subchapter D, that carry any flammable or combustible liquid cargoes or
residues.
    (3) Facilities that receive vessels certificated to carry 500 to
1,000 passengers.
    (4) Facilities that receive towing vessels engaged in towing a
barge or barges carrying hazardous materials other than CDC in bulk,
crude oil, or towing vessels certificated to carry 500 to 1,000
passengers.
Risk Group C
    (1) Facilities that receive vessels carrying non-hazardous cargoes
not otherwise included in Risk Groups A or B.
    (2) Facilities that receive vessels certificated to carry less than
500 passengers.
    (3) Facilities that receive towing vessels engaged in towing a
barge carrying non-hazardous cargoes or less than 500 passengers.
    This NPRM proposes to classify all OCS facilities subject to 33 CFR
part 106 into Risk Group B.
    As discussed more fully above in Section III.C., we used the AHP to
conduct a risk-based analysis of MTSA-regulated vessels and facilities.
We identified 68 distinct types of vessels and facilities based on
their purpose or operational description. We then assessed each of the
68 types of vessels and facilities using three factors: (1) Maximum
consequences to that vessel or facility resulting from a terrorist
attack; (2) criticality to the nation's health, economy, and national
security; and (3) utility of the TWIC in reducing risk.
    For the first factor, we used the Coast Guard's MSRAM terrorism
risk-analysis tool to calculate the maximum potential consequence
resulting from the total loss of a target, factoring in injury and loss
of life, economic and environmental impact, symbolic effect, and
national security impact. We averaged these MSRAM consequences within
each of the 68 types to develop a standard consequence for each type.
    For the second and third factors, we considered the impact of the
total loss of a vessel or facility beyond the immediate local
consequences, and the utility of the TWIC program in reducing a vessel
or facility's vulnerability to a terrorist attack.
    Using the AHP, we combined the above three factors and developed an
overall risk ranking of vessels and facilities by type. At the end of
this process, types of vessels and facilities with similar scores were
combined into one of three risk groups. This NPRM proposes to classify
vessels and facilities into Risk Groups A, B, and C based on the AHP
risk rankings.
    Upon further analysis of the data generated through the AHP
process, we note that certain types of facilities currently categorized
in Risk Group B have relatively high MSRAM consequence scores. These
facilities include petroleum refineries,\78\ non-CDC bulk hazardous
materials facilities, and petroleum storage facilities. Due to their
high MSRAM consequence scores, we are considering whether TWIC reader
requirements would be appropriate for these three types of facilities
and to include these types of facilities into Risk Group A. Note,
however, that despite the relatively high consequence scores for these
three facility types, they do not handle CDC in bulk. Like all Risk
Group B facilities, these three facility types pose less operational
risk than Risk Group A facilities because they do not handle CDC in
bulk. We are soliciting public comments on this issue. Specifically, we
request public comments on whether any or all of petroleum refineries,
non-CDC bulk hazardous materials facilities, and petroleum storage
facilities should be categorized in Risk Group A. We also seek public
comments on how to define these facilities for the purpose of this
rulemaking. Please see Section V., ``Regulatory Analyses'' below for a
discussion of the costs and benefits associated with this alternative.
---------------------------------------------------------------------------

    \78\ Note that Risk Group A, as currently proposed in the NPRM,
captures certain petroleum refineries. In the NPRM, Risk Group A
includes refineries that handle Certain Dangerous Cargoes (CDCs) in
bulk or receive vessels that do the same. There are 16 such
refineries.
---------------------------------------------------------------------------

K. Movement Between Risk Groups

    We propose to add 33 CFR 104.263(d) and 105.253(d) to address the
movement between risk groups by vessels and

facilities, based on the materials they are carrying or handling, or
the types of vessels they are receiving at any given time. These
regulatory provisions are designed to provide flexibility to owners and
operators of vessels and facilities that only meet the Risk Group A
criteria on a periodic basis. These provisions are not mandatory. The
owner or operator of such a vessel or facility could choose to maintain
its Risk Group A status, even during those periods when the vessel or
facility is not handling or carrying materials that meet the Risk Group
A criteria. However an owner or operator wishing to take advantage of
one of these provisions would be required to explain how the vessel or
facility would move between risk groups in an amended security plan.
The security plan would be required to account for the timing of such
movement, as well as how the owner or operator would comply with the
requirements of the higher- and lower-level risk groups, with
particular attention to the security measures to be taken when moving
from a lower-level risk group to a higher-level risk group.

L. Physical Placement of TWIC Readers

    We propose to amend 33 CFR 104.265(a)(4) by requiring a vessel
owner or operator to place TWIC readers at the vessel's access points
only, regardless of whether the secure area encompasses the entire
vessel. Thus, even if the secure area does not encompass the entire
vessel (e.g., a passenger vessel consisting of secure areas and
passenger and employee access areas), TWIC readers would be required
only at the points of access to the vessel itself. TWIC-holders may be
granted unescorted access to the vessel's secure areas after the TWIC
has been verified, validated, and authenticated at a vessel access
point. TWIC-holders may then move from passenger/employee access areas
to secure areas without processing through a TWIC reader each time.
    We propose to amend 33 CFR 105.255(a)(4) by requiring a facility
owner or operator to place TWIC readers at the access points to a
facility's secure areas. If the entire facility is designated as a
secure area, then TWIC readers would be required only at the facility's
access points. If the secure area does not encompass the entire
facility, then TWIC readers would be required at access points to the
secure areas.
    We request additional comments from the public on the proposed
regulatory provisions regarding the placement of TWIC readers for
vessels and facilities.

M. Technical Amendments

    We propose several technical amendments to remove references to
dates no longer relevant and to add or change cross-references within
the regulations to align with the proposed new or updated provisions.
These amendments appear at 33 CFR 101.514, 101.515(d)(2), 104.105(d),
104.115(c), 104.200(b), 104.260(d)(1), 104.265(d)(1), 104.265(e)(8),
104.265(f)(11), 104.267(a), 104.292(b), 104.292(e), 104.405(a)-(b),
105.110(b), 105.115(c)-(d), 105.200(b), 105.255(d)(1), 105.255(e)(8),
105.255(f)(10), 105.257(a), 105.290(b), 105.296(a)(4), 105.405(a)-(b),
106.110(d)-(e), 106.200(b), 106.260(d)(1), 106.260(e)(5),
106.260(f)(9), 106.262(a), and 106.405(a)-(b).

N. Privacy

    When an individual's TWIC is scanned using a TWIC reader, the TWIC
reader captures limited information, including the TWIC-holder's FASC-N
as well as the date and time of the scan. The TWIC-holder's name would
also be captured in limited circumstances, depending on the type of
TWIC reader employed. For example, a TWIC reader only captures the
TWIC-holder's name when operating in ``contact'' mode,\79\ and only
after the TWIC-holder enters a 6-8 digit PIN.\80\ An integrated PACS
may also capture the name of the TWIC-holder.
---------------------------------------------------------------------------

    \79\ ``Contact'' TWIC readers perform a scan when an individual
inserts a TWIC into a slot to provide direct contact between the
device and the computer chip imbedded in the TWIC.
    \80\ As discussed in this preamble, the Coast Guard has observed
operational challenges and limited utility associated with PIN
usage. Therefore, the proposed rule would not require owners and
operators to check TWIC-holder PINs. Owners and operators who wish
to enhance access control would be allowed to require workers to
input PIN information. However, because of the noted operational
challenges and limited utility, the Coast Guard does not expect
widespread PIN usage. Therefore, the Coast Guard does not expect
TWIC readers to capture name information in most instances.
---------------------------------------------------------------------------

    The proposed rule contains recordkeeping requirements for owners or
operators using TWIC readers. Owners and operators using TWIC readers,
with or without a PACS, would be required to maintain certain records
for at least 2 years. During that time, owners and operators would be
required to make those records available to the Coast Guard upon
request. Those records include, with respect to each individual granted
unescorted access to a secure area: (1) FASC-N; (2) date that access
was granted; (3) time that access was granted; and (4) if captured, the
name of the individual to whom access was granted.
    If a TWIC reader or PACS captures the required data when the TWIC
is scanned, and can retain and reproduce that data, the recordkeeping
requirement would be met. Owners and operators would also be required
to maintain records to demonstrate that they have performed the
required card validity check using the CCL on each individual. The
proposed rule also contains a regulatory provision indicating that TWIC
reader records are SSI, and must be protected in accordance with 49 CFR
part 1520.\81\
---------------------------------------------------------------------------

    \81\ In accordance with 49 U.S.C. 114(s), Sensitive Security
Information (SSI) is information obtained or developed in the
conduct of security activities, including research and development,
the disclosure of which TSA has determined would: (1) Constitute an
unwarranted invasion of privacy (including, but not limited to,
information contained in any personnel, medical, or similar file);
(2) reveal trade secrets or privileged or confidential information
obtained from any person; or (3) be detrimental to the security of
transportation. Part 1520 of Title 49 of the CFR generally requires
that SSI be properly marked and protected from unauthorized
disclosure. Unauthorized disclosure of SSI is grounds for a civil
penalty and other enforcement or corrective action by DHS, and
appropriate personnel actions for Federal employees. Corrective
action may include issuance of an order requiring retrieval of SSI
to remedy unauthorized disclosure or an order to cease future
unauthorized disclosure.
---------------------------------------------------------------------------

O. Public Comment

    The Coast Guard invites comments on the risk-based approach to
categorizing facilities and vessels and the assumptions and estimates
used in the ``Preliminary Regulatory Analysis and Initial Regulatory
Flexibility Analysis,'' which is available in the public docket for
this rulemaking. Specifically, the Coast Guard requests comments on the
following:
    1. We request comments from the public on the risk-based approach
to classifying facilities and vessels including the use of MSRAM in the
risk-based approach.
    2. We request comments from the public regarding the incremental
security benefits of requiring TWIC readers for higher-risk facilities
and vessels. We request comments from the public on the security
benefits of performing TWIC-holder identification, validation, and
authentication via a TWIC reader instead of visual inspection.
    3. We request comments from the public regarding the expected
lifespan and replacement cycle for TWIC readers.
    4. We request comments from owners and operators of Risk Group A
facilities and vessels on the maintenance costs associated with the
proposed TWIC reader requirements.
    5. We request comments from owners and operator of MTSA-regulated
vessels

and facilities already using TWIC readers, and whether the proposals in
this NPRM would require additional investments, e.g., new readers or
supporting infrastructure?
    6. We request comments from owners and operators of MTSA-regulated
vessels and facilities on the additional hours of TWIC reader training
that would result from this proposed rule.
    7. We request comments from the public regarding our estimates that
it would take 25 hours to create an addendum for each VSP and FSP.
    8. We request comments from the public on potential delays due to
TWIC reader use and the associated cost estimates used in this proposed
rule.
    9. We request comments from owners and operator of MTSA-regulated
vessels and facilities already using TWIC readers on the types and
frequency of TWIC reader failures.
    10. We request comments from the public on the expected rates at
which TWICs will need to be replaced during implementation and all
subsequent years.
    11. We request comments from owners and operators of Risk Group A
vessels and facilities regarding whether they intend to require the use
of PINs, how often will PINs be used, and in what scenarios. What
percentage of TWIC-holders do not currently remember their PIN, and
also how many TWIC-holders are anticipated to travel to an enrollment
center to retrieve their PIN?
    12. We request comments from the public on the anticipated
frequency of the use of an escort and the availability of escorts to
provide access to secure areas in the cases of an invalid TWIC reader
transaction.
    13. We request comments from the public on any additional costs or
benefits to TWIC reader requirements not accounted for in this NPRM.
    14. We have clarified in the preamble to this NPRM that a facility
that receives Risk Group A vessels would be categorized as a Risk Group
A facility. We request additional comments from the public on specific
scenarios that might warrant further consideration of potential
regulatory requirements to address the interaction of vessels and
facilities in different risk groups.
    15. We seek comments from the public on whether the additional
flexibility of being able to modify a facility's security footprint by
assigning different portions of the facility to different risk groups
is necessary or appropriate. Please be as specific as possible in
explaining how this would apply to your facility.
    16. We request comments from the public regarding practical
scenarios in which a vessel might not be able to download necessary CCL
updates within the prescribed frequency (weekly or daily, depending on
MARSEC Level). Additionally, we request comments from the public
regarding the regulatory requirements that we should put in place when
vessels are in one of those scenarios. In those scenarios, should we
require the use of TWIC readers for identity verification, card
authentication, and card validity, even though the CCL might not have
been updated within the prescribed frequency? Should we require the
owner or operator to update the CCL at the next available opportunity?
What other alternatives should we consider?
    17. We request comments from the public on the proposed regulatory
provisions regarding the placement of TWIC readers for vessels and
facilities, and how to minimize crewmembers from entering secure and/or
restricted areas if they do not hold a TWIC.
    18. We request comments from the public regarding whether 7 days is
a sufficient amount of time in which to expect resolution of a typical
TWIC reader or communication systems malfunction.
    19. We request comments from the public on the proposal to exempt
all vessels with 14 or fewer TWIC-holding crewmembers from TWIC reader
requirements, including whether 14 is an appropriate cut-off number.
Please explain and provide available data to support your comments.
    20. We request comments from the public on whether any or all of
petroleum refineries, non-CDC bulk hazardous materials facilities, and
petroleum storage facilities should be categorized in Risk Group A. We
also request comments from the public on how to define these facilities
for the purpose of this rulemaking.
    21. We request comments from the public on whether there is a
population of State-licensed vessel pilots that are not otherwise
required to obtain a TWIC because they access secure areas of MTSA-
regulated vessels.
    22. We request comments from the public on the proposal for Risk
Group A to update CCL information at different frequencies (weekly or
daily) depending on MARSEC Level.
    23. We request comments from the public on whether this rule may
help to reduce criminal activity at ports and on vessels. Please
describe any anecdotal evidence or data to support your comments.
    24. We request comments from the public on the characterizations
and conclusions in the preamble to this NPRM of the TWIC Pilot, and how
we used the findings from the TWIC Pilot to inform the NPRM.
    25. We request comments from the public on any other matters
relevant to the proposals in this NPRM and whether there are additional
data sources that we should consider. If there are, please include
information in your comments about these data sources and the reason
for their relevance.

