10 Steps to Implement TWIC

10 Steps to Implement TWIC

Congress mandated the Transportation Worker Identification Credential in the Maritime Transportation Security Act of 2002 (MTSA) as amended by the Security and Accountability for Every Port Act of 2006 (SAFE Port Act). MTSA directed the secretary of the Department of Homeland Security to prescribe regulations that would prohibit an individual from gaining unescorted access to a secure area as designated in an approved security plan of a regulated facility unless that individual holds a duly-issued transportation security card and is otherwise authorized by the owner or operator to be in such a secure area. Only individuals who are not deemed a terrorism security risk after a criminal history records review and national security database check will be issued a TWIC. The TWIC card is to contain biometric identification data that can be accessed and verified when presented to a facility to gain access to secure areas. This ensures that the individual presenting the TWIC is in fact the individual who applied for and was approved by the Transportation Security Administration for such access.

In its initial phase, the TWIC will only be required to be used as a “Flash Pass.” This means that only a visual inspection of a TWIC will be required when used to gain access to a secure area. It has been announced that the TWIC will be the required credential to gain access to secure areas of regulated facilities by Sept. 28, 2008. The TWIC will cost $132.25 and will be valid for five years. Phase Two will require that the facility utilize a TWIC reader to verify the electronic biometric information stored within the card. Regulations for TWIC reader technology specifications have just been published. See www.tsa.gov/TWIC.

TWIC enrollment began at the Port of Wilmington, Del., on Oct. 16, 2007. Enrollment will begin in Corpus Christi, Texas; Baton Rouge, La.; Beaumont, Texas; Honolulu; Oakland, Calif.; Tacoma, Wash.; Chicago/Calumet, Ill.; Houston; Port Arthur, Texas; Providence, R.I.; and Savannah, Ga. shortly thereafter. Information about the mandated TWIC pilot programs to test TWIC reader technology solutions will be forthcoming as well. Notwithstanding the considerable delays in the implementation of the TWIC program, there are ways that prudent owners and operators can be prepared for the required implementation of the TWIC program. The following 10 steps should provide some assistance.

1. Know the law. The enabling language and legislative rationale for the TWIC program as set forth in the MTSA § 70105, SAFE Port Act Sec. 104, see also remarks of Sen. Ernest Hollings in the Congressional Record, Nov. 14, 2002 at S10975.

2. Connect the dots. Understand how implementing the TWIC program relates to the substantive requirements for facility security plans as outlined in MTSA § 70103 and SAFE Port Act Sec. 102. “Current regulations for appropriate identification for gaining access to a regulated maritime facility.” 71 Fed. Reg. 25066 (April 28, 2006) (Maritime Identification Credentials).

3. Learn how the program will function. Know and understand the regulations promulgated by the Coast Guard and Transportation Security Administration implementing the TWIC program for regulated facilities in general, see 33 C.F.R. pt. 105 (2003) as amended by 72 Fed. Reg. 3582-5 (Jan. 25, 2007), and for facility access control in particular see 33 C.F.R. § 105.255 (2003) as amended by 72 Fed. Reg. 3583 (Jan. 25, 2007).

4. Learn how the program will be enforced. Understand how the Coast Guard will interpret and enforce the TWIC regulations by reading Coast Guard Navigation and Vessel Information Circular (NVIC) 03-07.

5. Know who will need a TWIC. In NVIC 03-07, the Coast Guard indicates that among the populations that it expects to need unescorted access to secure areas of facilities and would accordingly be required to obtain and present a TWIC include: longshore workers, drayage truckers, facility employees who work in the secure area, truckers bringing cargo onto a facility or picking up cargo at a facility, surveyors, agents, chandlers, port chaplains, and other maritime professionals. Review the individuals that seek and are granted access to your facility. Besides employees, think about service providers and contractors as well. Determine who will need a TWIC at your facility.

