REFERRAL PROTOCOLS FOR AIR CARGO AND MAIL UNDER THE EU PRE-LOADING ADVANCE CARGO INFORMATION (PLACI) RISK ANALYSIS PROCESS

Transcription

1 TAXUD B2/87/2015 REFERRAL PROTOCOLS FOR AIR CARGO AND MAIL UNDER THE EU PRE-LOADING ADVANCE CARGO INFORMATION (PLACI) RISK ANALYSIS PROCESS This working paper on Referral protocols for air cargo and mail is addressed to entities involved in the managing and carriage of air cargo and mail into the EU by aircraft. It has been jointly developed by customs and aviation security communities in order to ensure coherency and alignment between customs and civil aviation security legislation. It refers to the EU regulatory framework for Aviation Security (Regulation (EC) No 300/ ) as well as to the relevant customs legislation, i.e. the Union Customs Code Implementing Acts or future modification thereof. This document adheres to the principle that the responsibility for security by the authorities (customs, aviation security, law enforcement, etc.) and operators involved in the supply chain stay unaffected by it and remain subject to the responsibilities of the relevant EU or national legislators. The development of protocols for adequate anticipation and reaction of authorities and operators had been identified as a necessity for the efficient and effective implementation of the EU advanced cargo information system. The development of the common risk indicators (criteria) for air cargo security risk analysis purposes is being carried out jointly between customs, home affairs and aviation security experts from the Member States and the Commission. The document should be used as guidelines regarding the cooperation between authorities and economic operators under the UCC IA-IV-1-04 paragraphs 1 (3), 3, 4, 5. It also represents the input to the discussion in the ICAO-WCO Joint Working on Advanced Cargo Information. The process flows described in this paper are based on the standards agreed at the Technical Expert Group on Air Cargo (TEGACS) in May 2014, which were included into the WCO SAFE text by the WCO SAFE working group in October 2014 and will be proposed for adoption by the WCO Council in June LEGAL DISCLAIMER: The information contained in this document is of a general nature and not intended to address the specific circumstances of any particular individual or entity. It is neither a legally binding document, nor does it constitute a manual, nor standards nor guidelines. 1. INTRODUCTION Following the Yemen parcel incident and the Air Cargo Security Action Plan supported by the Council of responsible EU ministers, the main action directly applicable to the aviation sector had been the ACC3 regime which renders air carriers responsible for the 1 Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 as supplemented and implemented, in particular through Commission Regulation (EU) No 185/2010 of 4 March 2010 laying down detailed measures for the implementation of the common basic standards on aviation security and Commission Implementing Decision C(2010) 774 of 4 March 2010 laying down detailed measures for the implementation of the common basic standards on aviation security

2 security of cargo and mail they carry into the EU from foreign airports and enhances air cargo controls for high risk cargo. The ACC3 (Air cargo or mail carrier operating into the EU from a third country airport ACC3) regime has been established by Regulation (EU) No 185/2010 and Decision C(2010) 774 and stipulates that cargo and mail entering the EU on an aircraft must be controlled according to EU air cargo screening obligations unless it comes from an airport located in a country exempted from these rules 2. The application of such controls 3 shall be ensured by the ACC3 or, if applicable, by a certified foreign Regulated Agent (RA3) from which it receives cargo or mail. Unless exempted, cargo or mail consignments received for transport into the EU must be subjected to the following controls. EU in-bound consignments shall be flown into the EU by an air carrier that has obtained the designation as ACC3 by an EU Member State and is responsible to ensure that either, o physical screening of the consignment took place under its own responsibility or the responsibility of an EU aviation security validated foreign regulated agent (RA3), or o consignments have been processed through a secure supply chain, originating under the responsibility of an EU aviation security validated foreign known consignor (KC3) and delivered directly to the ACC3 or by way of a RA3 also responsible for issuing the security status. Enhanced controls prior to their loading on board of an aircraft to the EU must apply to air cargo and mail consignments considered as high risk (HRCM) based on established risk criteria (list of countries), to consignments that show unjustified tampering or to consignments subject to an alert caused by law enforcement systems. In parallel and at global level ICAO 4 defined high risk cargo and developed further air cargo control mechanisms. While base line screening of cargo or mail is confirmed by Security Status Declarations stating SCO (good for cargo flights) or SPX (good also for passenger flights), high risk cargo screening is declared by the security status SHR. Security Status declarations are to be issued by a (RA3) or an air carrier. Within the customs sector the focus according to the Air Cargo Security Action Plan has been to use advanced data sent to the electronic customs risk assessment systems for air cargo security purposes in order to identify high risk cargo and to develop instruments that would communicate threat parameters, identify high risk cargo and swiftly inform industry about threat. Since the entry into force of the EU Customs Security Legislation in 2011 the EU Customs authorities have a legal responsibility to ensure that a risk analysis is carried out and finalized primarily for security and safety purposes i.e. responsible to make a decision in terms of necessary measures to be taken to mitigate identified risk (e.g. action by the economic operator, or customs control action at different points of the supply chain). Based on the current Customs Import Control System (ICS) and Risk Management systems (CRMS) EU Customs began to develop measures to ensure the collection and analysis of advance information on air cargo and mail prior of being loaded on board of an aircraft into the EU as well as any reaction considered appropriate in relation to identified risk level for the EU bound cargo and mail. It has to be noted that the risk assessment following the pre-loading data submission is only focused on the detection of an immediate risk to aviation, which is the bringing on board an aircraft of articles prohibited by aviation security legislation that could lead to the distortion of 2 Attachments 6-Fi and 6-Fii to Commission Implementing Regulation (EU) No 185/ In accordance with Commission Implementing Decision C(2010) 774 (addressed directly to EU Member States not available to the public) 4 International Civil Aviation Organization 2