V. Regulatory Analyses

    We developed this proposed rule after considering numerous statutes
and executive orders related to rulemaking. Below we summarize our
analyses based on 13 of these statutes or executive orders.

A. Regulatory Planning and Review

    Executive Orders 12866 (``Regulatory Planning and Review'') and
13563 (``Improving Regulation and Regulatory Review'') direct agencies
to assess the costs and benefits of available regulatory alternatives
and, if regulation is necessary, to select regulatory approaches that
maximize net benefits (including potential economic, environmental,
public health and safety effects, distributive impacts, and equity).
Executive Order 13563 emphasizes the importance of quantifying both
costs and benefits, of reducing costs, of harmonizing rules, and of
promoting flexibility. This proposed rule is a significant regulatory
action under section 3(f) of Executive Order 12866, Regulatory Planning
and Review. OMB has reviewed it under that Order. It requires an
assessment of potential costs and benefits under section 6(a)(3) of
that Order. A draft Assessment is available in the docket where
indicated under the ``Public Participation and Request for Comments''
section of this preamble. A summary of the Assessment follows:
    We propose amending our regulations on certain MTSA-regulated
vessels and facilities to include requirements for electronic TWIC
readers to be used for access control for unescorted access to secure
areas.
    The following table summarizes the costs and benefits of this
proposed rule.

               Table 1--Summary of Costs and Benefits \82\
------------------------------------------------------------------------
             Category                               NPRM
------------------------------------------------------------------------
Applicability.....................  High-risk MTSA-regulated facilities
                                     and high risk MTSA-regulated
                                     vessels with greater than 14 TWIC-
                                     holding crew.
Affected Population...............  38 vessels.
                                    532 facilities.
Costs ($ millions, 7% discount      $26.5 (annualized).
 rate).                             $186.1 (10-year).
Costs (Qualitative)...............  Time to retrieve or replace lost
                                     PINs for use with TWICs.
Benefits (Qualitative)............  Standardization of access control
                                     and credential verification
                                     throughout industry.
                                    Enhanced access control and security
                                     at U.S. maritime facilities and
                                     onboard U.S. flagged vessels.
                                    Reduction of human error when
                                     checking identification and manning
                                     access points.
------------------------------------------------------------------------

    In this NPRM, we propose to require owners and operators of certain
vessels and facilities regulated by the Coast Guard under 33 CFR
Chapter I, subchapter H, to use electronic readers designed to work
with TWIC as an access control measure. This NPRM also proposes
additional requirements associated with electronic TWIC readers,
including recordkeeping requirements for those owners and operators
required to use an electronic TWIC reader, and amendments to security
plans previously approved by the Coast Guard to incorporate TWIC
requirements.
---------------------------------------------------------------------------

    \82\ For a more detailed discussion of costs and benefits, see
the full Preliminary Regulatory Analysis and Initial Regulatory
Flexibility Analysis available on the docket for this rulemaking.
Appendix G of that document outlines the costs by provision and also
discusses the complementary nature of the provisions and the
subsequent difficulty in distinguishing independent benefits from
individual provisions.
---------------------------------------------------------------------------

    The proposals in this NPRM, once final, would enhance the security
of vessels, ports, and other facilities by ensuring that only
individuals who hold TWICs are granted unescorted access to secure
areas at those locations. It would also further implement the MTSA
transportation security card requirement, as well as the SAFE Port Act
electronic TWIC reader requirements.
    We estimate that this proposed rule would specifically affect
owners and operators of MTSA-regulated vessels and facilities in Risk
Group A with additional costs. As previously discussed, Risk Group A
would consist of those vessels and facilities with highest consequence
for a TSI. Affected facilities in Risk Group A would include: (1)
Facilities that handle CDC in bulk; (2) Facilities that receive vessels
certificated to carry more than 1,000 passengers; and (3) Barge
fleeting facilities that receive barges carrying CDC in bulk. Affected
vessels in Risk Group A would include: (1) Vessels that carry CDC in
bulk; (2) Vessels certificated to carry more than 1,000 passengers; and
(3) Towing vessels engaged in towing barges subject to (1) or (2). In
addition, this proposal provides a TWIC Reader exemption for vessels
with 14 or fewer TWIC-holding crewmembers, further reducing the number
of affected vessels in Risk Group A.
    Based on the risk-based hierarchy described in the preamble of this
NPRM and data from the Coast Guard's MISLE database, we estimate this
proposed rule would affect 532 facilities and 38 vessels with
additional costs. All of these facilities and vessels are in Risk Group
A.
    To estimate the costs for this proposal, we use data from the TWIC
Pilot, which was broken down by facility type, to estimate a cost per
TWIC reader deployed for installation, integration, and PACS
integration, where applicable. By distilling the costs from the TWIC
Pilot down to a per TWIC reader cost by facility type, we are able to
smooth out the varied costs in the TWIC Pilot and effectively normalize
the TWIC Pilot costs before extrapolating out over the full affected
population of this rulemaking.
    The primary cost driver for this proposed rule is the capital cost
associated with the purchase and installation of TWIC readers into
access control systems. These costs include the cost of TWIC reader
hardware and software, as well as costs associated with the
installation, infrastructure, and integration with a PACS. Operational
costs associated with this rulemaking, include security plan
amendments, recordkeeping, CCL updates, training, and system
maintenance. We also include operational and maintenance costs, which
we estimate to be five percent of the cost of the TWIC reader hardware
and software and are incurred annually. Table 2 shows the 10-year
period of analysis for the total costs by facility type. These facility
costs do not include costs associated with delays or replacement of
TWICs, which are discussed later. These estimates include capital
replacement costs for TWIC reader hardware and software beginning 5
years after implementation.

                                Table 2--10-Year Total Costs, by Facility Type *
                                                  [$ Millions]
----------------------------------------------------------------------------------------------------------------
                                        Bulk    Break bulk                 Large       Small     Mixed
                Year                   liquid   and solids   Container   passenger   passenger    use     Total
----------------------------------------------------------------------------------------------------------------
1...................................    $37.2         $2.7        $0.9       $11.3        $5.0     $5.0    $62.2
2...................................     38.1          2.8         0.9        11.6         5.2      5.2     63.8
3...................................      2.0          0.1         0.0         0.6         0.3      0.3      3.3
4...................................      2.0          0.1         0.0         0.6         0.3      0.3      3.3
5...................................      2.0          0.1         0.0         0.6         0.3      0.3      3.3
6...................................     14.1          1.0         0.3         4.3         1.9      1.9     23.6
7...................................     14.1          1.0         0.3         4.3         1.9      1.9     23.6
8...................................      2.0          0.1         0.0         0.6         0.3      0.3      3.3
9...................................      2.0          0.1         0.0         0.6         0.3      0.3      3.3

10..................................      2.0          0.1         0.0         0.6         0.3      0.3      3.3
                                     ---------------------------------------------------------------------------
    Total Undiscounted..............    115.3          8.4         2.7        35.2        15.7     15.6    193.0
                                     ---------------------------------------------------------------------------
    Total Discounted at 7%..........     94.0          6.9         2.2        28.7        12.8     12.7    157.2
                                     ---------------------------------------------------------------------------
    Total Discounted at 3%..........    105.1          7.7         2.5        32.1        14.3     14.2    175.9
----------------------------------------------------------------------------------------------------------------
Note: Numbers may not total due to rounding.
* These facilities are regulated because they handle CDC or more than 1,000 passengers. In the U.S. marine
  transportation system, facilities often handle a variety of commodities and provide a variety of commercial
  services. These facility types have different costs based on physical characteristics, such as the number of
  access points that would require TWIC readers, and other data received from the TWIC Pilot Study. See the
  Preliminary Regulatory Analysis and Initial Regulatory Flexibility Analysis for details on different facility
  types and data from the TWIC Pilot Study.

    To account for potential opportunity costs associated with the
delays as a result of the TWIC reader requirements, we estimate a cost
of delay associated with failed reads.\83\ We provide a range of delay
costs based on different delays in seconds and also based on the number
of times a TWIC-holder may have their card read on a weekly basis. By
using a range of delay costs, we are able to account for multiple
scenarios where an invalid TWIC reader transaction would lead to the
use of a secondary processing operation, such as a visual inspection,
additional identification validation, or other provisions as set forth
in the FSP.\84\
---------------------------------------------------------------------------

    \83\ Delays may result from operational, human- or weather-
related factors.
    \84\ The Preliminary Regulatory Analysis and Initial Regulatory
Flexibility Analysis contains a discussion of the different failure
mode scenarios where an invalid TWIC reader transaction would lead
to potential delays and the use of secondary processing.

                                Table 3--Cost of Delays Due to Invalid Transaction per Year, for Risk Group A Facilities
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                            1 Read per      2 Reads per     3 Reads per     4 Reads per     5 Reads per
                                                               week            week            week            week            week           Average
--------------------------------------------------------------------------------------------------------------------------------------------------------
6 Seconds...............................................         $91,244        $182,489        $273,733        $364,977        $456,221        $273,733
14 Seconds..............................................         212,903         425,807         638,710         851,613       1,064,517         638,710
30 Seconds..............................................         456,221         912,443       1,368,664       1,824,886       2,281,107       1,368,664
60 Seconds..............................................         912,443       1,824,886       2,737,328       3,649,771       4,562,214       2,737,328
120 Seconds.............................................       1,824,886       3,649,771       5,474,657       7,299,543       9,124,428       5,474,657
Average.................................................         699,539       1,399,079       2,098,618       2,798,158       3,497,697       2,098,618
--------------------------------------------------------------------------------------------------------------------------------------------------------

    For the purposes of this analysis, we used the cost of delay
estimate of $2.1 million per year, which represents the average delay
across all iterations of delay times and TWIC reader transactions.
    The use of TWIC readers would also increase the likelihood of
faulty TWICs (TWICs that are not machine readable) being identified and
the need for secondary screening procedures so affected workers and
operators can address these issues.\85\ If a TWIC-holder's card is
faulty and cannot be read, the TWIC-holder would need to travel to a
TWIC Enrollment Center to get a replacement TWIC, which results in
additional travel and replacement costs. To account for this, we
estimate a cost for a percentage of TWIC-holders to obtain replacement
TWICs.
---------------------------------------------------------------------------

    \85\ Although current regulations require that TWICs be valid
and readable upon request by DHS or law enforcement personnel, we
anticipate that widespread use of TWIC readers will initially
identify more unreadable cards. However, we expect the regular use
of TWIC readers to ultimately serve to enhance compliance with
current TWIC card validity and readability requirements.
---------------------------------------------------------------------------

    Based on information from the TWIC Pilot, we estimate that
approximately five percent of TWIC-holders associated with Risk Group A
would need to replace TWICs that cannot be read. We estimate that this
would cost approximately $262.37 per TWIC-holder to travel to a TWIC
Enrollment center and get a replacement TWIC.\86\ Overall, we estimate
that TWIC replacement would cost approximately $1.9 million per year
for TWIC transactions involving Risk Group A facilities. We assume this
is an annual cost, though we anticipate that the rate of TWIC
replacements will decrease as TWIC reader use increases, since the
number of unreadable TWICs initially identified will decrease as the
regular use of TWIC readers will serve to enhance TWIC validity and
readability.
---------------------------------------------------------------------------

    \86\ This cost is explained in greater detail in the Preliminary
Regulatory Analysis and Initial Regulatory Flexibility Analysis. It
includes an estimated $202.37 for the average TWIC-holder to travel
to a TWIC Enrollment Center, cost to be away from work, wait time at
the Enrollment Center, and the $60 fee for a replacement TWIC. Some
TWIC-holders may not need to pay a replacement fee if the TWIC is
determined faulty as a result of the card production process.
However, these TWIC-holders would still need to travel to a TWIC
Enrollment Center to get a replacement TWIC.
---------------------------------------------------------------------------

    Table 4 shows the average initial phase-in and annual recurring
costs per facility by facility type. This includes capital,
operational, delay, and TWIC replacement costs due to invalid TWIC
reader transactions. It does not, however, account for vessel costs.
Table 5 shows the total cost to facilities over the 10-year period of
analysis by facility type. This includes capital, operational, delay,
and TWIC replacement costs due to invalid TWIC reader transactions.