6. Know who is eligible for a TWIC and how they will get one.

a. Immigration status: U.S. citizens and lawful permanent residents are eligible for a TWIC. Foreign citizens with certain legal status to work or live in the U.S. may be eligible as well. A complete listing of the immigration status that is necessary to obtain a TWIC is found at 49 C.F.R. § 1572.105.
b. Terrorist activity, criminal history, mental incapacity: An individual who has a connection to terrorist activity, has been convicted of certain crimes or has been determined to lack mental capacity will be ineligible for a TWIC.

i. Permanent disqualifying offenses: If a person has a record of having committed one of the offenses enumerated in 44 C.F.R. § 1572.103(a), he/she is ineligible for a TWIC. Such offenses include, but are not limited to, espionage, sedition, treason, terrorism, murder, dealing in explosives.
ii. Interim disqualifying offenses: A conviction within seven years, or release from incarceration within five years of a TWIC application for one of the interim disqualifying offenses enumerated in 44 C.F.R. § 1572.103(b) will also render an individual ineligible for a TWIC. Such offenses include, but are not limited to, firearms crimes, extortion, fraud, bribery, smuggling, kidnapping, arson, robbery, rape, and assault with intent to kill.
iii. Mental incapacity: A person who has been adjudicated as lacking mental capacity or has formally been committed to a mental health facility by a lawful authority is also ineligible for a TWIC.

c. Enrollment and pre-enrollment — learn where the enrollment centers in your port will be located. TWIC enrollment will be conducted by Lockheed Martin. A notice will be published in the Federal Register indicating when TWIC enrollment at a specific location will begin. Owners and operators must notify workers of their responsibility to enroll for a TWIC during the enrollment period. Applicants with access to the Internet can pre-enroll to save time during enrollment. Applicants must provide certain identity documents, submit fingerprints, be photographed and sign application documents at the time of enrollment. Applicants also will be required to pay the fee in cashier’s check, money order or credit card. Lockheed Martin will utilize a combination of fixed and mobile enrollment centers at locations to be announced. Employers with a large number of workers are encouraged to volunteer to host a mobile enrollment site. The TSA will notify the applicant when the credential is ready for pickup and what processes are necessary to activate the TWIC.
d. Appeals and waivers. An appeals-and-waiver process is available for individuals who are denied a TWIC. Appeals are generally for mistakes of fact in the security threat assessment process — for example, the wrong “John Smith,” or an arrest that appears on the record as a conviction. Waivers are for individuals who committed an interim disqualifying act but can provide appropriate evidence of mitigating circumstances. Waivers are not available for permanent disqualifying offices. The protocols for the appeals and waiver process are found at 44 C.F.R. § 1515 et seq.

7. Formulate a TWIC policy for your facility. Merely possessing a TWIC does not automatically grant an individual access to a facility. The facility owner or operator is the arbiter of who shall be granted access. Moreover, neither the TWIC enabling statute, regulations nor NVIC 03-07 require owners or operators to provide escorts to individuals seeking unescorted access to secure areas. Therefore, in order to prevent confusion a facility should prepare a TWIC policy.

a. Learn the difference between “escorting” and “monitoring” and between secure and restricted areas: Escorting is defined as “ensuring that the escorted individual is continuously accompanied while within a secure area in a manner sufficient to observe whether the escorted individual is engaged in activities other than those for which escorted access was granted.” 33 C.F.R. § 101.105. Restricted areas require “a live, physical side-by-side escort” but not necessarily a one-on-one escort. In a secure area, the escorting requirement is more flexible and would permit both physical accompaniment as well as monitoring. There is a special provision for escorting groups in enclosed vehicles.

Monitoring requires the “observation of an individual with means to respond if they are observed to be engaging in unauthorized activities or in an unauthorized area.” Closed-circuit television cameras and other electronic surveillance may be acceptable forms of monitoring but generally not for groups of workers. What approach the owner or operator takes regarding this matter is dependent on the nature of the operation and should be reflected in a security plan.
b. Review your TWIC policy with Coast Guard personnel in your Captain of the Port zone to familiarize them on how you intend to implement the TWIC program at your facility.
c. Determine whether you need to redefine secure or restricted areas in your facility security plan. There is a distinction between secure areas and restricted areas of a facility. Secure areas refers to the area over which an owner or operator has implemented security measures for access control. Restricted areas would be the most secure and limited areas of a facility and usually falls within a secure area. Owners and operators have discretion to designate an entire facility or vessel a secure or even a restricted area. Such a designation must be reflected in the facility’s security plan and would impact the facility’s procedures on escorting and monitoring. Because the regulations differentiate between acceptable escorting ratios and monitoring protocols in secure and restricted areas, each facility should determine its own needs and amend its security plan if necessary. The Coast Guard has extended but not announced a new deadline to file this type of amendment to a facility security plan.