3 the plane and/or the loss of lives, e.g. an improvised explosive device (IED), aka "bomb in the box". Three projects on advanced cargo information (ACI) have been conducted. The Express Pilot 2012, the Postal Pilot (started in 2012) and the PRECISE study with freight forwarders and air carriers (2013) which tested data submission prior to loading in the different air cargo business models. Deriving from these projects the following risk mitigation measures are proposed to be included into the Union Customs Code Implementing Act 5 which will enter into force in May : o request for further information on the particulars (data quality and accuracy referral) (Article IA-IV-1-04 (3)) o request for High Risk Cargo and Mail screening (HRCM) by making use of EU Civil Aviation measures (Article IA-IV-1-04(4)) and o notification for do not load (DNL) (Article IA-IV-1-04(5), current 2nd subparagraph of Article 184d(2) Community Customs Code Implementing Provisions) Measures must be carried out as effectively and efficiently as possible, i.e. least disruptive on the supply chain, as early as possible and at the latest before cargo or mail is loaded onto an aircraft at the last airport before entering the Customs territory of the EU. While communication of the mitigating measures is envisaged to be based on a single shipment level and in principle restricted to bilateral electronic message exchange between the customs and the economic operator who carry the risk connected to the shipment for which risk has been identified, the greatest possible dissemination of information should, subject to technical feasibility and communication channels, be provided in particular in cases where risk identified may affect other operators.. Cooperation between different authorities and as well as authorities and economic operators must be defined clearly, including the definition of communication channels by way of referral protocols.7 The particularities of the different air cargo business models (traditional, express, postal model) should be taken into account. 5 Regulation (eu) no 952/2013 of the European parliament and of the Council of 9 october 2013 laying down the Union Customs Code (OJEU l 269 of ) 6 Transitional periods due to the necessary IT implementation will apply and - in fact defer the implementation of the pre-loading air cargo requirements until 2018/ The developed approaches have been tested with the traditional air cargo business model in practice on 5 June 2014 at London Heathrow airport (United Kingdom) with British Airways and on 16 September with Kuehne+Nagel in Mainz-Hechtsheim (Germany) and with the Express Industry on 30 September with EEA in Brussels (Belgium). A test with postal operators is envisaged for