                                                      Table 4--Per Facility Cost, by Facility Type
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                          Break bulk and                       Large           Small
               Phase-in & recurring costs                   Bulk liquid       solids         Container       passenger       passenger       Mixed use
--------------------------------------------------------------------------------------------------------------------------------------------------------
Initial Phase-in Cost...................................        $256,267        $347,901        $604,007        $252,324        $164,011        $169,136
Annual Recurring cost...................................          14,531          19,727          34,248          14,307           9,300           9,590
Annual Recurring cost with Equipment Replacement........          94,399         128,154         222,493          92,947          60,415          62,303
--------------------------------------------------------------------------------------------------------------------------------------------------------

                     Table 5--10-Year Total Cost Risk Group A Facilities, by Facility Type *
                                                  [$ Millions]
----------------------------------------------------------------------------------------------------------------
                                 Bulk     Break bulk                 Large       Small
            Year                liquid    and solids   Container   passenger   passenger   Mixed use     Total
----------------------------------------------------------------------------------------------------------------
1...........................       $38.3        $2.8        $0.9       $11.7        $5.2        $5.2       $64.2
2...........................        40.5         3.0         1.0        12.4         5.5         5.5        67.8
3...........................         4.3         0.3         0.1         1.3         0.6         0.6         7.3
4...........................         4.3         0.3         0.1         1.3         0.6         0.6         7.3
5...........................         4.3         0.3         0.1         1.3         0.6         0.6         7.3
6...........................        16.5         1.2         0.4         5.0         2.2         2.2        27.6
7...........................        16.5         1.2         0.4         5.0         2.2         2.2        27.6
8...........................         4.3         0.3         0.1         1.3         0.6         0.6         7.3
9...........................         4.3         0.3         0.1         1.3         0.6         0.6         7.3
10..........................         4.3         0.3         0.1         1.3         0.6         0.6         7.3
                             -----------------------------------------------------------------------------------
    Total Undiscounted......       137.9        10.1         3.3        42.1        18.7        18.7       230.8
                             -----------------------------------------------------------------------------------
    Total Discounted at 7%..      $109.6        $8.0        $2.6       $33.4       $14.9       $14.9      $183.3
                             -----------------------------------------------------------------------------------
    Total Discounted at 3%..      $124.2        $9.1        $3.0       $37.9       $16.9       $16.8      $207.9
----------------------------------------------------------------------------------------------------------------
* This table includes the costs to facilities as well as additional costs such as delay, travel, and TWIC
  replacement costs due to TWIC failures.

    For the 38 Risk Group A vessels with greater than 14 TWIC-holding
crewmembers, we assume that each vessel will comply with the
requirements by purchasing two portable TWIC readers and deploying them
at the main access points of the vessel. We estimate the annualized
costs to vessels of this rulemaking to be approximately $0.4 million at
a 7 percent discount rate. These costs are shown in Table 6.

                                           Table 6--Total Vessel Costs
                           [Risk Group A with more than 14 TWIC-holding crewmembers] *
----------------------------------------------------------------------------------------------------------------
                              Year                                 Undiscounted         7%              3%
----------------------------------------------------------------------------------------------------------------
1...............................................................      $1,257,866      $1,175,576      $1,221,229
2...............................................................         132,114         115,394         124,530
3...............................................................         132,114         107,845         120,903
4...............................................................         132,114         100,789         117,382
5...............................................................         132,114          94,196         113,963
6...............................................................       1,145,036         762,986         958,949
7...............................................................         132,114          82,274         107,421
8...............................................................         132,114          76,892         104,292
9...............................................................         132,114          71,861         101,255
10..............................................................         132,114          67,160          98,305
                                                                 -----------------------------------------------
    Total.......................................................      $3,459,815      $2,654,972      $3,068,229
                                                                 -----------------------------------------------
    Annualized..................................................  ..............         378,008         359,690
----------------------------------------------------------------------------------------------------------------
* Because the affected population is relatively small, we assume that all 38 vessels will comply within the
  first year of implementation. However, owners and operators of these vessels would have 2 years to comply with
  the rulemaking.

    We estimate the annualized cost of this proposed rule to industry
over 10 years to be about $26.5 million at a 7 percent discount rate.
The main cost drivers of this proposed rule are the acquisition and
installation of TWIC readers and the maintenance of the affected
entity's TWIC reader system. Initial costs, which would be distributed
over a 2-year implementation phase, consist predominantly of the costs
to purchase and install TWIC readers and to integrate them with owners'
and operators' PACS. Annual costs would be driven by costs associated
with CCL updates, recordkeeping, training, system maintenance and
opportunity costs associated with failed reader transactions.
    We estimated the present value average costs of this proposed rule
on industry for a 10-year period as summarized in Table 7. The costs
were discounted at 3 and 7 percent as set forth by guidance in OMB
Circular A-4.

                                                       Table 7--Total Industry Cost, Risk Group A
                                                                      [$ Millions]
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Additional
                          Year                               Facility         Vessel          costs*       Undiscounted         7%              3%
--------------------------------------------------------------------------------------------------------------------------------------------------------
1.......................................................           $62.2            $1.3            $2.0           $65.4           $61.1           $63.5
2.......................................................            63.8             0.1             4.0            67.9            59.3            64.0
3.......................................................             3.3             0.1             4.0             7.4             6.0             6.8
4.......................................................             3.3             0.1             4.0             7.4             5.6             6.6
5.......................................................             3.3             0.1             4.0             7.4             5.3             6.4
6.......................................................            23.6             1.1             4.0            28.7            19.2            24.1
7.......................................................            23.6             0.1             4.0            27.7            17.3            22.6
8.......................................................             3.3             0.1             4.0             7.4             4.3             5.8
9.......................................................             3.3             0.1             4.0             7.4             4.0             5.7
10......................................................             3.3             0.1             4.0             7.4             3.8             5.5
                                                         -----------------------------------------------------------------------------------------------
    Total...............................................           193.0             3.5            37.8           234.2           186.0           210.9
                                                         -----------------------------------------------------------------------------------------------
Annualized..............................................  ..............  ..............  ..............  ..............            26.5           24.7
--------------------------------------------------------------------------------------------------------------------------------------------------------
* This includes additional delay, travel, and TWIC replacement costs due to TWIC failures.

    As this rule would require amendments to FSPs and VSPs, we estimate
a cost to the government to review these amendments during the
implementation period. We do not anticipate any additional annual cost
to the government from this rulemaking. For the total implementation
period, the total government cost would be $98,226 at a 7 percent
discount rate. Table 8 shows the 10-year government costs.

                                           Table 8--Government Costs *
----------------------------------------------------------------------------------------------------------------
                                                                       Total
                                        FSP             VSP        undiscounted         7%              3%
----------------------------------------------------------------------------------------------------------------
1...............................         $51,072          $6,299         $57,371         $53,617         $56,507
2...............................          51,072               0          51,072          44,608          50,208
3...............................               0               0               0               0               0
4...............................               0               0               0               0               0
5...............................               0               0               0               0               0
6...............................               0               0               0               0               0
7...............................               0               0               0               0               0
8...............................               0               0               0               0               0
9...............................               0               0               0               0               0
10..............................               0               0               0               0               0
                                 -------------------------------------------------------------------------------
    Total.......................         102,144           6,299         108,443          98,226         103,840
                                 -------------------------------------------------------------------------------
    Annualized..................  ..............  ..............  ..............          13,985         12,173
----------------------------------------------------------------------------------------------------------------
* After implementation, we estimate there would be no additional government costs for plan review as additional
  updates would be covered under existing plan review requirements and resources.

    Based on the proposals in this NPRM and recent data, we estimated
the average first-year cost of this NPRM (combined industry and
government) to be about $61.2 million or $63.6 million at a 7 or 3
percent discount rate, respectively. The undiscounted annual recurring
cost for this proposal is approximately $7.4 million in every year
except years 6 and 7, due to equipment replacement 5 years after
implementation. The annualized cost of this proposed rule is $26.5
million at 7 percent and $24.7 million at 3 percent. The 10-year cost
to industry of this proposed rule is approximately $186.1 million at a
7 percent discount rate, and $211.0 million at a 3 percent discount
rate, respectively.
    The benefits of the proposed rule include enhancing the security of
vessels, ports, and other facilities by ensuring that only individuals
who hold TWICs are granted unescorted access to secure areas at those
locations.
    TWIC readers will make identification, validation, and verification
of individuals attempting to gain unescorted access to a secure area
more reliable and also will help to alleviate potential sources of
human error when checking credentials at access points. Identity
verification ensures that the individual presenting the TWIC is the
same person to whom the TWIC was issued. Card authentication ensures
that the TWIC is not counterfeit, and card validation ensures that the
TWIC has not expired or been revoked by TSA, or reported as lost,
stolen, or damaged. Furthermore, the standardization of TWIC readers on
a national scale could provide additional benefits in the form of
efficiency gains in implementing access control systems throughout port
facilities and nationally for companies operating in multiple
locations.
    The proposed rule would also further implement the MTSA provision
for the transportation security card requirement, as well as the SAFE
Port Act electronic TWIC reader requirements. Due to current data
limitations, we do not estimate monetized benefits of this proposed
rule. We present qualitative benefits and a break-even analysis in this
preliminary analysis.
    Break-even analysis is useful when it is not possible to quantify
the benefits

of a regulatory action.\87\ OMB Circular A-4 recommends a ``threshold''
or ``break-even'' analysis when non-quantified benefits are important
to evaluating the benefits of a regulation. Threshold or break-even
analysis answers the question, ``How small could the value of the non-
quantified benefits be (or how large would the value of the non-
quantified costs need to be) before the rule would yield zero net
benefits?'' \88\ For this rulemaking, we calculate a potential range of
break-even results from the estimated consequences of the three attack
scenarios that are most likely to be mitigated by the use of TWIC
readers. Because the primary function of the TWIC card and TWIC reader
is to enhance access control and identity verification and validation,
the attack scenarios evaluated within MSRAM to provide the consequence
data for this analysis were limited to the following:
---------------------------------------------------------------------------

    \87\ In order to monetize the benefits from an anti-terrorism
regulation, we would need to know the incremental reduction in risk
of a successful terrorist attack that would accrue from the
regulatory action being analyzed. However, the data needed to
estimate this reduction in risk are not available.
    \88\ U.S. Office of Management and Budget, Circular A-4,
September 17, 2003.

 Truck Bomb
    [cir] Armed terrorists use a truck loaded with explosives to attack
the target focal point. The terrorists will attempt to overcome guards
and barriers if they encounter them.
 Terrorist Assault Team
    [cir] A team of terrorists using weapons and explosives attack the
target focal point. Assume the terrorists have done prior planning and
surveillance, but have no insider support of assault.
 Passenger/Passerby Explosives/Improvised Explosive Device
    [cir] Terrorists exploit inadequate access control and detonate
carried explosives at the target focal point. Assume the terrorists
approach the target under cover of legitimate presence and are not
armed. Note: for this attack mode, terrorist is not an insider.

