1667 K Street, NW Suite 700 Washington, DC 20006

Transcription

1 National Petrochemical & Refiners Association 1667 K Street, NW Suite 700 Washington, DC voice fax Coast Guard Docket No. USCG USCG Docket Management Facility (M-30) U.S. Department of Transportation West Building Ground Floor Room W New Jersey Avenue, SE Washington, DC May 26, 2009 Re: Comments on the Advanced Notice of Proposed Rulemaking for Transportation Worker Identification Credential (TWIC) Reader Requirements (Docket No. USCG ) Dear Sir/Madam: NPRA, the National Petrochemical & Refiners Association (NPRA) appreciates the opportunity to provide these comments on the Transportation Worker Identification Credential (TWIC) Reader Requirements Advanced Notice of Proposed Rulemaking (ANPRM) (74 FR 13360, March 27, 2009). The petrochemical and refining industries have invested significant resources to ensure the security and resiliency of their own facilities and systems. Many NPRA facilities are subject to the Maritime Transportation Security Act (MTSA) and the TWIC requirements. NPRA commends the United States Coast Guard for its open and consultative approach with industry in developing the TWIC program. NPRA is a national trade association whose members include virtually all refiners and petrochemical manufacturers in the United States. Refining and petrochemical businesses have always placed great emphasis on facility security. NPRA members are absolutely committed to securing all facilities, including maritime operations from threats of terrorism. NPRA s members began actively implementing security measures long before the MTSA and TWIC regulations were developed, to ensure protection against such potential threats as trespassers, eco-terrorists, insurgencies, natural disasters, and other contingencies. NPRA has partnered with the U.S. Coast Guard s Office of Port and Facility Activities since MTSA s inception. For this specific ANPRM, NPRA comments focus on the following issues: Risk-Based Approach to Reader Requirements Reader Requirements

2 Recurring Unescorted Access Privilege Granting PIN Codes Additional Topics and Requirements NPRA further recognizes that this is an ANPRM and that there will be another opportunity to comment on the TWIC Reader program once a proposed rule is published. NPRA also understands that the USCG is currently implementing a small pilot program to test the TWIC readers. NPRA strongly believes that no proposed TWIC reader rule should be published until the results of the TWIC pilot program have been discussed and analyzed. Our detailed comments on the ANPRM are as follows: I. Risk-Based Approach to Reader Requirements NPRA agrees that a risk-based approach to reader requirements is a logical one. However, the Coast Guard should clarify the formal process used for assigning risk groups designation and this designation should be clear-cut for all facilities. NPRA requests that a detailed explanation of the process/formulas used to assign the specific Risk Group be given and that the Coast Guard allow public comment on the method(s). NPRA believes the proposed Risk Groups is inconsistent with like methodologies used nationally for other security, environmental response, regulatory compliance, and enforcement continuums. The entering assumption used for all vessels and facilities is the maximum potential consequence resulting from the total destruction of a vessel or facility. NPRA believes that total destruction is applied too broadly. Many facilities are quite expansive, covering thousands of acres with multiple systems and processes. It would be extremely difficult to affect total destruction of these complexes. Conversely, the Coast Guard needs to recognize that small footprint facilities and vessels are inherently more vulnerable to total destruction. NPRA recommends that risk assumptions include a tiered approach within the risk group that more accurately and reasonably reflects the effects of worst case consequences for each facility or vessel, rather than imposition of a blanket assumption across the spectrum of commodities handled or service type. NPRA disagrees with the Coast Guard that Risk Group A sites be required to do a biometric match at all MARSEC Levels. Consideration should be provided for larger facilities conducting turnarounds or special projects, and which may be employing literally thousands of contractors on a daily basis. In these cases, the requirement to use biometrics may have a significant adverse impact on facilities to operate effectively. For example, an NPRA member facility that employs more than 3,000 personnel, using biometrics daily will have a significant adverse impact on their ability to operate effectively and efficiently, adversely impacting the site island s intermodal delivery systems, and hindering the general public s transportation and commerce. The location of the facility borders well-traveled thoroughfares, each approximately one hundred yards from access 2