4 2. GENERAL PROCESS OVERVIEW NOTWITHSTANDING PLACI RISK ANALYSES REGULATION (EC) NO 300/2008, INCLUDING HRCM BASED ON 6-I IS TO BE APPLIED I. Data submission and analysis 3.1. Data submission to ICS 3.2. PLACI risk analysis ICS rejects data automatically if field is missing. II. Results No further action required Further Information required Request for HRCM screening in accordance with EU AVSEC legislation Risk to civil aviation requiring immediate action Has the consignment being subject to screening as HRCM in accordance with AVSEC rules? III. Actions No further action required// Request closed message NO Operator to screen the consignment as HRCM and inform Customs about screening result and the screening means and methods applied YES Operator to confirm to Customs about screening result of and the screening means and method applied Customs sends DNL message to Operator. Operator to immediately identify location of consignment inform local authorities as necessary, and activate (aviation) security procedureprocedur es. Does the consignment still represent high risk to civil aviation? Request closed message NO YES Threat to civil aviation requiring immediate action is apparent IV. Decision Consignment can be loaded on the aircraft 4 Consignment cannot be loaded onto aircraft (Do not load)

5 3. THE PRE-LOADING ADVANCE AIR CARGO INFORMATION (PLACI) RISK ANALYSIS PROCESS 3.1. The air cargo data submission to the PLACI process Import Control System (ICS) Following the Customs Code Security amendments (Regulation 648/05), the advance cargo information submission requirements for all goods moved by all modes of transport has been introduced through the Customs Import Control System (ICS). The ICS is operational since The ICS enables Customs Administrations in all Member States of the EU to electronically receive and handle the advance cargo information i.e. Entry Summary Declarations (ENS) and to risk analyse the ENS declarations prior to goods arriving into the EU. The ICS applies to all goods entering, transiting (exiting) the EU Customs territory, unless exclusion applies. In the context of air traffic, currently, the ENS is lodged prior to the arrival of the aircraft at the first customs office of entry in the EU (first airport of call). Currently the ICS is under review to receive better data quality through improved filing arrangements from supply chain parties, to receive data prior to loading of cargo, to address security gaps by removing relevant ENS filing exemptions and to improve ENS data availability among customs authorities concerned. Data required under the EU-PLACI shall be established under the EU Customs rules. Delivering economic operator may be one of the persons referred to in Article 127 (4) and (6) of the Union Customs Code 8 (UCC) and Art. DA-IV-1-08b, e.g. air carrier, importer, freight forwarder, or postal operator, Receiving authority is the customs authority of the EU Member State stipulated in Article 127 (3) UCC. Possible responses to the data transmission are set out in Article IA-IV-1-04, paragraphs 1(3), 3, 4, 5 The economic operator 9 responsible for the EU-bound air cargo or mail submits at least defined limited data set (subset of Entry Summary Declaration (ENS)) 10 to Customs as early as possible before loading onto an EU bound flight to launch the PLACI risk analysis process. Already at that stage the economic operator may choose to submit the complete ENS declaration before loading; the complete ENS must in any case reach the EU customs authorities at the latest 4 hours prior to arrival at the first place/airport of entry to the EU (or at take-off for short haul flights of duration of less than 4 hours). (Article DA-IV-1-03(1), Article DA-I-2-01(1)(b) + Annex B DA for data sets). If a required data field for the minimum data-set is missing or the data set does not comply with the data requirements and/or the rules and conditions set out in the legal provisions 11 and ICS specifications, the message from the economic operator is automatically rejected. 8 Regulation (EU) No 952/ Either the carrier or a related person (UCC 127 (4)), or another person UCC 127 (6), e.g. house air waybill issuing party, postal operator, DA-IV-1-08) 10 Preloading data set (also known as "7+1"), it is defined in the WCO SAFE (revision 2015), Annex II, is a subset of the entry summary declaration (ENS) pursuant to UCC 127 (1) 11 Annex B-DA and IA of UCC (column F2D or F3B or F4D) 5