    The focus on these three attack scenarios allows us to look at
specific attack scenarios that are most likely to be mitigated by the
use of TWIC readers. We base our analysis on the highest consequence
scenario of these three for each target. These scenarios were chosen
because they represent the scenarios most likely to benefit from the
enhanced access control afforded by TWIC readers, as they require
would-be attackers gaining access to the target in question. For these
three attack types, the aggressor would first need to gain access to
the facility to inflict maximum damage. Because the function of the
TWIC reader is to enhance access control, the deployment of TWIC
readers would increase the likelihood of identifying and denying access
to an individual attempting nefarious acts. The consequence of an
attack scenario is dependent on both the target and the attack mode.
The attack modes selected for this analysis, as described above, serve
to limit the potential maximum consequence compared to other potential
attack modes. Typically, one or more threat, vulnerability, or
consequence drivers will contribute significantly more to a target's
risk scores than others; these are known as major risk drivers. The
local COTPs document major risk drivers such as inherent limitations on
access control or the potential death and injury during the analysis
process.
    For the break-even analysis, we estimate the consequences of these
three scenarios by estimating the number of casualties and serious
injuries that would occur had the attack been successful. To monetize
the value of fatalities prevented, we use the concept of ``value of a
statistical life'' (VSL), which is commonly used in safety and security
analyses. The VSL does not represent the dollar value of a person's
life, but the amount society would be willing to pay to reduce the
probability of death. We currently use a value of $6.3 million as an
estimate of VSL.\89\ This break-even analysis does not consider any
property damage, environmental damage, indirect or macroeconomic
consequences these terrorist attacks might cause. Consequently, the
economic impacts of the terrorist attacks estimated for this series of
break-even analyses would be higher if these other impacts were
considered. See Table 9 for the average maximum consequence \90\ of the
three attack scenarios on Group A facilities.
---------------------------------------------------------------------------

    \89\ ``Valuing Mortality Risk Reductions in Homeland Security
Regulatory Analyses,'' prepared for the U.S. Customs and Border
Protection, June 2008. See www.regulations.gov, search on docket
USCG-2005-21869-003.
    \90\ The average maximum consequence is the average of the
highest consequence attack scenario for each target in the
referenced target group. The average maximum consequence compares
the results from the three analyzed attack modes for each target and
averages the maximum consequence for all targets.

                        Table 9--Annual Risk Reduction and Attacks Averted Required for Costs to Equal Benefits, NPRM Alternative
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                Annualized cost,         Average
                                                7% discount rate     consequence ($         Required               Frequency of  attacks averted
                                                  ($ millions)          millions)       reduction in risk
--------------------------------------------------------------------------------------------------------------------------------------------------------
NPRM Alternative.............................              $26.5            $3,468.7                0.8%   One every 130.9 years.
--------------------------------------------------------------------------------------------------------------------------------------------------------

    As shown in Table 9, an avoided terrorist attack at an average
target is equivalent to $3,468.7 million in avoided consequences. Using
the estimated annualized cost of this regulation, the annual reduction
in the probability of attack to a Risk Group A facility that would just
equate avoided consequences with cost is less than 1 percent. To state
this in another way, if implementing this regulation would lower the
likelihood of a successful terrorist attack by more than 1 percent each
year, then this would be a socially efficient use of resources. This
proposed rule is estimated to cost approximately $26.5 million
annually. This proposed rule would be cost effective if it prevented
one terrorist attack with consequence equal to the average every 130.9
years ($3,468.7/$26.5). These small changes in risk reduction suggest
the potential benefits of the proposed rule justify the costs.
    For the NPRM alternative, we assess that all Risk Group A
facilities will be required to install and use TWIC readers. On the
vessel side, we assess that all Risk Group A vessels with a crew size
greater than 14 TWIC-holding crewmembers will likely carry two portable
TWIC readers. For this alternatives analysis, we look at several
different ways to implement TWIC reader requirements based on the risk
group hierarchy. These alternatives include requiring TWIC readers for
Risk Group A and B facilities, along with Risk Group A vessels with
more than 14 TWIC-holding crewmembers, Risk

Group A and container facilities, along with Risk Group A vessels with
more than 14 TWIC-holding crewmembers, adding certain high-risk
facilities to Risk Group A, including petroleum refineries, non-CDC
bulk hazardous materials facilities, and petroleum storage facilities,
and Risk Group A facilities and all self-propelled Risk Group A
vessels. Table 10 summarizes the alternatives considered. The costs
displayed are the 10-year costs and the 10-year annualized cost, each
discounted at 7 percent.

                                                            Table 10--Regulatory Alternatives
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Annualized
                                                                                Total cost ($      cost ($
                                                               Description                   Facility         Vessel       millions, at    millions, at
                                                                                population      population      7% discount     7% discount
                                                                                rate)           rate)
--------------------------------------------------------------------------------------------------------------------------------------------------------
NPRM Alternative...............................  All Risk Group A facilities and Risk                532              38          $186.1           $26.5
                                                  Group A vessels with more than 14
                                                  crewmembers.
Alternative 2..................................  All Risk Group A facilities and Risk                532             138           197.7            28.2
                                                  Group A vessels (except barges).
Alternative 3..................................  Risk Group A and all container                      651              38           624.9            89.0
                                                  facilities and Risk Group A vessels
                                                  with more than 14 crewmembers.
Alternative 4..................................  All Risk Group A facilities, plus                 1,174              38           419.6            59.7
                                                  additional high consequence facilities
                                                  including petroleum refineries, non-
                                                  CDC bulk hazardous materials
                                                  facilities, and petroleum storage
                                                  facilities, and Risk Group A vessels
                                                  with more than 14 crewmembers.
Alternative 5..................................  Risk Group A and B Facilities and Risk            2,173              38           991.6           141.2
                                                  Group A vessels with more than 14
                                                  crewmembers.
--------------------------------------------------------------------------------------------------------------------------------------------------------

    When comparing alternatives, we also looked at the results of the
break-even analysis for these alternatives. As Table 11 shows, for the
overall average maximum consequence, the NPRM alternative would require
the lowest reduction in risk for the costs of the rule to be justified.
As the purpose of this rulemaking is to enhance security to mitigate a
TSI, we assess the break-even for the overall consequence of a TSI. It
is assumed that the highest consequence targets will be the most
attractive targets for potential terrorist attack.

       Table 11--Summary of Required Risk Reduction and Attacks Averted by Regulatory Alternative, Overall
                                                 [In $ millions]
----------------------------------------------------------------------------------------------------------------
                                   Annualized                       Required
                                    cost, 7%         Average      reduction in     Frequency of attacks averted
                                  discount rate    consequence   risk (percent)
----------------------------------------------------------------------------------------------------------------
NPRM Alternative...............           $26.5        $3,468.7             0.8  One every 130.9 years.
Risk Group A facilities and all            28.2         3,468.7             0.8  One every 123.2 years.
 Risk Group A vessels, except
 barges.
Risk Group A and all container             89.0         2,878.9             3.1  One every 32.4 years.
 facilities and Risk Group A
 vessels with more than 14
 crewmembers.
All Risk Group A facilities,               59.7         1,776.9             3.4  One every 29.8 years.
 plus additional high
 consequence facilities
 including petroleum
 refineries, non-CDC bulk
 hazardous materials
 facilities, and petroleum
 storage facilities, and Risk
 Group A vessels with more than
 14 crewmembers.
Risk Groups A and B facilities            141.2         1,143.3            12.4  One every 8.1 years.
 and Risk Group A vessels with
 more than 14 crewmembers.
----------------------------------------------------------------------------------------------------------------

NPRM Alternative--Risk Group A Facilities and Risk Group A Vessels With
More Than 14 TWIC-Holding Crewmembers
    The analysis for this alternative is discussed in detail previously
in this section, as it is the alternative we propose in this NPRM.
Alternative 2--Risk Group A Facilities and All Risk Group A Vessels,
Except Barges
    This alternative would require TWIC readers to be used at all Risk
Group A facilities and for all Risk Group A vessels, except barges.
This alternative would increase the burden on industry and small
entities by increasing the affected population from 38 vessels to 138
vessels. The number of facilities would be the same as in the NPRM
alternative. Under this alternative, annualized cost of this rulemaking
would increase from $26.5 million to $28.2 million, at a 7 percent
discount rate. The discounted 10-year costs would go from $186.1
million to $197.7 million. While this alternative does not lead to a
significant increase in costs, we reject it because requiring TWIC
readers on vessels with 14 or fewer TWIC-holding crewmembers is
unnecessary, as crews with that few members are known to all on the
vessel. This crewmember limit was proposed in the ANPRM and was based
on a recommendation from TSAC. In an effort to reduce unnecessary
burden and minimize costs of this rulemaking, we estimate this is the
most efficient way to regulate Risk Group A vessels. See the discussion
in the NPRM on ``Recurring

Unescorted Access'' and ``TWIC Reader Requirements on Vessels'' for
more details.
Alternative 3--Risk Group A and All Container Facilities and Risk Group
A Vessels With More Than 14 TWIC-Holding Crewmembers
    For this alternative, we assumed that only those facilities in Risk
Group A, as previously defined, and all container facilities will
require TWIC readers. This alternative would increase the burden on
industry and small entities by increasing the affected population from
532 facilities to 651 facilities. Under this scenario, the annualized
cost of this rulemaking would increase from $26.5 million to $89.0
million, at a 7 percent discount rate. The discounted 10-year costs
would go from $186.1 million to $624.9 million. The inclusion of
container facilities would also potentially have adverse environmental
impacts due to increased air emissions due to longer wait (``cueing'')
times and congestion at facilities.
    We considered this alternative because container facilities are
perceived to pose a unique threat to the maritime sector due to the
transfer risk associated with containers. As discussed in the preamble
of this NPRM, many of the high-risk threat scenarios at container
facilities would not be mitigated by TWIC readers. The costs for TWIC
readers at container facilities would not be justified by the amount of
potential risk reduction at these facilities. While container
facilities pose an increased transfer risk (i.e., there is a greater
risk of a threat coming through a container facility and inflicting
harm or damage elsewhere than with any other facility type), such
threats are not mitigated by the use of TWIC readers. Furthermore, the
use of TWIC readers, or other access control features, would not
mitigate the threat associated with the contents of a container. The
TWIC reader serves as an additional access control measure, but would
not improve screening of cargoes for dangerous substances or devices.
We request data and informed input regarding this assessment.
Alternative 4--Adding Certain High Consequence Facilities to Risk Group
A (These Additional Facilities To Include Petroleum Refineries, Non-CDC
Bulk Hazardous Materials Facilities, and Petroleum Storage Facilities)
    For this alternative, we moved three facility categories--petroleum
refineries, non-CDC bulk hazardous materials facilities, and petroleum
storage facilities--into Risk Group A from Risk Group B based on the
average maximum consequence for these facility types. This alternative
would increase the burden on industry by increasing the affected
population from 532 facilities to 1,174 facilities. Under this
scenario, the annualized cost of this rulemaking would increase from
$26.5 million to $59.7 million, at a 7 percent discount rate. The
discounted 10-year costs would go from $186.1 million to $419.6
million.
    We considered this alternative based on the high MSRAM consequence
scores associated with these three facility types, as well as due to
the perception that petroleum facilities pose a greater security risk
than other facility types. Despite the high MSRAM consequence scores
for these facility types, the overall risk scores as determined in the
analytical hierarchy process (AHP) were not as high as those in the
current Risk Group A, and therefore, we rejected this alternative and
maintained the AHP-based risk groupings.
Alternative 5--Risk Group A and Risk Group B Facilities and Risk Group
A Vessels With More Than 14 Crewmembers
    Alternative 5 would require TWIC readers to be used at all Risk
Group A and Risk Group B facilities, and Risk Group A vessels with
greater than 14 TWIC-holding crewmembers. This alternative would
increase the burden on industry and small entities by increasing the
affected population from 532 facilities to 2,173 facilities. This
increase in facilities would extend the affected population to
facilities that fall under the second risk tier. Under this
alternative, annualized cost of this rulemaking would increase from
$26.5 million to $141.2 million, at a 7 percent discount rate. The
discounted 10-year costs would go from $186.1 million to $991.6
million. Based on a recent study by HSI, as discussed in the preamble
to this NPRM, the difference in risk between facilities in Risk Groups
A and B is clearly defined, indicating that the two risk groups do not
require the same level of TWIC requirements. Further, as discussed in
the benefits section of this analysis, the break-even point, or the
amount of risk that would need to be reduced for costs to equal
benefits, for this alternative is much higher than that of the NPRM
alternative. Moreover, we understand many of the comments opposing TWIC
reader requirements represented the interests of owners and operators
of vessels or facilities assigned to Risk Group B. For these reasons,
we rejected this alternative.
    The provisions in this proposed rule are taken in order to meet
requirements set forth in MTSA and the SAFE Port Act. The proposal, as
presented, represents the lowest cost alternative, as discussed above.
We have focused this rulemaking on the highest risk population so as to
reduce the impacts of this rule as much as possible. Also, we have
created a performance standard that allows the affected population to
implement the requirements in a manner most conducive to their own
business practices. By allowing for flexibilities, such as the use of
fixed or portable readers, and removing vessels with 14 or fewer TWIC-
holding crewmembers from the requirements, we have reduced potential
burden on all entities, including small entities. Furthermore, we
believe that providing any additional relief for small entities would
conflict with the purpose of this rulemaking, as the objective is to
enhance access control and reduce risk of a TSI. Providing relief of
the proposed requirements based on entity size would contradict that
stated purpose and leave small entities, which may possess as great a
risk as entities that exceed the Small Business Administration (SBA)
size standards, more vulnerable to a TSI.

