with expired
TWICs who had applied for a TWIC renewal prior to expiration.
i. Vessels and Facilities Using a PACS
    Because the final rule provides more flexibility for electronic
TWIC inspection beyond presenting a TWIC for access control purposes,
some of the issues addressed in Sec.  101.535 are significantly
different if using a PACS to perform the electronic TWIC inspection.
For example, if an employee's TWIC is stolen and the theft is reported
to the TSA, the affected TWIC will be placed on the list of cancelled
TWICs, but the employee will still be registered in the facility's
PACS. However, upon attempting to gain access to a secure area, during
the card validity check, the affected TWIC will appear on the list of
cancelled TWICs, and thus fail the check. The revised final regulations
are designed to allow a procedure where the employee can still be
granted unescorted access until he or she can obtain a replacement TWIC
and update his or her profile in the facility access control system
with the information from the new TWIC. In this final rule, we have
added Sec.  101.550(b), which allows unescorted access to secure areas
to be granted by a facility operator for a period of up to 30 days if
the TWIC appears on the list of cancelled TWICs if the individual is
known to have had a TWIC and to have reported it lost, damaged, or
stolen.

    Example:  An individual who works at a facility where the PACS
has been linked to a TWIC card reports his or her TWIC as lost. When
presenting his or her facility access card to the PACS, the card
validity check will return a TWIC on the list of cancelled TWICs
because the TWIC has been reported lost. The FSO confirms that the
TWIC was reported as lost. In that instance, the PACS will recognize
the status of the TWIC as cancelled, but can still grant unescorted
access to secure areas to the individual for a period of up to 30
days. If, after 30 days, the individual has not linked their
facility access card to a valid TWIC, the PACS would have to deny
unescorted access to secure areas to that individual.
ii. Vessels and Facilities Using TWIC Readers
    We proposed in Sec.  101.535 that vessel or facility operators
using TWIC readers allow for temporary access in the case of a lost,
stolen, or damaged TWIC. Specifically, the Coast Guard proposed that if
a person is known to have had a TWIC, has previously been granted
unescorted access, and can present another form of acceptable
identification, and there are no other suspicious circumstances, then
the operator may grant that person access for 30 days so that they can
be issued a new TWIC.
    We received a wide variety of comments relating to the issue of
lost or stolen TWICs. One commenter argued that any allowance for
malfunctioning TWICs undermines the point of having the card at all. We
disagree, and note that the procedure is necessary to ensure smooth
operation of the TWIC system, and believe it contains enough safeguards
so as not to function as a loophole in security.
    One commenter recommended splitting the CCL into separate
categories, including categories of TWICs invalidated for
``administrative reasons.'' We disagree, because the list of cancelled
TWICs is intended to help screen out invalid cards regardless of the
reason.
    Many commenters argued that the 7-day period proposed in Sec.
101.535(a) is too short, and that the period should be extended, with a
significant number of