6 3.2. PLACI risk analysis process In addition to the general customs pre-arrival risk analysis process for customs security and safety purposes, in the context of aviation a pre-loading air cargo and mail risk analysis process is required (the so-called 'First layer of security risk analysis' process), following the key principles: takes place prior to loading of air cargo or mail onto an EU-bound flight (pre-loading); based upon a minimum data set 12 ; checks against common risk criteria relevant for aviation security specific risk ('bomb-in-a-box'), to be developed jointly by EU authorities 13 responsible for the respective risk; identifies the possible presence of high risk; leads to the following conclusions, communicated either tacitly or actively prior to loading: 'no further action required', relevant risk mitigation measures or 'do not load' onto an aircraft. EU Customs authorities are responsible for the PLACI risk analysis process and in particular its management through the established communication channels between customs authorities and economic operators and the supporting electronic system. At national level, EU Member States must define the extent to which other authorities, such as aviation security or law enforcement at different levels participate in or supplement the process of the first layer of the customs security risk analysis. At any time in the process EU Customs authorities remain free to escalate mitigation measures instantaneously. In the absence of any immediate risk to aviation, EU Customs authorities may order, if appropriate, a documental or physical inspection of the consignment upon arrival at an EU airport Possible consequences of the PLACI risk analysis process The following reactions may occur as a result of the pre-loading PLACI risk analysis process: 1) No further action is required 2) Further information is required (data quality and accuracy referral) 3) Request for HRCM screening 4) Notification for a do not load (DNL) 1) No further action before loading is required by the economic operator in the cases where no air cargo security related risk is identified (Article IA-IV-1-04 (1)). No identified high-risk beyond a possible risk already mitigated through EU aviation security legislation on in-bound air cargo and mail (ACC3 regime) points 6.7 and 6.8 of Regulation (EU) No 185/2010. Cargo continues to move through the supply chain. In the case where no air cargo security related risk is identified no communication between authority and economic operator is required, however the IT platform may deliver at the traders choice the indication of "no further action required". As a rule pre-loading data submission shall take place prior to cargo or mail being loaded onto an EU-bound flight or rather as soon as possible once data becomes available. 12 Shipper name and address, consignee name and address, number of pieces within the consignment, gross weight, commodity description, House Air waybill 13 By customs jointly with other competent authorities, e.g. Civil Aviation and Interior Authorities 6

7 While no minimum time for latest possible submission of required pre-loading data-set is defined, it is however important to ensure that pre-loading data reaches the EU customs as early as possible to undertake a first layer of security risk analysis. A late submission may lead to the disruption of the secure supply chain in case specific measures would be required to be performed by the economic operator (i.e. HRCM screening or DNL). 2) Request for further information on the particulars to complete the risk analysis (Article IA-IV-1-04 (3)) This request is communicated electronically by customs to the economic operator concerned if the pre-loading minimum data set is insufficient or inadequate, e.g. if it does not contain relevant data about real supply chain parties motivating the transaction, but instead freight forwarder information in the consignor or consignee fields or the goods description is not sufficient (e.g. terms used like "consolidation", "spare parts", "miscellaneous goods"). Alternatively EU Customs authorities may accept to access further information from company specific imaging repositories, where this has been made available by the economic operator. During this process cargo continues to move through the supply chain. A. Recipient of the request for further information: The economic operator according to Article IA-IV-1-04 (3). B. The request is to be communicated by the responsible Member State to the economic operator that submitted the data - and, where different, inform the carrier, provided that the carrier is connected to the customs system - by means of ICS (or alternative use of the access to the economic operator s proprietary system). C. Message content: Request for providing adequate data (e.g. based on Air waybill, consolidated cargo manifest, commercial invoice etc.) D. Reply by the recipient through the transmission of the required data, either through amendment of the original minimum data-set submission or complete ENS, or by making data available to the customs through access to its proprietary system or other systems of communication (e.g. structured information through the ICS channel). The operators can submit any additional information they deem necessary (e.g. results of screening if available). E. Reaction in case of sufficient feedback. Responsible authority send a "request closed" message at the traders choice. F. In the absence of sufficient feedback within a reasonable 14 time frame the PLACI risk analysis process is pursued and, due to the un-satisfactory data quality provided, may lead to a request for further risk mitigation. 3) Request for High Risk Cargo or Mail (HRCM) screening (Article IA-IV-1-04(4)) When the PLACI risk analysis process concludes that a consignment is considered as a possible high risk to the air cargo security or in the absence of sufficient feedback on a request for further information it must be subjected to the risk mitigation measures under 14 To be defined 7