B. Small Entities

    Under the Regulatory Flexibility Act (5 U.S.C. 601-612), we have
considered whether this proposed rule would have a significant economic
impact on a substantial number of small entities. The term ``small
entities'' comprises small businesses, not-for-profit organizations
that are independently owned and operated and are not dominant in their
fields, and governmental jurisdictions with populations of fewer than
50,000. An Initial Regulatory Flexibility Analysis discussing the
impacts of this proposed rule on small entities is available in the
docket where indicated under the ADDRESSES Section.
    For this proposed rule, we estimated mandatory TWIC reader
requirement costs for approximately 38 vessels and 532 facilities based
on the risk assessment hierarchy and current data from the Coast
Guard's MISLE database. Of these 532 facilities that would be affected
by the TWIC reader requirements, we found 311 unique owners. Among
these 311 unique owners, there were 31 government-owned entities, 119
companies that exceeded SBA small business size standards, 88 companies
considered small by SBA size standards, and 73 companies for which no
information was available. For the purposes of this analysis, we
consider all entities for which information was not available to

be small. There were no not-for-profit entities in our affected
population. Of the 31 government jurisdictions that would be affected
by this proposed rule, 24 exceed the 50,000 population threshold as
defined by the Regulatory Flexibility Act to be considered small and
seven have government revenue levels such that there would not be an
impact greater that 1 percent of government revenue.\91\
---------------------------------------------------------------------------

    \91\ ``Government revenues'' used for this analysis include tax
revenues, and in some cases, operating revenues for government owned
waterfront facilities.
---------------------------------------------------------------------------

    We were able to find revenue information for 64 of the 88
businesses deemed small by SBA size standards.\92\ We then determined
the impacts of the proposed rule on these companies by comparing the
cost of the proposed rule to the average per facility cost of this
rulemaking. To determine the average per facility cost, we average the
per facility cost for all facility types using the same cost per
facility type breakdown as used to assess the costs of this proposal.
We then found what percent impact on revenue the proposed rule would
have based on implementation costs (including capital costs) and annual
recurring costs (including CCL updates, recordkeeping, and training).
We estimate these costs to be, on average $233,736 per facility during
the implementation period and $6,186 per facility in annual recurring
cost.\93\ We base our impact analysis on average cost to regulated
entities due to the flexibility afforded by this proposed rule to
individual facilities to determine how best to implement TWIC reader
requirements.\94\ Table 12 shows the potential revenue impacts for
small businesses impacted by this rulemaking.
---------------------------------------------------------------------------

    \92\ SBA small business standards are based on either company
revenue or number of employees. Many companies in our sample have
employee numbers determining them small, but we were unable to find
annual revenue data to pair with the employee data.
    \93\ These are weighted averages, based on the per facility cost
displayed in Table 4 and the number of facilities by type.
    \94\ We do not know how a specific facility with comply with
this rulemaking in regards to type and number of readers installed,
number of personnel requiring training at a given facility, etc.

                       Table 12--Revenue Impacts on Affected Small Businesses--Facilities
----------------------------------------------------------------------------------------------------------------
                                                    Impacts from implementation    Impacts from recurring annual
                                                               costs                           costs
              Revenue impact range               ---------------------------------------------------------------
                                                     Number of      Percent of       Number of      Percent of
                                                     entities        entities        entities        entities
----------------------------------------------------------------------------------------------------------------
0% < Impact <= 1%...............................              27              42              57              89
1% < Impact <= 3%...............................              10              16               6               9
3% < Impact <= 5%...............................               5               8               1               2
5% < Impact <= 10%..............................               8              13               0               0
Above 10%.......................................              14              22               0               0
                                                 ---------------------------------------------------------------
    Total.......................................              64             100              64             100
----------------------------------------------------------------------------------------------------------------

    The greatest impact is expected to occur during the implementation
phase when 58 percent of small businesses that we were able to find
revenue data on will experience an impact of greater than 1 percent,
and 22 percent of small businesses that we were able to find revenue
data on will experience an impact greater than 10 percent. After
implementation, the impacts decrease and 89 percent of affected small
businesses will see an impact less than 1 percent. We expect the
revenue impacts for years with equipment replacement to be between
those for implementation and annual impacts. During those years with
equipment replacement, we estimate that approximately 44 percent of
businesses would see an impact greater than 1 percent, and 13 percent
would see an impact greater than 10 percent.\95\
---------------------------------------------------------------------------

    \95\ We estimate an average cost per facility in years with
equipment replacement to be $48,110.
---------------------------------------------------------------------------

    For vessels, we found that for the 38 vessels that would be
affected by this proposed rule, there were 10 unique owners, all of
which were businesses. We were able to find employee and revenue data
for all but one of the companies. Out of the nine companies for which
we were able to find data, only two qualified as small businesses by
SBA size standards. We estimate these costs to be, on average $33,102
per vessel during the implementation period, and $3,477 per vessel in
annual cost. We base our impact analysis on average cost per vessel due
to the flexibility afforded to vessels and the subsequent assumption
that all vessels will deploy, on average, two portable TWIC readers.
Both of these businesses would experience impacts less than 1 percent
of revenue for both previously mentioned impact analyses.
    If you think that your business, organization, or governmental
jurisdiction qualifies as a small entity and that this proposed rule
would have a significant economic impact on it, please submit a comment
to the Docket Management Facility at the address under ADDRESSES. In
your comment, explain why you think it qualifies and how and to what
degree this proposed rule would economically affect it.

C. Assistance for Small Entities

    Under section 213(a) of the Small Business Regulatory Enforcement
Fairness Act of 1996 (Public Law 104-121), we want to assist small
entities in understanding this proposed rule so that they can better
evaluate its effects on them and participate in the rulemaking. If the
proposed rule would affect your small business, organization, or
governmental jurisdiction and you have questions concerning its
provisions or options for compliance, please consult Lieutenant
Commander Loan T. O'Brien, Coast Guard, telephone<PHONE_NUMBER>. We will
not retaliate against small entities that question or complain about
this proposed rule or any policy or action of the Coast Guard.

D. Collection of Information

    This proposed rule would call for a collection of information under
the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3520). As defined
in 5 CFR 1320.3(c), ``collection of information'' comprises reporting,
recordkeeping, monitoring, posting, labeling, and other similar
actions. The title and description of the information collection, a
description of those who must collect the information, and an estimate
of the total annual burden follow. The estimate covers the time for
reviewing instructions, searching existing sources of data, gathering
and maintaining the data needed, and

completing and reviewing the collection.
    Under the provisions of the proposed rule, the affected facilities
and vessels would be required to update their FSPs and VSPs, as well as
create and maintain a system of recordkeeping within 2 years of
promulgation of the final rule. This requirement would be added to an
existing collection with OMB control number 1625-0077.
    Title: Security Plans for Ports, Vessels, Facilities, Outer
Continental Shelf Facilities and Other Security-Related Requirements
    OMB Control Number: 1625-0077.
    Summary of the Collection of Information: This information
collection is associated with the maritime security requirements
mandated by MTSA. Security assessments, security plans, and other
security-related requirements are found in 33 CFR chapter I, subchapter
H. The proposed rule would require certain vessels and facilities to
use electronic readers designed to work with the TWIC as an access
control measure. Affected owners and operators would also face
requirements associated with electronic TWIC readers, including
recordkeeping requirements for those owners and operators required to
use an electronic TWIC reader, and security plan amendments to
incorporate TWIC requirements.
    Need for Information: The information is necessary to show evidence
that affected vessels and facilities are complying with the TWIC reader
requirements.
    Proposed Use of Information: We would use this information to
ensure that facilities and vessels are properly implementing and
utilizing TWIC readers.
    Description of the Respondents: The respondents are owners and
operators of certain vessels and facilities regulated by the Coast
Guard under 33 CFR Chapter I, subchapter H.
    Number of Respondents: The adjusted number of respondents is 13,825
for vessels, 3,270 for facilities, and 56 for OCS facilities. Of these
3,270 facilities and 13,825 vessels, approximately 532 facilities that
are considered ``high risk'' would be required to modify their existing
FSPs and approximately 38 vessels would be required to modify their
VSPs to account for the TWIC reader requirements. These same
populations would be required to create and maintain recordkeeping
systems as well.
    Frequency of Response: The FSP and VSP would need to be amended
within 2 years of promulgation to include TWIC reader-related
procedures. Recordkeeping requirements would need to be met along a
similar timeline.
    Burden of Response: The estimated burden for facilities would be
17,290 hours in the first year, 18,886 hours in the second year and
3,192 hours in the third year and all subsequent years. The burden for
vessels would be 2,470 burden hours in year one, and 288 burden hours
for all subsequent years. This includes an estimated 25 burden hours to
amend the FSP or VSP, along with an implementation period burden of 40
hours and an annual burden of 6 hours for designing and maintaining a
system of records for each facility or vessel, to include recordkeeping
related to the CCL.
Estimate of Total Annual Burden
    Facilities: The estimated burden over the 2-year implementation
period for facilities is 25 hours per FSP amendment. Since there are
currently 532 facilities that will need to amend their FSPs, the total
burden on facilities would be 13,300 hours (532 FSPs x 25 hours per
amendment) during the 2-year implementation period, or 6,650 hours each
of the first 2 years. Facilities would also face a recordkeeping burden
of 21,280 hours during the 2-year implementation period (532 facilities
x 40 hours per recordkeeping system), or 10,640 hours each year over
the first 2 years. There would also be an annual recordkeeping burden
of 3,192 hours (532 facilities x 6 hours per year), starting in the
third year. In the second year, the 266 facilities that implemented in
the first year would incur the 6 hours of annual recordkeeping, at a
burden of 1,596 (266 facilities x 6 hours). The total burden for
facilities is estimated at 17,290 (6,650 + 10,640) in Year 1, 18,886 in
Year 2 (6,650 + 10,640 + 1,596), and 3,192 in Year 3.
    Vessels: For the 38 vessels, the burden in the first year would be
950 hours (38 VSPs x 25 hour per amendment). Vessels would also face a
recordkeeping burden of 1,520 hours during the 1-year implementation
period (38 vessels x 40 hours per recordkeeping system). There would
also be an annual recordkeeping burden of 228 hours (38 vessels x 6
hours per year). The total burden for vessels is estimated at 2,470
(950 + 1,520) in Year 1 and 228 hours in Years 2 and 3.
    Total: The total additional burden due to the TWIC Reader rule is
estimated at 19,760 (2,470 for vessels and 17,290 for facilities) in
Year 1, 19,114 (228 for vessels and 18,886 for facilities) in Year 2,
and 3,420 (228 for vessels and 3,192 for facilities) in Year 3. The
current annual burden listed in this collection of information is
1,108,043. The new burden, as a result of this proposed rulemaking, in
Year 1 is 1,127,803 (1,108,043 + 19,760). The new burden, as a result
of this proposed rule, is 1,127,803 (1,108,043 + 19,760). The total
change in monetized burden in Year 1 is approximately $1.3 million. The
total burden in Year 2 is 1,127,157 (1,108,043 + 19,114) and in Year 3
is 1,111,463 (1,108,043 + 3,420). The average annual additional burden
across the 3 years is 14,098 and the average total burden is 1,122,141
(14,098 + 1,108,043).
    As required by the Paperwork Reduction Act of 1995 (44 U.S.C.
3507(d)), we have submitted a copy of this proposed rule to OMB for its
review of the collection of information.
    We ask for public comment on the proposed collection of information
to help us determine how useful the information is--whether it can help
us perform our functions better, whether it is readily available
elsewhere, how accurate our estimate of the burden of collection is,
how valid our methods for determining burden are, how we can improve
the quality, usefulness, and clarity of the information, and how we can
minimize the burden of collection.
    If you submit comments on the collection of information, submit
them both to OMB and to the Docket Management Facility where indicated
under ADDRESSES, by the date under DATES.
    You need not respond to a collection of information unless it
displays a currently valid control number from OMB. Before the
requirements for this collection of information become effective, we
will publish a notice in the Federal Register of OMB's decision to
approve, modify, or disapprove the proposed collection.