8. Know the technology demands of a fully integrated TWIC system will place on your operations and plan accordingly.

a. Know the technology involved. Phase Two will require that the facility utilize a TWIC reader to verify that the electronic biometric information stored within the TWIC matches the person presenting the TWIC for access. Such a reader will be required at vehicle and pedestrian gates and will need to be secured and mounted on pedestals and have certain power and data requirements. The reader will have to function in all weather conditions.

i. The industry has indicated that it prefers a contactless TWIC reader. This means that the TWIC is waved in the proximity of the reader without being inserted into the reader. An individual also will have to touch the reader with a finger to permit it to verify the fingerprint with the stored biometric fingerprint within the TWIC.

1. Learn how the reader accesses information from the TWIC.

ii. After the fingerprint is verified, the facility’s system will need to verify that the TWIC is valid and has not been revoked by the TSA. The facility will be required to obtain updated revocation information periodically from the TSA, with the frequency determined by the Maritime Security level set by the Coast Guard.

1. Once the reader indicates that the biometric has been verified, it is still up to the facility to determine if that specific TWIC holder is permitted facility access.
2. Integrating the facility’s physical access control policy and function will require the creation of some form of electronic communication between the facility’s database of TWIC holders authorized for facility access and the TSA database of valid and un-revoked TWICs.

a. Published TWIC reader specifications rely on a TWIC Privacy Key (TPK). This means that facilities will have to integrate the TWIC into their physical access control systems in one of three ways (72 Fed. Reg. 53788 [Sept. 20, 2007]):

i. Utilizing one of three magnetic stripes on the TWIC to transfer infer by swiping the TWIC through a magnetic stripe reader and then presenting it to a contactless reader.
ii. Pre-registration of the information on the magnetic stripe into a local physical access control system and then presenting the TWIC to a contactless reader.
iii. Pre-registering the biometric minutiae templates into the local physical access control system until retrieved upon presentation of the TWIC to a contactless reader.

3. Facilities should be working with their system integrators on how the TWIC reader specifications will be integrated into their facility physical access control systems.

b. Interview biometric card reader purveyors and learn about their technology approach and potential solutions.
c. Understand, with your systems integrators, how the TWIC verification and access authorization will integrate with terminal operating and access control systems.
d. Plan for appropriate IT resources to ensure round-the-clock functionality.

9. Understand your obligations as a facility owner or operator: The effective date of the TWIC program is being rolled out on a Captain of the Port zone basis. Notices regarding the relevant compliance dates of the TWIC program in each Captain of the Port zone will be published in the Federal Register. There will be a Federal Register notice announcing when TWIC enrollment begins in each Captain of the Port zone and another notice published at least 90 days in advance of the compliance date for each zone. Compliance dates are the dates that all facilities within a given zone will be required to use the TWIC as the required form of identification to permit an individual unescorted access to secure areas. The regulations require employers to provide notice to employees of their need to obtain and use a TWIC. 44 C.F.R. § 105.200(14).

Certain Captain of the Port zones may have a compliance date earlier than Sept. 28, 2008. Coast Guard enforcement begins on the compliance date. The Coast Guard intends to do spot checking of TWICs utilizing hand-held TWIC readers to ensure compliance. A vessel or facility not implementing the TWIC program after the compliance date will be subject to civil penalties and may be subject to control and compliance measures.

10. Encourage early TWIC applications: Although owners and operators will not have access to TWIC application information, if you become aware of an individual who is reticent about applying for a TWIC because of an event in his or her past, you should encourage them to apply for the TWIC as early as possible to allow them time to fully utilize the appeals-and-waiver process. Set a good example and get your TWIC as soon as possible.