3 gates. One bordering access road is the only entrance to the island s container port where all goods and services are transshipped. Daily biometric matches for all entrants will cause traffic backups on public roads, increase hazards to the general public, and unduly delay commerce. The impacts will greatly increase during major turnarounds when 1,000 3,000 additional personnel are surged into the facility. NPRA believes that requiring Risk Group B sites to perform Biometric Verification one day per month at MARSEC 1 may be possible, but it would impose significant and costly burdens on owner/operators for a questionable security benefit. For example, several companies utilize a universal electronic solution to the verification process. If these companies have several facilities that are required to complete this process, there will be a tremendous burden on the corporate staff to complete this task for each facility once a month. If a company has 20 MTSA facilities, in essence, they will be performing this operation once every business day throughout the month. While this task may be appropriate at MARSEC levels 2 and 3, it is burdensome at MARSEC 1 and would not improve security measurably at those sites. NPRA also questions the provision allowing a facility to change its Risk Group based on vessel interface or cargo operations as an acceptable practice. Changing the Risk Group would require the development of a formal process to ensure Risk Groups are raised or lowered against specific criteria, under defined circumstances, and by designated and trained personnel only. This process could create confusion within the facility and promote inconsistencies in how vessels are handled from location to location at every MARSEC level. NPRA agrees that it is reasonable that the lowest Risk Group (Risk Group C) not be required to install TWIC readers. Facilities that are assigned to the lowest Risk Group are expected to be undesirable terrorist targets, minimally staffed, found in remote locations, and often have little or no history of significant security incidents. The requirement to possess a valid TWIC could easily be checked and reinforced during annual USCG audits or spot checks using hand-held readers. II. Reader Requirements NPRA agrees with the proposed escalation of requirements to correlate with each of the three MARSEC levels. The ANPRM asks for comments regarding the everyday operational impacts of these proposed requirements. NPRA finds it difficult to respond appropriately because there is very little detail currently available on how the hotlist process will actually work. For instance: 1) How will the USCG push the hotlist electronically? 2) How will each facility update its lists? NPRA members will require more detail so that their IT groups can plan for systems with appropriate capacity to provide, in the worst case, daily updates to their access control databases. A facility may not have a physical access control point at the entry point to its secure areas; thus, compliance with requirements for Risk Groups A and B would require a handheld TWIC reader that can be interfaced with the TWIC hotlist and updated as frequently as daily. Facilities with virtual boundaries may need additional assurance and clarification 3

4 of USCG expectations to ensure they can fulfill TWIC reader requirements with hand-held devices. Regarding Card Authentication, NPRA agrees with the requirement to use card readers as detailed for each Risk Group. NPRA does believe however, that facilities should continue to have the option to use card readers during facility exit if they choose. However, in the case of Identity Verification, NPRA disagrees with the proposed frequency and application to all Risk Groups. Risk Group A requires a daily biometric match at all MARSEC levels. This approach is overly aggressive because it leaves no additional measures available at heightened threat levels. The advantages of a scaled approach will yield ranging benefits in times of increased threat as evidenced in local, regional and national changes to MARSEC, the national alert system, and threat conditions (THREATCON). Operating at the highest state of security at all times impedes the benefits of heightened awareness for employees during heightened threat levels and may create a false sense of security among employees and security personnel over time. NPRA believes that the spirit and intent of the regulations is achieved through the vetting and clearance of transportation workers, visual card/holder identification and verification, and security feature confirmation during MARSEC 1. Random biometric matching not more than once per month for Risk Group A is a more reasonable requirement. Visual inspection and security feature verification has proven to be a viable means to strengthen access control at maritime transportation related facilities, as evidenced since national implementation. Increases in MARSEC should result in corresponding increases to biometric matching i.e. MARSEC 2: once per week, MARSEC 3: daily for Risk Group A. Conversely, Risk Group C, while clearly a lower risk based on the proposed breakdown of maritime sectors, should have some means of validation, verification, and authentication if only at MARSEC 3. NPRA believes that all Risk Groups should have the ability to read a TWIC. The frequency for all Risk Groups should be based on risk and consequence applied to each facility graduating at each MARSEC level. III. Recurring Unescorted Access The ANPRM requests comments on a reasonable maximum number of personnel per vessel or facility to be granted recurring unescorted access. NPRA has no comment on the appropriate number of personnel to be allowed recurring unescorted access on vessels. However, it should be noted that larger facilities may require hundreds or more unescorted personnel in their secure areas during special project work or turnarounds and it is reasonable to expect that more than 14 would need recurring unescorted access to ensure efficient operations. The Coast Guard should consider large facilities in its determination and provide enough flexibility to register site security personnel, emergency responders, and key managers. NPRA recommends that the Coast Guard consider that the unescorted access number should be revised to an either/or statement using a baseline number or percentage to 4

