Blog

However, according to 33CFR105.200 (b)(7) – the facility owner or operator must ensure that restricted areas are controlled and TWIC provisions are coordinated, if applied to such restricted areas. [emphasis added]

INTERPRETATION: This tells us that if a portion of your Secure Area is also a Restricted Area, e.g. a Secure/Restricted Area, TWIC provisions must be coordinated.

Join us this month while we review these regulatory definitions and how they apply to your facility. Suggested Reading – National Maritime Security Initiatives , 33 CFR 101.105 and 33 CFR 105.200.

Last week we reviewed the regulatory definitions of Secure Areas and Restricted Areas. Now let’s look at guidance provided by the Coast Guard. NVIC 03-07 GUIDANCE FOR THE IMPLEMENTATION OF THE TRANSPORTATION WORKER IDENTIFICATION CREDENTIAL (TWIC) PROGRAM IN THE MARITIME SECTOR issued July 2, 2007 provides additional information regarding these designations in Paragraph 5; which states:

• The term “secure area” is defined as “the area over which the owner/operator has implemented security measures for access control in accordance with their security plan.” The terms “secure area” and “restricted area” have different definitions and purposes. Regulations at 33 CFR 101.105 define restricted area as “a location requiring a higher degree of security protection” which is used in a number of regulatory requirements. A secure area covers a broader space encompassing restricted areas and includes everything within an access control boundary, as defined in existing security plans. For facilities, the secure area encompasses the entire facility footprint as described in their currently approved facility security plan, with the exception of public access areas and those facilities with significant non-maritime transportation portions who submit an amendment to redefine their secure area. All of these provisions are explained in Enclosure (3) (section 3.3 b) [which follows].
• 3.3 b Secure Areas

(1) A key element of the TWIC Program is the definition of the secure area. A secure area is defined as “the area over which an owner/operator has implemented security measures for access control.” For facilities, the secure area is the entire area within the outer-most access control perimeter of a facility, with the exception of public access areas, and encompasses all restricted areas, with the exception of paragraph 3.3 b (3) below. The secure area is bound by the fence line, gates, waterfront, and other means that provide access control to the area. The secure area is the area regulated by 33 CFR Part 105 and is encompassed by the currently approved security plan.

(2) The terms “secure area” and “restricted area” do not mean the same thing. The restricted area is already defined in 33 CFR Parts 101-106 as “the infrastructure or locations identified in a facility security assessment or by the operator that require limited access and a higher degree of security protection.” (33 CFR 101.105) Additionally, reference (a) spells out certain areas within facilities that must be included as restricted areas (see 33 CFR 105.260). Restricted areas of a facility present a heightened opportunity for a TSI. By virtue of the fact that the secure area encompasses the entire facility or vessel, restricted areas fall within this perimeter.

(3) Facilities with a significant non-maritime transportation portion may submit an amendment to their FSP to request to redefine their secure area to include only the maritime transportation portion of the facility. During this redefinition process, some restricted areas may be eligible for placement outside of the new secure area [emphasis added] depending on their type. (see discussion in section 3.4) …which states in 3.4.a. (3) Some restricted areas may be authorized to lie outside the secure area if owners/operators can demonstrate that they do not directly support or interface with the maritime transportation related portions of the facility. The Coast Guard will generally consider that the following restricted areas have a maritime transportation nexus and should always be included in the secure area:
(a) Shore areas immediately adjacent to each vessel moored at the facility
(b) Areas designated for loading, unloading or storage of cargo and stores*
(c) Areas containing cargo consisting of dangerous goods or hazardous substances, including certain dangerous cargoes*.
*However, in some cases, tank farms or cargo storage areas directly support both maritime transportation and industrial processes (e.g. a coal pile supplied by vessel and consumed in a power plant or a tank farm storing product refined onsite intended for shipment by a vessel). In determining whether these directly support or interface with the maritime transportation portion of the facility, owners/operators should consider the following: risk of a TSI, proximity to vessels and the waterfront, and hazards of cargo. The Coast Guard expects that cargo storage areas near vessels or the waterfront will be included in the secure area, regardless of whether or not they also serve an industrial purpose.

This is the reason why your Seebald & Associates’ prepared FSP may use the terms Restricted Area, Secure Area, and Secure/Restricted Area.

Restricted Area, Secure Area, Secure/Restricted Area

We sometimes are asked:

“What is a Secure/Restricted Area? That designation is not listed or referred to in the regulations.”

To address these differences, we begin this month’s Blog series with regulatory definitions and their interpretation.