E. Federalism

    A rule has implications for Federalism under Executive Order 13132,
Federalism, if it has a substantial direct effect on the States, on the
relationship between the national government and the States, or on the
distribution of power and responsibilities among the various levels of
government. This proposed rule has been analyzed in accordance with the
principles and criteria in Executive Order 13132, and as discussed
earlier in the preamble, it has been determined that this proposed rule
does have Federalism implications or a substantial direct effect on the
States.
    This proposed rule would update existing regulations by creating a
risk-based analysis of MTSA-regulated vessels and facilities. Based on
this analysis, each vessel or facility is

classified according to its risk level, which then determines whether
the vessel or facility would be required to use TWIC readers.
Additionally, this proposed rule would amend recordkeeping requirements
and add requirements to amend security plans in order to ensure
compliance.
    It is well-settled that States may not regulate in categories
reserved for regulation by the Coast Guard. It is also well-settled,
now, that all of the categories covered in 46 U.S.C. 3306, 3703, 7101,
and 8101 (design, construction, alteration, repair, maintenance,
operation, equipping, personnel qualification, and manning of vessels),
as well as the reporting of casualties and any other category in which
Congress intended the Coast Guard to be the sole source of a vessel's
obligations, are within fields foreclosed from regulation by the States
or local governments. (See the decision of the Supreme Court in the
consolidated cases of United States v. Locke and Intertanko v. Locke,
529 U.S. 89, 120 S.Ct. 1135 (March 6, 2000).)
    The Coast Guard believes the Federalism principles articulated in
Locke apply to this proposed rule since it would require certain MTSA-
regulated vessels to carry TWIC readers (i.e., required equipment), and
to conform to recordkeeping and security plan requirements. Therefore,
States and local governments are foreclosed from regulating within this
field. This principle also applies to MTSA-regulated facilities, at
least insofar as a State or local law or regulation applicable to these
same facilities for the purpose of their protection, would conflict
with a Federal regulation (i.e., it would either actually conflict or
would frustrate an overriding Federal need for uniformity).
    Although State and local governments are foreclosed from regulating
within this specific field, the Coast Guard recognizes the key role
that State and local governments may have in making regulatory
determinations. Additionally, Sections 4 and 6 of Executive Order 13132
require that for any rules with preemptive effect, the Coast Guard
shall provide elected officials of affected State and local governments
and their representative national organizations the notice and
opportunity for appropriate participation in any rulemaking
proceedings, and to consult with such officials early in the rulemaking
process. Therefore, we invite affected State and local governments and
their representative national organizations to indicate their desire
for participation and consultation in this rulemaking process by
submitting comments to this notice. In accordance with Executive Order
13132, the Coast Guard will provide a Federalism impact statement to
document: (1) The extent of the Coast Guard's consultation with State
and local officials that submit comments in response to this proposed
rule; (2) a summary of the nature of any concerns raised by State or
local governments and the Coast Guard's position thereon; and (3) a
statement of the extent to which the concerns of State and local
officials have been met.

F. Unfunded Mandates Reform Act

    The Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1531-1538)
requires Federal agencies to assess the effects of their discretionary
regulatory actions. In particular, the Act addresses actions that may
result in the expenditure by a State, local, or tribal government, in
the aggregate, or by the private sector of $100,000,000 (adjusted for
inflation) or more in any one year. Though this proposed rule would not
result in such an expenditure, we do discuss the effects of this
proposed rule elsewhere in this preamble.

G. Taking of Private Property

    This proposed rule would not cause a taking of private property or
otherwise have taking implications under Executive Order 12630,
Governmental Actions and Interference with Constitutionally Protected
Property Rights.

H. Civil Justice Reform

    This proposed rule meets applicable standards in sections 3(a) and
3(b)(2) of Executive Order 12988, Civil Justice Reform, to minimize
litigation, eliminate ambiguity, and reduce burden.

I. Protection of Children

    We have analyzed this proposed rule under Executive Order 13045,
Protection of Children from Environmental Health Risks and Safety
Risks. Though this proposed rule is a ``significant regulatory action''
under Executive Order 12866, it would not create an environmental risk
to health or a risk to safety that might disproportionately affect
children.

J. Indian Tribal Governments

    This proposed rule does not have tribal implications under
Executive Order 13175, Consultation and Coordination with Indian Tribal
Governments, because it would not have a substantial direct effect on
one or more Indian tribes, on the relationship between the Federal
Government and Indian tribes, or on the distribution of power and
responsibilities between the Federal Government and Indian tribes.

K. Energy Effects

    We have analyzed this proposed rule under Executive Order 13211,
Actions Concerning Regulations That Significantly Affect Energy Supply,
Distribution, or Use. We have determined that it is not a ``significant
energy action'' under that order. Though it is a ``significant
regulatory action'' under Executive Order 12866, it is not likely to
have a significant adverse effect on the supply, distribution, or use
of energy. The Administrator of the Office of Information and
Regulatory Affairs has not designated it as a significant energy
action. Therefore, it does not require a Statement of Energy Effects
under Executive Order 13211.

L. Technical Standards

    The National Technology Transfer and Advancement Act (NTTAA) (15
U.S.C. 272 note) directs agencies to use voluntary consensus standards
in their regulatory activities unless the agency provides Congress,
through OMB, an explanation of why using these standards would be
inconsistent with applicable law or otherwise impractical. Voluntary
consensus standards are technical standards (e.g., specifications of
materials, performance, design, or operation; test methods; sampling
procedures; and related management systems practices) that are
developed or adopted by voluntary consensus standards bodies.
    This proposed rule does not use technical standards. Therefore, we
did not consider the use of voluntary consensus standards.
    The Federal government is developing the TWIC reader standards.
Under NTTAA and OMB Circular A-119, NIST is tasked with the role of
encouraging and coordinating Federal agency use of voluntary consensus
standards and participation in the development of relevant standards,
as well as promoting coordination between the public and private
sectors in the development of standards and in conformity assessment
activities. NIST is assisting TSA with the establishment of a
conformity assessment framework in support of a QTL for identity and
privilege credential products, to be managed by TSA. NIST is also
assisting TSA with the establishment of a testing suite for qualifying
products in conformity to specified standards and TSA specifications.
    If you are aware of voluntary consensus standards that might apply
to this rule, please send a comment to the

docket using one of the methods under ADDRESSES. In your comment,
please explain why you disagree with our analysis and/or identify
voluntary consensus standards we have not listed that might apply.

M. Environment

    We have analyzed this proposed rule under DHS Management Directive
023-01 and Commandant Instruction M16475.lD, which guide the Coast
Guard in complying with the National Environmental Policy Act of 1969
(NEPA) (42 U.S.C. 4321-4370f), and have made a preliminary
determination that this action is not likely to have a significant
effect on the human environment. A ``Draft Programmatic Environmental
Assessment'' (DPEA) and a draft ``Finding of No Significant Impact''
(FONSI) are available in the docket where indicated under the ``Public
Participation and Request for Comments'' section of this preamble. Our
analysis indicates that TWIC reader operations would have insignificant
direct, indirect or cumulative impacts on environmental resources, with
special attention to potential air quality issues. We encourage the
public to submit comments on the DPEA and draft FONSI.

List of Subjects

33 CFR Part 101

    Harbors, Incorporation by reference, Maritime security, Reporting
and recordkeeping requirements, Security measures, Vessels, Waterways.

33 CFR Part 104

    Maritime security, Reporting and recordkeeping requirements,
Security measures, Vessels.

33 CFR Part 105

    Maritime security, Reporting and recordkeeping requirements,
Security measures.

33 CFR Part 106

    Continental shelf, Maritime security, Reporting and recordkeeping
requirements, Security measures.
    For the reasons discussed in the preamble, we propose to amend 33
CFR parts 101, 104, 105, and 106 as follows:

PART 101--MARITIME SECURITY: GENERAL

0
1. The authority citation for part 101 continues to read as follows:

    Authority: 33 U.S.C. 1226, 1231; 46 U.S.C. Chapter 701; 50
U.S.C. 191, 192; Executive Order 12656, 3 CFR 1988 Comp., p. 585; 33
CFR 1.05-1, 6.04-11, 6.14, 6.16, and 6.19; Department of Homeland
Security Delegation No. 0170.1.

0
2. Amend Sec.  101.105, as follows:
0
a. Add, in alphabetical order, definitions for the terms ``Biometric
match'', ``Canceled Card List (CCL)'', ``Card authentication'', ``Card
Holder Unique Identifier (CHUID)'', ``Card validity check'', ``Mobile
Offshore Drilling Unit (MODU)'', ``Offshore Supply Vessel (OSV)'',
``Physical Access Control System (PACS)'', ``Risk Group'', and ``TWIC
reader''; and
0
b. Remove the definition for the term ``Recurring unescorted access''.
    The additions read as follows:

Sec.  101.105  Definitions.

* * * * *
    Biometric match means a confirmation that: one of the two biometric
(fingerprint) templates stored in the Transportation Worker
Identification Credential (TWIC) matches the scanned fingerprint of the
person presenting the TWIC; or the alternate biometric stored in a PACS
matches the corresponding biometric of the person.
* * * * *
    Canceled Card List (CCL) means the list of TWIC Federal Agency
Smart Credential-Numbers (FASC--Ns) that have been invalidated or
revoked because TSA has determined that the TWIC-holder may pose a
security threat, or because the card has been reported lost, stolen, or
damaged.
* * * * *
    Card authentication means electronic verification that the TWIC is
a valid credential issued by TSA, containing the Card Holder Unique
Identifier (CHUID) and the correct digital signature.
    Card Holder Unique Identifier (CHUID) means the standardized data
object comprised of the FASC--N, globally unique identifier, expiration
date, and certificate used to validate the data integrity of other data
objects on the credential.
    Card validity check means electronic verification that the TWIC has
not been invalidated or revoked by checking the TWIC against the
Canceled Card List or, for vessels and facilities assigned to Risk
Group B or C according to Sec. Sec.  104.263 or 105.253 of this
subchapter, by verifying that the expiration date on the face of the
TWIC has not passed.
* * * * *
    Mobile Offshore Drilling Unit (MODU) means the same as defined in
33 CFR 140.10.
* * * * *
    Offshore Supply Vessel (OSV) means the same as defined in 46 CFR
125.160.
* * * * *
    Physical Access Control System (PACS) means a system, including
devices, personnel, and policies, that controls access to and within a
facility or vessel.
* * * * *
    Risk Group means the risk ranking assigned to a vessel, facility,
or OCS facility according to Sec. Sec.  104.263, 105.253, or 106.258 of
this subchapter, for the purpose of the TWIC requirements in this
subchapter.
* * * * *
    TWIC reader means an electronic device listed on TSA's Qualified
Technology List (QTL) and used to verify and validate: the authenticity
of a TWIC; the identity of the TWIC-holder as the legitimate bearer of
the credential; that the TWIC is not expired; and that the TWIC is not
on the CCL. TSA's QTL of acceptable TWIC readers may be accessed online
at http://(TBD).
* * * * *
0
3. Add Sec.  101.112 to read as follows:

Sec.  101.112  Federalism.

    (a) The regulations in 33 CFR parts 101, 103, 104, and 106 have
preemptive effect over State or local regulation within the same field.
    (b) The regulations in 33 CFR part 105 have preemptive effect over
State or local regulations insofar as a State or local law or
regulation applicable to the facilities covered by part 105 would
conflict with the regulations in part 105, either by actually
conflicting or frustrating an overriding Federal need for uniformity.