these commenters referring to the 30-day extension of the 7-day period
permitted by CG-FAC Policy Letter 12-04. Based upon the comments
received, which indicated that it can take longer than 7 days to be
issued a new TWIC, we have decided to include a 30-day period for this
situation in section 101.550(b) of the final rule. We believe that this
provides ample time to be issued a new TWIC, without presenting an
undue security risk. When effective, this regulation will supersede the
current guidance in CG-FAC Policy Letter 12-04, which allowed for a
total of 37 days.
b. Transportation Worker Forgets To Bring TWIC To Work Site
    The existing regulations in 33 CFR parts 104 through 106, the
policy arrangements in CG-FAC Policy Letter 12-04, as well as the
proposed regulations in Sec.  101.535, only grant unescorted access to
those individuals whose TWICs have expired or have reported their TWIC
as lost, stolen, or damaged to the TSA. For all other individuals who
fail to present a TWIC, unescorted access would be denied under
proposed Sec.  101.535(d). Thus, under the proposed regulation, an
employee who forgot his or her TWIC at home would not be permitted
unescorted access to the facility, whereas an employee whose TWIC was
stolen would be permitted unescorted access for a limited period of
time.
    We received one comment relating to the issue of forgotten TWICs
from a commenter who described such a situation in their submission to
the docket for this rulemaking. This commenter suggested that we add an
allowance for persons who forgot their TWIC at home. After reviewing
comments on the proposed rule, we reiterate our existing position that
persons who cannot present a valid TWIC, and have not reported their
TWIC as lost, stolen, or damaged to the TSA, may not be granted
unescorted access to a vessel or facility.
    We believe that providing an exemption for forgotten TWICs creates
a potential degradation in security and additional risks that outweigh
the benefits. Unlike the situation where a TWIC has been reported as
stolen or lost to the TSA and is therefore no longer valid which can be
verified by checking the list of cancelled TWICs, a claim of a
forgotten TWIC cannot be validated.
    Instead, we reiterate that under current regulation at Sec.
101.514(a), unless exempted from the TWIC requirements by Sec.
101.514(b), (c), or (d), all persons must physically possess a TWIC, or
undergo electronic TWIC inspection, prior to being granted unescorted
access to a secure area of a vessel or facility. Persons who do not
physically present a TWIC or undergo electronic TWIC inspection, and
have not reported their TWIC as lost, stolen, or damaged to the TSA,
may not be granted unescorted access.
c. Inaccessible Biometrics
    In the NPRM, we proposed two secondary authentication procedures
that could be followed in the event that a person's biometric template
could not be read by a TWIC reader or PACS due to a technology
malfunction or low quality biometric template. These alternatives were
listed in proposed Sec.  101.535(b), and allowed either the input of a
PIN or the use of an alternative biometric that has been incorporated
into the PACS. Given the change from requiring a TWIC reader to
requiring electronic TWIC inspection, some changes to this section are
needed as well. We discuss changes to this section and comments
received below.
    One commenter suggested that people with unreadable biometric
templates should be allowed to use a PACS card in addition to a PIN or
alternate biometric. We agree, and note that under the final
regulations, given that input of biometric information (including
alternatives to fingerprints) into a PACS reader may now be a common
manner of completing identification verification, the use of a PACS
card in conjunction with an alternative biometric will be an accepted
regular way to conduct an electronic TWIC inspection.
    However, upon consideration, we do not believe that the input of a
PIN alone is equivalent to biometric identification. Biometric
identification allows the facility to ascertain with a high degree of
certainty whether the individual requesting access is the TWIC-holder.
On the other hand, commenters noted that other methods of
identification verification will not detect counterfeit, stolen, or
borrowed TWICs. Similarly, the use of a PIN alone will not detect a
borrowed TWIC or PACS card or, potentially, a stolen TWIC or PACS card,
if the PIN has been illicitly obtained.
    Nonetheless, the Coast Guard believes that a method for
accommodating persons with unreadable biometrics is important. In such
cases, we believe that visual TWIC inspection, when combined with the
PIN, provides enough certainty as to be an acceptable alternative to
biometric identification. Combining visual identification with the PIN
will help to ensure that stolen and borrowed cards are difficult to
use.
    Thus, in this final rule, we are modifying the provision in
proposed Sec.  101.535(b), which allowed for PINs to be used in lieu of
biometric matching, to include a requirement for visual identification
in addition to the PIN. The new provision is located in Sec.
101.550(c) of this final rule. We believe that this provision would
present few problems, as people could use their TWICs for visual
identification. Alternatively, if a PACS PIN is assigned and stored in
the access control system, an employee with unreadable biometrics could
enter his or her PIN and present a PACS card or driver's license to
conduct a visual identification check.
d. Malfunctioning Access Control Systems
    In the NPRM, we proposed a mechanism by which persons could be
granted unescorted access to secure areas if a TWIC reader
malfunctioned. Specifically, proposed Sec.  101.535(c) allowed owners
and operators to use visual checks for a period of 7 days if a TWIC
reader malfunctioned. In light of the change in this final rule from
the required use of TWIC readers to the more flexible requirement for
electronic TWIC inspection for Risk Group A vessels and facilities, we
are making some conforming changes and clarifications to this
procedure. We received several comments on the matter, which are
addressed below.
    Upon consideration of this policy, we believe that a clause
automatically allowing the use of visual TWIC inspections in lieu of
biometric matching presents a serious security concern. As one
commenter argued, any allowance for malfunctioning TWICs undermines the
point of having the card at all. The Coast Guard agrees, and believes
that allowing the use of visual TWIC inspections in lieu of biometric
matching degrades security. This final rule represents a concerted
effort to significantly upgrade the security at a relatively small
group of high-risk vessels and facilities. Given the importance of
security, we would not expect vessels or facilities to have only a
single TWIC reader, but expect some redundancy in the system, and note
that two commenters strongly echoed the view that redundancy is needed
in any critical system. We would agree that, as a practical matter, the
minimum number of electronic readers (either dedicated TWIC readers or
those integrated into a PACS) at a facility or onboard a vessel would
be two, in case one malfunctioned. As discussed in the RA, using the
TWIC pilot data we estimated the average number of electronic readers