33CFR101.105 DEFINITIONS: Unless otherwise specified, as used in this subchapter:

Restricted areas mean the infrastructures or locations identified in a facility security assessment or by the operator that require limited access and a higher degree of security protection. The entire facility may be designated the restricted area, as long as the entire facility is provided the appropriate level of security.

Secure area means the area at a facility over which the owner/operator has implemented security measures for access control in accordance with a Coast Guard approved security plan. It does not include public access areas, as that term is defined in §§105.106 of this subchapter. Facilities subject to part 105 of this subchapter located in the Commonwealth of the Northern Mariana Islands and American Samoa have no secure areas. Facilities subject to part 105 of this subchapter may, with approval of the Coast Guard, designate only those portions of their facility that are directly connected to maritime transportation or are at risk of being involved in a transportation security incident as their secure areas.

Let’s review the Implementation of the National Maritime Security Initiatives Final Rule published July 1, 2003. An important and insightful aspect of every Final Rule is the Agency’s responses to public comments. In response to a request that TWIC requirements be promulgated quickly – the Coast Guard states: ‘46 U.S.C. 70105, Transportation Security Cards, addresses unescorted personnel access to secure areas of facilities [emphasis added] and vessels. Other agencies of DHS (e.g., TSA) are responsible for implementing this section of the MTSA. Other agencies of DHS (e.g., TSA) are developing the Transportation Worker Identification Credential (TWIC) that will be a transportation system-wide common credential, used across all modes, for all U.S. transportation workers requiring unescorted physical and logical access to secure areas of our transportation system [emphasis added]. The goal is to have one standardized credential that is universally recognized and accepted across our transportation system and can be used locally within the current facility infrastructure.’

INTERPRETATION: This tells us that to be granted unescorted access to a Secure Area one must possess a valid TWIC [and have a reason to be in the secure area]. There is no regulatory requirement to possess a valid TWIC for unescorted access to a Restricted Area.

However, according to 33CFR105.200 (b)(7) – the facility owner or operator must ensure that restricted areas are controlled and TWIC provisions are coordinated, if applied to such restricted areas. [emphasis added]

INTERPRETATION: This tells us that if a portion of your Secure Area is also a Restricted Area, e.g. a Secure/Restricted Area, TWIC provisions must be coordinated.

Join us this month while we review these regulatory definitions and how they apply to your facility. Suggested Reading – National Maritime Security Initiatives , 33 CFR 101.105 and 33 CFR 105.200.

The TWIC Reader Final Rule, scheduled to go into effect August 23, 2018, has been delayed. A court order from the United States District Court for the Eastern District of Virginia has delayed the enforcement of TWIC Reader Final Rule for facilities that transfer and non-transfer facilities handling bulk cargoes of certain dangerous cargo (CDC). This court order is a result of a lawsuit against the Department of Homeland Security. The timeframe for completing this litigation is unknown.

The court ruling ordered that the TWIC Reader Final Rule will go into effect on August 23, 2018, for facilities that receive vessels certified to carry 1,000 or more passengers.

Pending legislation on TWIC Reader Final Rule

I am going to provide a rudimentary “School House Rock” lesson and explain why this bill came to be. The House of Representatives last week passed a bill and the Senate passed it today, July 26, which now goes to the President’s desk to be signed into law. The bill was introduced to delay the August 23, 2018, TWIC Reader Final Rule until after an assessment study on the effectiveness of the transportation security card program can been completed and submitted to Congress for review.

If the President signs this bill and it becomes a law, it will now depend on how long the study takes, which has period of performance ending in the spring of 2019. If the study determines the transportation security card program to be an effective security strategy for CDC facilities, it may take several more months to implement the TWIC Reader Final Rule, which puts us into the late summer of 2019, but that could easily change to be sooner or later.

The bottom line is we are looking at a potential six-month to one-year delay that is being driven by a court order and a bill going through the legislation process. As soon as we learn more, we will put out an updated blog. If you have any questions, please do not hesitate to contact me or any of my Associates.

33CFR105.415, doesn’t let us off the hook just yet. The regulation goes on to say, “If the results of an audit require amendment of either the FSA or FSP, the FSO must submit, in accordance with § 105.410 of this subpart, the amendments to the cognizant COTP for review and approval no later than 30 days after completion of the audit and a letter certifying that the amended FSP meets the applicable requirements of this part.” So, if an amendment is required, we need to address this promptly!

As we manage the paperwork related to the audit it is also important to be reminded that 18 USC 47 applies to all § 1001 states: “Whoever … knowingly and willfully—

(1) falsifies, conceals, or covers up by any trick, scheme, or device a material fact;

(2) makes any materially false, fictitious, or fraudulent statement or representation; or

(3) makes or uses any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry;

shall be fined under this title, imprisoned not more than 5 years or, if the offense involves international or domestic terrorism (as defined in section 2331), imprisoned not more than 8 years, or both.”