8 the EU aviation security legislation 15, at the earliest possible opportunity. This request is communicated by customs to the economic operator(s) concerned electronically. Physical screening of air cargo or mail, including HRCM screening of consignments identified as posing risk to the air cargo security must be performed by either, a RA3, an ACC3 at a foreign location, or another air carrier, cargo handling entity or foreign regulated agent if the consignment is to be loaded onto an aircraft departing at an airport located in a country exempted from the ACC3 regime. It must involve the use of effective explosive detection technology. A. Recipient of the request for risk mitigation measures: a) The economic operator, etc. according to Article IA-IV-1-04 (4). b) The appropriate authority for aviation security of the same Member State, subject to established communication channels. B. The request for risk mitigation is to be communicated by the responsible authority to the economic operator that submitted the data - and, where different, inform the carrier, provided that the carrier is connected to the customs system -, by means of ICS. C. Message content: Request by customs for HRCM screening 16. D. Reply by the recipient of the request for mitigation measures on the results of the screening process including information on the screening means and methods: a) Confirmation that HRCM screening has caused no alarm and that SHR status has been assigned to the consignment. As evidence, a copy of the Consignment Security Declaration 17 (in e-csd format) or equivalent documentation should be provided. b) Confirmation that HRCM screening has caused an alarm and evidence concerning the screening process and in particular the screening means and methods applied, including screener alarm resolution process. E. Reaction in case of no-alarm Responsible authority send a "request closed" message at the traders choice. F. Reaction in case of alarm a) Economic operator activates protocols as per operator (aviation) security programme(s). b) Responsible authority may request further risk mitigation measures to be undertaken or, issues a 'Do Not Load' notification if appropriate. 4) Notification for 'Do Not Load' (Article IA-IV-1-04(5)) If a high risk to civil aviation requiring immediate action is identified (i.e. reasonable grounds for the customs authorities to consider that the introduction of the goods into the customs territory of the Union would pose such a serious threat to the security and safety of the Union that immediate intervention is required; e.g. that the consignment contains 15 In accordance with Chapter 6 of the Commission Regulation (EU) No 185/2010 and Commission Implementing Decision C(2010) In accordance with Attachment 6-J of Commission Implementing Decision C(2010) 774 (not publically available) 17 Both the electronic format and the written format are compliant instruments and of Regulation (EU) No 185/2010 8

9 an assembled explosive or incendiary device), a notification for 'do not load' is issued in order to remove the consignment immediately from the supply chain. While it is envisaged that this notification is communicated by customs to the economic operator concerned electronically (as 'do not load' remains an instrument under customs legislation), close cooperation of the all authorities potentially involved, inside and outside the EU, is required. The use of other protocols and/or channels of communication between authority and economic operator may need to be established to ensure effective implementation of this measure. Moreover, the potential risk should be shared through all available national and international communication channels in particular by means of the (aviation) security community. EU Customs is to perform further risk analysis to identify shipments with similar characteristics of other carriers and inform all relevant actors accordingly. A. Recipient of the notification: a) The economic operator, etc. according to Article IA-IV-1-04 (5). b) A predefined information escalation will be triggered at the level of the appropriate authorities, at national and European level. B. The notification for 'do not load' is communicated by the responsible authority to the economic operator that submitted the data - and, where different, the carrier is informed, provided that the carrier is connected to the customs system - by means of ICS, and wherever possible through available and agreed other communication channels (e.g. phone). C. Message contents Notification for 'Do Not Load' by EU Customs D. Required reaction by the recipient of the 'Do Not Load' notification a) Immediate localisation of the high risk consignment subject of the 'Do Not Load' notification. b) Activation of all relevant emergency response protocols and security processes (i.e. security information to potential air carrier, other economic operator, cargo handling entity, etc.). c) Where appropriate, notification to the relevant (local security) authorities. E. The appropriate authority/authorities identified by EU or national legislation shall undertake or assist in the following (emergency) activities: a) Assessment of possible further consequences of the identified risk, including targeting of consignments with similar characteristics through the EU-PLACI risk analysis process or other relevant instruments. b) Attempt to share risk information with all potentially involved economic operators, to allow for the rapid identification of similar risk. c) Coordination with other national authorities potentially involved in further risk mitigation. d) Assistance to the economic operator in the management of the 'do not load' notification situation. e) Coordination with the appropriate authorities of other EU Member States, directly or through European institutions (AVSEC committee). 9

10 f) Where applicable, coordination with the appropriate authority of the State in which the consignment subject to a 'do not load' notification has been identified and/or from where it originated. g) Where applicable (consignment on airborne aircraft), coordination with the State of (current) overflight as well as the States responsible for aircraft and operator, i.e. to issue an immediate landing of the aircraft. h) Reporting of the incident in line with legal requirements to European and international organisations (EU, ECAC, ICAO). 10