Sec.  101.514  [Amended]

0
4. In Sec.  101.514, remove paragraph (e).
0
5. Revise Sec.  101.515(d)(2) to read as follows:

Sec.  101.515  TWIC/Personal identification.

* * * * *
    (d) * * *
    (2) Each person who has been issued or who possesses a TWIC must
allow their TWIC to be read by a TWIC reader and must submit their
reference biometric, such as a fingerprint, and any other required
information, such as a Personal Identification Number (PIN), to the
TWIC reader, upon a request from TSA, the Coast Guard, any other
authorized DHS representative, or a Federal, State, or local law
enforcement officer.
0
6. Add Sec.  101.520 to read as follows:

Sec.  101.520  TWIC reader requirements for Risk Group A.

    Owners or operators of vessels or facilities subject to part 104 or
105 of this subchapter that are assigned to Risk Group A in Sec. Sec.
104.263 or 105.253 of this

subchapter must ensure that a Transportation Worker Identification
Credential (TWIC) program is implemented as follows:
    (a) Maritime Security (MARSEC) Level 1. (1) Prior to each entry,
all persons must present their TWICs for inspection using a TWIC
reader, with or without a Physical Access Control System (PACS), before
being granted unescorted access to secure areas. The TWIC inspection
must include an identity verification including a biometric match, card
authentication, and card validity check using Canceled Card List (CCL)
information that is no more than 7 days old.
    (2) With a PACS, biometrics other than the fingerprint templates
stored in the TWIC may be used to perform the identity verification,
provided that the owner or operator links the person, the TWIC, and the
alternate biometric in the PACS. To do this, a one-time initial
biometric match and card authentication using a TWIC reader must be
performed. Owners and operators must update their security plans to
explain how the PACS performs the required security functions and how
they protect sensitive security information.
    (b) MARSEC Levels 2 and 3. At these MARSEC Levels, the same
procedures outlined in paragraph (a) of this section must be used,
except that the card validity check must use CCL information that is no
more than 1 day old.
    (c) The CCL information used to verify card validity must be
updated within 12 hours of any increase in MARSEC Level, no matter when
the information was last updated.
    (d) Only the most recently obtained CCL information shall be used
to conduct card validity checks.
    (e) Vessels in Risk Group A with more than 14 crewmembers required
to hold a TWIC must comply with the applicable TWIC reader requirements
in this subchapter. All vessels with 14 or fewer TWIC-holding
crewmembers are exempt from the TWIC reader requirements in this
subchapter. Owners or operators of vessels with 14 or fewer TWIC-
holding crewmembers are required to perform the following TWIC visual
inspection requirements, prior to each entry, on persons seeking
unescorted access to secure areas:
    (1) Visually match the photograph on the TWIC to the person
presenting the TWIC.
    (2) Visually check the various security features present on the
card to determine whether the TWIC has been tampered with or forged.
    (3) Visually verify that the expiration date on the face of the
TWIC has not passed.
    (f) If the COTP determines that TWIC reader requirements are
causing delays at a facility that result in excessive vehicle build-up
or other consequence, the COTP is authorized to temporarily suspend
TWIC reader requirements at that facility, and permit the owner or
operator to satisfy the requirements of this section by performing the
following TWIC visual inspections, prior to each entry, on persons
seeking unescorted access to secure areas:
    (1) Visually match the photograph on the TWIC to the person
presenting the TWIC.
    (2) Visually check the various security features present on the
card to determine whether the TWIC has been tampered with or forged.
    (3) Visually verify that the expiration date on the face of the
TWIC has not passed.
0
7. Add Sec.  101.525 to read as follows:

Sec.  101.525  TWIC inspection requirements for Risk Group B.

    Owners or operators of vessels, facilities, or Outer Continental
Shelf facilities subject to part 104, 105, or 106 of this subchapter
that are assigned to Risk Group B in Sec. Sec.  104.263, 105.253, or
106.258 of this subchapter must ensure that at all Maritime Security
(MARSEC) Levels, prior to each entry, all persons seeking unescorted
access to secure areas present their Transportation Worker
Identification Credentials (TWICs) for inspection before being granted
such unescorted access.
    (a) Inspection must include--
    (1) A visual match of the photograph on the TWIC to the person
presenting the TWIC;
    (2) A visual check of the various security features present on the
card to determine whether the TWIC has been tampered with or forged;
and
    (3) A visual verification that the expiration date on the face of
the TWIC has not passed.
    (b) Nothing in this section shall be read to prohibit an owner or
operator from implementing the TWIC requirements of a higher Risk Group
for their vessel or facility.
0
8. Add Sec.  101.530 to read as follows:

Sec.  101.530  TWIC inspection requirements for Risk Group C.

    Owners or operators of vessels or facilities subject to part 104 or
105 of this subchapter that are assigned to Risk Group C in Sec. Sec.
104.263 or 105.253 of this subchapter must ensure that at all Maritime
Security (MARSEC) Levels, prior to each entry, all persons seeking
unescorted access to secure areas present their TWICs for inspection
before being granted such unescorted access.
    (a) TWIC inspection must include--
    (1) A visual match of the photograph on the TWIC to the person
presenting the TWIC;
    (2) A visual check of the various security features present on the
card to determine whether the TWIC has been tampered with or forged;
and
    (3) A visual verification that the expiration date on the face of
the TWIC has not passed.
    (b) Nothing in this section shall be read to prohibit an owner or
operator from implementing the TWIC requirements of a higher Risk Group
for their vessel or facility.
0
9. Add Sec.  101.535 to read as follows:

Sec.  101.535  TWIC inspection requirements in special circumstances.

    Owners or operators of any vessel, facility, or Outer Continental
Shelf (OCS) facility subject to part 104, 105, or 106 of this
subchapter must ensure that a TWIC program is implemented as follows:
    (a) If a person cannot present a Transportation Worker
Identification Credential (TWIC) because it has been lost, damaged, or
stolen, and the person has previously been granted unescorted access to
secure areas and is known to have had a TWIC, the person may be granted
unescorted access to secure areas for a period of no longer than 7
consecutive calendar days if--
    (1) The person has reported the TWIC as lost, damaged, or stolen to
TSA as required in 49 CFR 1572.19(f);
    (2) The person can present another identification credential that
meets the requirements of Sec.  101.515 of this part; and
    (3) There are no other suspicious circumstances associated with the
person's claim that the TWIC was lost, damaged, or stolen.
    (b) If a person's fingerprints are not able to be read by a TWIC
reader or Physical Access Control System (PACS) due to technology
malfunction, poor fingerprint quality, or no fingerprint minutiae, the
owner or operator may grant the person unescorted access to secure
areas based on either of the following secondary authentication
procedures:
    (1) The owner or operator may require the person to provide their
Personal Identification Number (PIN); or
    (2) The owner or operator may require the person to present an
alternative biometric that has been incorporated into the PACS.
    (c) If a TWIC reader malfunctions, and a person seeking unescorted
access to

secure areas has previously been granted such unescorted access and is
known to have a TWIC, the person may be granted unescorted access to
secure areas for a period of no longer than 7 consecutive calendar
days. During that period, the owner or operator must perform the
following inspections prior to each entry:
    (1) A visual match of the photograph on the TWIC to the person
presenting the TWIC.
    (2) A visual check of the various security features present on the
card to determine whether the TWIC has been tampered with or forged.
    (3) A visual verification that the expiration date on the face of
the TWIC has not passed.
    (d) If a person cannot present a TWIC for any other reason than
those outlined in paragraph (a) of this section, the person must not be
granted unescorted access to secure areas. The person must be under
escort, at all times, while in a secure area.
    (e) With the exception of persons granted access according to
paragraph (a) of this section, all persons granted unescorted access to
secure areas of a vessel, facility, or OCS facility must be able to
produce their TWICs upon request from the Transportation Safety
Administration, the Coast Guard, other authorized Department of
Homeland Security representatives, or a Federal, State, or local law
enforcement officer.
    (f) There must be disciplinary measures in place to prevent fraud
and abuse.
    (g) Owners or operators must establish the frequency of the
application of any security measures for access control in their
approved security plans, particularly if these security measures are
applied on a random or occasional basis.
    (h) The vessel, facility, or OCS facility's TWIC program should be
coordinated, when practicable, with identification and TWIC access
control measures of other entities that interface with the vessel,
facility, or OCS facility.

PART 104--MARITIME SECURITY: VESSELS

0
10. The authority citation for part 104 continues to read as follows:

    Authority: 33 U.S.C. 1226, 1231; 46 U.S.C. Chapter 701; 50
U.S.C. 191; 33 CFR 1.05-1, 6.04-11, 6.14, 6.16, and 6.19; Department
of Homeland Security Delegation No. 0170.1.

Sec.  104.105  [Amended]

0
11. In Sec.  104.105(d), remove the words ``this part'', and add, in
their place, the words ``parts 101 and 104 of this subchapter''.
0
12. Amend Sec.  104.115 by removing paragraph (c), redesignating
paragraph (d) as paragraph (c), and revising newly redesignated
paragraph (c) to read as follows:

Sec.  104.115  Compliance.

* * * * *
    (c) By (2 YEARS AFTER DATE OF PUBLICATION OF FINAL RULE), owners
and operators of vessels subject to this part must amend their security
plans, if necessary, to indicate how they will implement the TWIC
reader requirements in this subchapter. By (2 YEARS AFTER DATE OF
PUBLICATION OF FINAL RULE), owners and operators of Risk Group A
vessels subject to this part must operate in accordance with the TWIC
reader provisions found within this subchapter.

Sec.  104.200  [Amended]

0
13. Amend Sec.  104.200 as follows:
0
a. In paragraph (b)(12) introductory text, remove the word ``part'',
and add, in its place, the word ``subchapter''; and
0
b. In paragraph (b)(14), remove the words ``Sec.  104.265(c) of this
part'', and add, in their place, the words ``Sec.  101.535(a) of this
subchapter''.
0
14. Amend Sec.  104.235 as follows:
0
a. In paragraph (b)(7), following the words ``of its effective
period;'', remove the word ``and'';
0
b. In paragraph (b)(8), following the words ``the audit was
completed'', remove the symbol ``.'' and add, in its place, the word
``; and'';
0
c. Add paragraph (b)(9); and
0
d. In paragraph (c), add a sentence to the end of the paragraph.
    The additions read as follows:

Sec.  104.235  Vessel recordkeeping requirements.

* * * * *
    (b) * * *
    (9) TWIC Reader/PACS. For each individual granted unescorted access
to a secure area, the: FASC-N; date and time that unescorted access was
granted; and, if captured, the individual's name. Additionally,
documentation to demonstrate that the owner or operator has updated the
CCL with the frequency required in Sec.  101.520 of this subchapter.
    (c) * * * TWIC reader records and similar records in a PACS are
sensitive security information and must be protected in accordance with
49 CFR part 1520.
0
15. Add Sec.  104.263 to read as follows:

Sec.  104.263  Risk Group classifications for vessels.

    (a) For purposes of the Transportation Worker Identification
Credential (TWIC) requirements of this subchapter, the following
vessels subject to this part are in Risk Group A:
    (1) Vessels that carry Certain Dangerous Cargoes (CDC) in bulk.
    (2) Vessels certificated to carry more than 1,000 passengers.
    (3) Towing vessels engaged in towing a barge or barges subject to
paragraph (a)(1) or vessels subject to paragraph (a)(2) of this
section.
    (b) For purposes of the TWIC requirements of this subchapter, the
following vessels subject to this part are in Risk Group B:
    (1) Vessels that carry hazardous materials other than CDC in bulk.
    (2) Vessels subject to 46 CFR chapter I, subchapter D, that carry
any flammable or combustible liquid cargoes or residues.
    (3) Vessels certificated to carry 500 to 1,000 passengers.
    (4) Towing vessels engaged in towing a barge or barges subject to
paragraph (b)(1), (b)(2), or vessels subject to paragraph (b)(3) of
this section.
    (c) For purposes of the TWIC requirements of this subchapter, the
following vessels subject to this part are in Risk Group C:
    (1) Vessels carrying non-hazardous cargoes that are required to
have a vessel security plan (VSP).
    (2) Vessels certificated to carry less than 500 passengers.
    (3) Towing vessels engaged in towing a barge or barges subject to
paragraph (c)(1) or vessels subject to paragraph (c)(2) of this
section.
    (4) Mobile Offshore Drilling Units (MODUs).
    (5) Offshore Supply Vessels (OSVs) subject to 46 CFR chapter I,
subchapter L or I.
    (d) Vessels may move from one Risk Group classification to another,
based on the cargo they are carrying or handling at any given time. An
owner or operator expecting a vessel to move between Risk Groups must
explain, in the VSP, the timing of such movements, as well as how the
vessel will move between the requirements of the higher and lower Risk
Groups, with particular attention to the security measures to be taken
when moving from a lower Risk Group to a higher Risk Group.
0
16. Amend Sec.  104.265 as follows:
0
a. Revise paragraph (a)(4);
0
b. Remove paragraphs (c) and (d);
0
c. Redesignate paragraphs (e) through (h) as paragraphs (c) through
(f), respectively;
0
d. Revise newly redesignated paragraph (d)(1);
0
e. In newly redesignated paragraph (e)(6), remove the word ``and'';
0
f. In newly redesignated paragraph (e)(7), following the words
``cooperation

with the facility'', remove the symbol ``.'' and add, in its place, the
word ``; and'';
0
g. Add paragraph (e)(8);
0
h. In newly redesignated paragraph (f)(9), remove the word ``or'';
0
i. In newly redesignated paragraph (f)(10), following the words
``search of the vessel'', remove the symbol ``.'' and add, in its
place, the word ``; or''; and
0
j. Add paragraph (f)(11).
    The revisions and additions read as follows:

Sec.  104.265  Security measures for access control.