Well, there you have it, the audit is an important part of your facility’s overall security culture! Be conscientious and keep your personnel, your facility your community and our Country safe and secure!!!

So, we now know that we must conduct audits annually and we also know who can conduct the audit, but what does the audit include?

• First the audit must include an extensive review of the physical site and the security systems being utilized. This is not just a quick 15 minute drive around the facility! The auditor must test your systems, look at your fence lines, gate systems, CCTV systems and all security equipment listed in your FSP.
• Second, the auditor must test your people ensuring that they have the required security awareness understanding and that they are fully carrying out their security responsibilities.
• Third, the auditor must also review all security records and documents to ensure that they are fully compliant.
• After the audit is complete, the auditor should provide the FSO with an Audit letter that should be included with your Records and Documents. Additionally, the auditor should provide you with a detailed report of what they found. This is for your information ONLY. It is not to be provided to the Coast Guard.

A comprehensive audit might also include the conducting of a Drill and Exercise and may include Security Awareness training for your All Other personnel. The Audit is a critical tool to improve your FSP and your personnel!

Once again 33CFR105.415 provides guidance regarding who can conduct the annual audit. The regulation states, “personnel conducting internal audits of the security measures specified in the FSP or evaluating its implementation must:

(i) Have knowledge of methods for conducting audits and inspections, and

security, control, and monitoring techniques;

(ii) Not have regularly assigned security duties; and

(iii) Be independent of any security measures being audited.”

In simple terms, the requirement is that the person needs to be an “expert” and not be part of your facility’s security organization. A pretty good test of whether your auditor is up to the task is to ask yourself the question, “Do I know more than the auditor?” If the answer is “yes”, keep looking for a real expert!

Your auditor must have enough expertise in conducting audits to be your “critical best friend”. They need the knowledge and experience to find your potential flaws, weaknesses and vulnerabilities before the Coast Guard does, or worse yet, the BAD Guys!

Yep, there is a requirement in 33CFR105 that mandates that we have a Security Audit conducted annually at our facilities!

33CFR105.415 (4)(b) states that, “The FSO must ensure an audit of the FSP is performed annually, beginning no later than one year from the initial date of approval, and attach a letter to the FSP certifying that the FSP meets the applicable requirements of this part.”

So, that seems simple enough …….. not so fast, there are additional times when an audit may be required. 33CFR105 goes on to say, ” The FSP must be audited if there

is a change in the facility’s ownership or operator, or if there have been modifications to the facility, including but not limited to physical structure, emergency response procedures, security measures, or operations.”

We now know when we must have an audit conducted. In our next blogs we’ll discuss what should be included in the audit, who can conduct an audit and what documentation is required.

Ok, we have covered The Good, The Bad and now to what you all have been waiting for, The Ugly. Here are some actual examples that will make you say, “No way, that can’t be true”

Access Control

Security Measures for Restricted Areas – At several facilities, pedestrian gates were left wide open during the day with no security guard present – an open invitation for a breach of security. At another facility, a computer server room door consisted of a shower curtain hanging from a shower curtain rod and it was not even marked “Restricted Area” – need we say more? For the rest of the story; that shower curtain was replaced with a steel cage door and is properly marked now.

Physical Security

Perimeter fencing and gates – One facility had a shipping gate with no lock providing easy access to the secure regulated footprint and often this gate was left wide open during business hours for convenience so the loading dock workers did not have to open and shut it after delivery trucks came and gone. While on a tour of a facility during an audit, a five-foot by six-foot hole was found in the perimeter fence line, which appeared to be there for some time – how can that be? How did no one notice it or if they did, why did they not report it? Another facility’s employee parking lot located outside the secure facility where vehicles were parked up against the 5-foot fence, allowing for an easy access over the fence into the secure/restricted area. To make matters worse, there was a container on the inside blocking the view of the security office and making unauthorized access almost undetectable.

Security procedures

Record keeping – There a few FSOs that are unorganized, papers everywhere and when asked to find something, they can’t – in another words, they’re a Hot Mess!!! Now this is during our audit, what is it like during a Coast Guard compliance inspection? One could only imagine. On three separate occasions, an approved FSP had NO Sensitive Security Information (SSI) markings, that’s right no SSI markings on any page. How did this get approved by the local Captain of the Port and not get noticed during previous compliance inspections?