required by this final rule by facility and vessel types at a minimum 2
per vessel and 4 per facility (Tables 4.3 and 4.4 of the RA). While the
TWIC readers on the QTL have been tested to ensure a degree of
reliability, there are many factors external to the testing process
that could cause any one individual electronic reader to fail. The
immediate availability of a backup electronic reader should one fail
(as documented in the relevant security plan) would allow a vessel or
facility to maintain the appropriate level of security for access
control and continue operating without further burden. Due to the
security concerns discussed in this paragraph, we are removing from the
final rule the proposed provision in Sec.  101.535 that would have
permitted automatic transition to visual TWIC inspections in the event
of an electronic reader malfunction. As stated above, based on
discussions with industry we expect that owners and operators will have
an additional functioning electronic reader to use in those instances
in case of equipment failures or malfunctions (Sec. Sec.  104.260(c)
and 105.250(c)). If the owners and operators plan for malfunctions as
existing regulations require, there should be no significant disruption
of operations. Further, in the unlikely event that both primary and
redundant electronic readers malfunction, the owner or operator could
obtain permission from the Captain of the Port (COTP) to continue
operating.
    Two commenters suggested changing the language in proposed Sec.
101.535(c) from a ``reader malfunction'' to ``in the event of an access
control system failure,'' noting that many other systems (such as the
software or electricity) could fail, thus rendering an electronic
reader inoperable. As we are deleting this exemption in this final
rule, the language question is no longer at issue.
    Commenters also suggested that 7 days is not sufficient to correct
all problems that can result in a TWIC malfunction. They noted that it
might take longer to procure parts, especially after a major regional
disaster or holiday, and that a 15-day period where visual TWIC
inspection is permitted would be more reasonable. On the other hand,
one commenter suggested that it should take only hours to repair a
malfunctioning TWIC reader. In this final rule, we are removing this
provision. Thus, restoration of an access control system will be
handled in accordance with the procedures for the reporting
requirements for non-compliance in Sec. Sec.  104.125, 105.125, and
106.125, which require the owner or operator to notify the cognizant
Captain of the Port and either suspend operations or request and
receive permission from the COTP to continue operating. Similarly, in
the event of a total system collapse or regional disaster, the COTP
will work with the affected organization to restore an access control
system as expeditiously as possible.
    The following examples provide illustrations relating to scenarios
involving the failure of an access control system:

    Example:  A facility using TWIC readers at five access points
suffers equipment failure of TWIC readers at two of those access
points. The facility would still be able to permit unescorted access
through the remaining three access points. Unescorted access could
also be granted using portable TWIC readers at the two affected
access points immediately in accordance with the FSP. The facility
would be required to notify the COTP that this equipment failure
took place but could continue operations using the remaining TWIC
readers.

    Example:  A computer virus causes a facility's PACS to become
completely inoperable, but the FSP contains an alternative where
access is controlled through the use of portable TWIC readers,
compliant with Sec.  101.520, at each access point to secure areas.
The facility would be required to notify the COTP that such a
failure of the PACS had occurred, but could continue operations
uninterrupted by using the portable TWIC readers.

    Example:  A computer virus causes a facility's PACS to become
completely inoperable, and the FSP does not contain an alternative
means of conducting electronic TWIC inspection. The owner or
operator could request permission from the COTP to conduct visual
TWIC inspections for a limited time until the PACS is operational.
Grants of unescorted access to secure areas would have to be
suspended until such permission was granted by the COTP.