    (a) * * *
    (4) Prevent an unescorted individual from entering an area of the
vessel that is designated as a secure area unless the individual holds
a duly issued TWIC and is authorized to be in the area. Depending on a
vessel's Risk Group, TWICs must be checked either visually or
electronically using a TWIC reader or as integrated into a PACS at the
locations where TWIC-holders embark the vessel.
* * * * *
    (d) * * *
    (1) Implement TWIC as set out in Sec. Sec.  101.520, 101.525, or
101.530 of this subchapter, as applicable, and in accordance with the
vessel's assigned Risk Group, as set out in Sec.  104.263 of this part;
* * * * *
    (e) * * *
    (8) Implementing additional TWIC requirements, as required by Sec.
104.263 of this part and Sec. Sec.  101.520, 101.525, or 101.530 of
this subchapter, if relevant.
* * * * *
    (f) * * *
    (11) Implementing additional TWIC requirements, as required by
Sec.  104.263 of this part and Sec. Sec.  101.520, 101.525 or 101.530
of this subchapter, if relevant.

Sec.  104.267  [Amended]

0
17. In Sec.  104.267(a), remove the last sentence.

Sec.  104.292  [Amended]

0
18. Amend Sec.  104.292 as follows:
0
a. In paragraph (b) introductory text, remove the words ``(f)(2),
(f)(4), and (f)(9)'' and add, in its place, the words ``(d)(2), (d)(4),
and (d)(9)'';
0
b. In paragraph (e)(3), remove the words ``Sec.  104.265(f)(4) and
(g)(1)'', and add, in their place, the words ``Sec.  104.265(d)(4) and
(e)(1)''; and
0
c. In paragraph (f), remove the words ``Sec.  104.265(f)(4) and
(h)(1)'', and add, in their place, the words ``Sec.  104.265(d)(4) and
(f)(1)''.
0
19. Amend Sec.  104.405 as follows:
0
a. Revise paragraph (a)(10); and
0
b. In paragraph (b), remove the last sentence.
    The revisions read as follows:

Sec.  104.405  Format of the Vessel Security Plan (VSP).

    (a) * * *
    (10) Security measures for access control, including the vessel's
TWIC program, designated passenger access areas, and employee access
areas;
* * * * *

PART 105--MARITIME SECURITY: FACILITIES

0
20. The authority citation for part 105 continues to read as follows:

    Authority: 33 U.S.C. 1226, 1231; 46 U.S.C. 70103; 50 U.S.C. 191;
33 CFR 1.05-1, 6.04-11, 6.14, 6.16, and 6.19; Department of Homeland
Security Delegation No. 0170.1.

0
21. Amend Sec.  105.110 by revising paragraph (b) to read as follows:

Sec.  105.110  Exemptions.

* * * * *
    (b) A public access area designated under Sec.  105.106 is exempt
from the requirements for screening of persons, baggage, and personal
effects and identification of persons in Sec. Sec.  101.520, 101.525,
or 101.530 of this subchapter, as applicable, and Sec.  105.255(c)(1),
(c)(3), (d)(1), and (e)(1) and Sec.  105.285(a)(1).
* * * * *
0
22. Amend Sec.  105.115 as follows:
0
a. In paragraph (c), following the words ``Sec.  105.415 of this
part'', remove the words ``, by September 4, 2007''; and
0
b. Remove paragraph (d), redesignate paragraph (e) as paragraph (d),
and revise newly redesignated paragraph (d) to read as follows:

Sec.  105.115  Compliance.

* * * * *
    (d) By (2 YEARS AFTER DATE OF PUBLICATION OF FINAL RULE), owners
and operators of facilities subject to this part must amend their
security plans, if necessary, to indicate how they will implement the
TWIC reader requirements in this subchapter. By (2 YEARS AFTER DATE OF
PUBLICATION OF FINAL RULE), owners and operators of Risk Group A
facilities subject to this part must be operating in accordance with
the TWIC reader provisions found within this subchapter.

Sec.  105.200  [Amended]

0
23. Amend Sec.  105.200 as follows:
0
a. In paragraph (b)(6) introductory text, remove the word ``part'', and
add, in its place, the word ``subchapter''; and
0
b. In paragraph (b)(15), remove the words ``section 105.255(c) of this
part'', and add, in their place, the words ``Sec.  101.535(a) of this
subchapter''.
0
24. Amend Sec.  105.225 as follows:
0
a. In paragraph (b)(7), following the words ``of its effective
period;'', remove the word ``and'';
0
b. In paragraph (b)(8), following the words ``the audit was
completed'', remove the symbol ``.'' and add, in its place, the word
``; and'';
0
c. Add paragraph (b)(9); and
0
d. In paragraph (c), add a sentence to the end of the paragraph.
    The additions read as follows:

Sec.  105.225  Facility recordkeeping requirements.

* * * * *
    (b) * * *
    (9) TWIC Reader/PACS. For each individual granted unescorted access
to a secure area, the: FASC-N; date and time that unescorted access was
granted; and, if captured, the individual's name. Additionally,
documentation to demonstrate that the owner or operator has updated the
CCL with the frequency required in Sec.  101.520 of this subchapter.
    (c) * * * TWIC reader records and similar records in a PACS are
sensitive security information and must be protected in accordance with
49 CFR part 1520.
0
25. Add Sec.  105.253 to read as follows:

Sec.  105.253  Risk Group classifications for facilities.

    (a) For purposes of the Transportation Worker Identification
Credential (TWIC) requirements of this subchapter, the following
facilities subject to this part are in Risk Group A:
    (1) Facilities that handle Certain Dangerous Cargoes (CDC) in bulk.
    (2) Facilities that receive vessels certificated to carry more than
1,000 passengers.
    (3) Barge fleeting facilities that receive barges carrying CDC in
bulk.
    (b) For purposes of the TWIC requirements of this subchapter, the
following facilities subject to this part are in Risk Group B:
    (1) Facilities that receive vessels that carry hazardous materials
other than CDC in bulk.
    (2) Facilities that receive vessels subject to 46 CFR chapter I,
subchapter D, that carry any flammable or combustible liquid cargoes or
residues.
    (3) Facilities that receive vessels certificated to carry 500 to
1,000 passengers.
    (4) Facilities that receive towing vessels engaged in towing a
barge or barges carrying hazardous materials other than CDC in bulk,
crude oil, or towing vessels certificated to carry 500 to 1,000
passengers.

    (c) For purposes of the TWIC requirements of this subchapter, the
following facilities subject to this part are in Risk Group C:
    (1) Facilities that receive vessels carrying non-hazardous cargoes
not otherwise included in paragraph (a) or (b) of this section.
    (2) Facilities that receive vessels certificated to carry less than
500 passengers.
    (3) Facilities that receive towing vessels engaged in towing a
barge carrying non-hazardous cargoes or less than 500 passengers.
    (d) Facilities may move from one Risk Group classification to
another, based on the material they handle or the types of vessels they
receive at any given time. An owner or operator of a facility expected
to move between Risk Groups must explain, in the facility security
plan, the timing of such movements, as well as how the facility will
move between the requirements of the higher and lower Risk Groups, with
particular attention to the security measures to be taken when moving
from a lower Risk Group to a higher Risk Group.
0
26. Amend Sec.  105.255 as follows:
0
a. Revise paragraph (a)(4);
0
b. Remove paragraphs (c) and (d);
0
c. Redesignate paragraphs (e) through (h) as paragraphs (c) through
(f), respectively;
0
d. Revise newly redesignated paragraph (d)(1);
0
e. In newly redesignated paragraph (c), remove the words ``Facility
Security Plan (FSP)'' and add, in their place, the word ``FSP''.
0
f. In newly redesignated paragraph (e)(6), remove the word ``or'';
0
g. In newly redesignated paragraph (e)(7), following the words ``in the
approved FSP'', remove the symbol ``.'' and add, in its place, the word
``; or'';
0
h. Add paragraph (e)(8);
0
i. In newly redesignated paragraph (f)(8), remove the word ``or'';
0
j. In newly redesignated paragraph (f)(9), following the words ``within
the facility'', remove the symbol ``.'' and add, in its place, the word
``; or''; and
0
k. Add paragraph (f)(10) as follows:
    The revisions and additions read as follows:

Sec.  105.255  Security measures for access control.

    (a) * * *
    (4) Prevent an unescorted individual from entering an area of the
facility that is designated as a secure area unless the individual
holds a duly issued TWIC and is authorized to be in the area. Depending
on a facility's Risk Group, TWICs must be inspected either visually or
electronically using a TWIC reader or as integrated into a PACS at the
access points to the secure areas designated in the facility security
plan (FSP).
* * * * *
    (d) * * *
    (1) Implement TWIC as set out in Sec. Sec.  101.520, 101.525, or
101.530 of this subchapter, as applicable, and in accordance with the
facility's assigned Risk Group, as set out in Sec.  105.253 of this
part;
* * * * *
    (e) * * *
    (8) Implementing additional TWIC requirements, as required by Sec.
105.253 of this part and Sec. Sec.  101.520, 101.525, or 101.530 of
this subchapter, if relevant.
* * * * *
    (f) * * *
    (10) Implementing additional TWIC requirements, as required by
Sec.  105.253 of this part and Sec.  101.520, 101.525, or 101.530 of
this subchapter, if relevant.

Sec.  105.257  [Amended]

0
27. In Sec.  105.257(a), remove the last sentence.
0
28. Revise Sec.  105.290(b) to read as follows:

Sec.  105.290  Additional requirements--cruise ship terminals.

* * * * *
    (b) Check the identification of all persons seeking to enter the
facility. Persons holding a TWIC shall be checked as set forth in
Sec. Sec.  101.520, 101.525 or 101.530 of this subchapter, as
applicable, in accordance with the facility's assigned Risk Group, as
set out in Sec.  105.253 of this part. For persons not holding a TWIC,
this check includes confirming the reason for boarding by examining
passenger tickets, boarding passes, government identification or
visitor badges, or work orders;
* * * * *
0
29. Revise Sec.  105.296(a)(4) to read as follows:

Sec.  105.296  Additional requirements-barge fleeting facilities.

    (a) * * *
    (4) Control access to the barges once tied to the fleeting area by
implementing TWIC as described in Sec. Sec.  101.520, 101.525 or
101.530 of this subchapter, as applicable, in accordance with the
facility's assigned Risk Group, as set out in Sec.  105.253 of this
part.
* * * * *
0
30. Amend Sec.  105.405 as follows:
0
a. Revise paragraph (a)(10); and
0
b. In paragraph (b), remove the last sentence.
    The revisions read as follows:

Sec.  105.405  Format and content of the Facility Security Plan (FSP).

    (a) * * *
    (10) Security measures for access control, including the facility's
TWIC program and designated public access areas;
* * * * *

PART 106--MARINE SECURITY: OUTER CONTINENTAL SHELF (OCS) FACILITIES

0
31. The authority citation for part 106 continues to read as follows:

    Authority: 33 U.S.C. 1226, 1231; 46 U.S.C. Chapter 701; 50
U.S.C. 191; 33 CFR 1.05-1, 6.04-11, 6.14, 6.16, and 6.19; Department
of Homeland Security Delegation No. 0170.1.

Sec.  106.110  [Amended]

0