All these examples were found, some in plain sight but others were found because a thorough audit or assessment was conducted. Who does your facility security audits? Would they have found these? FSOs – don’t rely on your auditor to find these discrepancies, you find them before your Coast Guard compliance inspector does. Get out and do reviews, conduct regular drills, and establish a security training program. These are only a few things to start building a security culture that puts security on the same level as safety. Remember, “The Bads & Uglies” can become “Goods!”

The past two weeks we touched on “The Good” but this week we’ll provide you with “The Bad” – examples of how improper security measures or lack of them will foster a poor security culture and potentially lead to security violations and breaches of security.

Access Control

• TWIC credentialing – When TWIC card inspections are not done properly, whether at a 100% rate or not, fraudulent TWIC cards will not be detected. For example, one facility discovered fake TWIC cards on two separate occasions in the same month inside the secure regulated facility during a drill to verify TWIC cards.
• Random screening techniques – During separate audits while observing vehicle and pedestrian screening, some improper techniques were discovered. A security guard climbed into the rig of a semitruck and was moving things around – You can only step up and look inside, you cannot climb in the cab of a truck because it is NOT a search. Remember only law enforcement officers are allowed to conduct searches. Another instance a security guard was asking pedestrians that were being screened to lift up their shirts so their waist line can be observed. This will get you in all kinds of trouble.

Physical Security

• Perimeter fencing and gates – On several occasions, we have seen fence lines with so much vegetation and tree overgrowth you cannot see the fence; gaps underneath the fence and between gates large enough for a 200-lb person to squeeze through; Jersey barriers up against the outside of the fence line providing a nice step to climb over or a large, heavy throw rug hanging over the top of the barbed wire fence; swing set chain used to lock the gate to the secure/restricted dock area or little to no fence around pipelines entering the facility, or not restricting access to critical kill points, such as electrical substations.

Security procedures

• Record keeping – There are so many FSOs that are afraid to delete, throw away or shred documents, especially when it comes to security matters. We cannot count how many times during an audit that several years’ worth of paperwork is unnecessarily kept. One facility had over 9 years’ worth of stuff – which equated to 12 two-foot-high stacks of paper on a table that was mostly Sensitive Security Information (SSI) in the FSO’s office, which most of the time was left open. You only need to keep security documents for two years and Declarations of Security (DoS) for 90 days past expiration. Training records are kept for the duration that individual is employed at your facility.

It’s hard to believe a lot of these poor security practices exist, and they are not hard to find if an audit is done properly or if an FSO conducts a thorough review of their facility and documentation.

This week we’ll provide more examples of “The Good” highlighting what it takes to better your facility security.

Access Control

• Security Measures for Restricted Areas – How is access to certain restricted areas for employees and visitors determined and who authorizes it? The FSO is ultimately responsible and should be the person making this decision. FSOs authorizing access based on a person’s duties and responsibilities and not delegating that authority can greatly reduce unauthorized access and potentially other security violations. FSOs need to make the time to exercise this authority and not delegate it to facility supervisors because the FSO is too busy. When this authority is delegated, it increases your risk of an employee or visitors being given access to restricted areas where those individuals have no business being.

Physical Security

• Gates – Whether it is the main vehicle gate, the rail gate or the pedestrian gate to the parking lot, they should be kept secured and not left opened for convenience. In addition to keeping gates closed, make sure there are no gaps between or underneath them for personnel to easily gain access. Leaving gates opened for convenience and not closing gaps enables a breach of security to take place, which may lead to worse things.

Security procedures

• Linking company proximity & TWIC cards – Greatly reduce the chance of a breach of security of an expired TWIC card. A lot of facilities integrate their company proximity card, used to gain access to the facility and other areas to include restricted areas, with a person’s TWIC card. When the TWIC card expires, the connected proximity card’s access is denied. Some facility’s Physical Access Control System (PACS) also alert the person at least a month prior to the TWIC card expiring. A way to use technology to reduce human error.
• Training – An established security training program provides PSDs and All Others with the necessary knowledge required by 33 CFR 105.210 and 105.215 respectively. Since the Maritime Transportation Security Act is a performance based law, some FSOs want to guarantee their PSDs and All Others know their security knowledge by requiring annual training. The “best of the best” shun computer-based training and use classroom training. Using technology to ensure everyone completes it annually, the company proximity card is used to document attendance or is associated to the person’s online training account and when annual training is not completed, ACCESS DENIED. This saves the FSO a lot of time trying to figure out who has and who hasn’t had training, plus everyone stays knowledgeable in their security duties.

Again, how did we find all these best practices? By getting out and physically checking, confirming and testing all aspects of the Coast Guard’s facility compliance inspection checklist – NVIC 03-03 change 2 during our audits.