5 account for small and large facilities equally. This will allow sites the flexibility to register security personnel, emergency responders and key managers. IV. Privilege Granting The proposed rule discusses the concept of privilege granting as an alternative to interfacing with the Hotlist. This procedure would allow an owner/operator to contact TSA and register those persons granted unescorted access privileges. TSA, in turn, would notify the owner/operator if any of those on the list were placed on the Hotlist. The ANPRM questions whether this would be a preferred option and if so, would owners/operators be willing to pay a fee for the option instead of downloading the Hotlist at regular intervals? The ANPRM also asks what would be an acceptable fee range, and what is an appropriate limit on payment? NPRA believes the option of privilege granting would be preferred to interfacing with the Hotlist and recommends that this procedure be adopted. NPRA questions the efficacy or need for sites to pay for this service. However, without the ability to compare fees for this service against expenditures that may be required for the facility to interface with the Hotlist, it is impossible to estimate an acceptable fee range. We recommend the USCG give this alternative additional study and analysis to include cost estimates of implementation and specifics regarding how large, complex sites would update the list. V. PIN Codes The ANPRM asks for comment on whether PINs should be dropped, or considered as an alternative or backup to a positive bio-match, retained as an optional added security layer to be used by owners/operators; or retained during spot-checks and annual inspections. While NPRA believes there is value in a PIN system, infrequently used PINs may be easily forgotten. Our members inform us that many personnel have already forgotten the PINs that they were assigned during TWIC activation. However, in light of potential fingerprint reader reliability issues, and to facilitate commerce while maintaining appropriate security, it seems prudent to retain the PIN requirement as an alternative to fingerprint matching, when such matching is unsuccessful, provided the system is efficient. VI. Additional Topics and Requirements The ANPRM requests comments on whether card readers should be subject to USCG inspection or third-party audits. NPRA believes that card readers should be subject to inspection only during times that they are required to be operational. However, readers that are not required for on-going operations (e.g. card readers taken out of service for periods of time, such as those on turnstiles used for turn-around) should not be subject to inspections. NPRA does not see the value in a third party conducting the audits and instead recommends that inspections be incorporated into the annual USCG security inspection as well as the facility annual self-assessment audit required by the current rule. 5

6 The ANPRM also asks whether all owners and operators should be required to amend their security plans to incorporate the final TWIC requirements and whether the requirement to retain access records for two years is reasonable. NPRA agrees that owners and operators should be granted a reasonable amount of time, no less than 6 months, to complete the amendments. Alternatively, a formal amendment of the security plan can be accomplished at the next 5-year renewal cycle. For facilities, the security plan amendment should designate the risk level based on expected operations over a one-year period. NPRA considers a twoyear record retention requirement reasonable. *************************************************************************** NPRA is grateful for the opportunity to present its comments on this matter. While we have concerns with a number of the TWIC Reader issues, NPRA looks forward to continuing an open, constructive dialogue with the USCG on this subject. If you have any questions, or if NPRA can be of further assistance, please contact me at (202) , or at jgunnulfsen@npra.org. Sincerely, Jeff Gunnulfsen Director Security and Risk Management NPRA 6