    Multiple commenters suggested that in the event that a TWIC reader
malfunctions, a facility should be immediately able to continue to
process workers using an alternative means defined in a security plan,
rather than requesting approval from the COTP to do so. One commenter
also suggested that an after-the-fact review by the Coast Guard could
be used in such circumstances. We note that the proposed text of Sec.
101.535(c) in the NPRM did not propose to require COTP authorization to
allow continuing operation for a period of 7 days, so we are unsure of
the provision to which the commenter may be referring. Nonetheless, the
final regulatory text allows a facility to immediately continue to
process workers using an alternative means as defined in an approved
security plan as required by Sec. Sec.  104.260(c) and 105.250(c)
without additional COTP approval.
    One commenter suggested that the Facility Security Officer (FSO)
should be able to determine if there are mitigating circumstances that
need to be implemented for a temporary time frame. In such a case, the
commenter suggested that the facility would conduct visual
identification verification in lieu of electronic TWIC inspection. We
disagree with this suggestion, for the reasons described above. The
commenter also requested that the COTP be able to waive TWIC
requirements in certain circumstances. We note that the COTP has the
power to waive requirements or impose alternative equivalent measures
generally.
    One commenter requested clarification on procedures to be used if
TSA's Web site is inaccessible and they are unable to access updates to
the CCL. In general, the owner or operator of an access control system
is required to download the TSA-supplied list of cancelled TWICs
(currently, the CCL) periodically, depending on the MARSEC level,
pursuant to Sec.  101.525 of this final rule. However, if the problem
with downloading the list is out of the operator's control, such as the
TSA Web site being down for an extended period of time, we would
consider it acceptable to continue to operate the access control system
by using the most recent version of the list available.
e. Requirements for Varying MARSEC Levels
    In the NPRM, we proposed requirements for Risk Group A vessels and
facilities that would vary based on the MARSEC level. MARSEC levels are
set to reflect the prevailing threat environment of the maritime
transportation system, including ports, vessels, facilities, and
critical assets and infrastructure located on or adjacent to waters
subject to the jurisdiction of the United States. Specifically, we
proposed to require that at MARSEC Level 1, during the card validation
process, a TWIC must be checked against a version of the list of
cancelled TWICs that is no more than 7 days old. However, at higher
MARSEC levels, we proposed that the version of the list used to conduct
the card validity check be no more than one day old. Several commenters
responded to this issue, and offered remarks relating to the use of
MARSEC levels overall.
    One commenter agreed with the Coast Guard's proposal to require, at
a minimum, weekly updates of the CCL at MARSEC Level 1 and daily
updates of the CCL at higher MARSEC levels.

Another commenter stated that we did not adequately clarify how
different MARSEC levels would interact with Risk Groups A, B, and C. In
response, we note that vessels and facilities that were proposed to be
classified as Risk Groups B or C are not affected by this final rule,
and that MARSEC interacts with Risk Group A as described in Sec.
101.525. We have moved the MARSEC level requirements to this separate
section to improve clarity.
    Several commenters suggested that electronic TWIC inspection should
only consist of card validation and card authentication at MARSEC Level
1, and that the Coast Guard should provide the flexibility for them to
use electronic TWIC inspection for biometric matching purposes at
higher MARSEC levels, or require it only at those levels. Other
commenters recommended that electronic TWIC inspection should only be
required once per day at MARSEC Level 1, with additional measures, such
as full electronic TWIC inspection or random spot checks, implemented
only at higher MARSEC levels. One commenter recommended that electronic
TWIC inspection be used only at higher MARSEC levels, with visual TWIC
inspections performed the rest of the time. We disagree with these
suggestions. We believe that Risk Group A vessels and facilities should
be secured at all times, not just at rare moments of heightened alert,
and that biometric identification, one of the TWIC's strongest security
features, should be used regularly. Based on the experience with the
pilot, we also believe that consistency in electronic TWIC inspection
processes is important, as varying use of security features can create
confusion that can hinder operations.
    One commenter suggested that the CCL should be updated daily at all