TWIC Facility Training Requirements ILTA EH&S Meeting St. Louis, MO, September 11, 2008

1. TWIC Facility Training Requirements ILTA EH&S Meeting St. Louis, MO, September 11, 2008 R. Peter Weaver

4. Enclosure (3) to Navigation and Inspection Circular 03-07 July 2, 2007

6. All Sec FSO MTSA, 33 CFR Part 105Personnel Training Requirements All facility personnel must be trained on: • How the TWIC applies to the facility • General recognition of a valid TWIC • Location of secure and restricted areas of the facility • Escorting procedures • Procedures for reporting lost, stolen or damaged cards In addition, personnel with security duties must also be trained on: 2b. More formalized recognition of a valid TWIC 3b. Requirements for the secure and restricted areas of the facility 4b. Additional escorting requirements 5b. Access procedures for those who have reported lost, stolen or damaged cards 6. Resolution of violations (forged or tampered TWICs and security breaches) And finally, the FSO must also be trained on: 7. Integration of the TWIC program into existing access control systems 8. New hire procedures 9. Employee notification requirements

7. All 1. How the TWIC applies to the facility • The Maritime Security Transportation Act (MTSA) of 2002 requires regulated facilities to maintain Facility Security Plans (FSP). • The plans designate secure and restricted areas. • Personnel entering these areas require, by law, a TWIC to be considered for unescorted access. • To obtain a TWIC, TSA & USCG collect payment ($132.50); personal information; • (name, address, DOB, Brthplace, weight, height, employer) biometric information; • (fingerprints, photograph) and conduct a collection of background checks. • (criminal ,terrorism, immigration status). • If the individual satisfies all enrollment requirements, a tamper-resistant biometric TWIC will be issued.

8. All 1. How the TWIC applies to the facility • The enrollment process includes the following steps: • Optional Pre-enrollment (www.tsa.gov/twic, or 1-866-DHS-TWIC) • Enrollment (Acceptable ID are listed on the TSA website) • Fee collection ($132.50) • Security threat assessment and notification of results • Issuance of TWIC at the same enrollment center • The card is valid for five years, subject to revocation. • The cards will eventually be scanned by automated card readers, but not initially. • TWIC holders must keep the card with them in the event of a spot check, or have them readily available (defined as 10 minutes). • Cards MAY be linked to existing access control systems.

9. All 2. General recognition of a valid TWIC (NVIC, Section 3.3 a, p. 6) • All employees should be familiar enough with the TWIC to be able to quickly recognize and verify its validity. • A valid TWIC should include: • Holder’s name, • Photograph, • Valid expiration date, • Smart chip, • On the back, a bar code and magnetic stripe, and • “Integral security features,” including twinkling stars, holograms, and multi-colored waves. • Verification should include: • Match of the photo • Verification that the TWIC hasn’t expired • Visual check of the security features to check for possible tampering or forgery

10. All 3. Location of secure and restricted areas of the facility • Secure and restricted areas must be designated in the FSP. • The entire footprint of the facility is likely to be a secure area. Certain areas are also likely to be restricted areas, requiring a higher degree of security: • docks, loading racks, tank farms, and dispatch offices. • Employees should understand the procedural and physical separations between the two. • The practical difference between restricted and secure areas is in escorting non-TWIC holders.

11. All 4. Escorting procedures (NVIC, Section 3.3c, p.10-13) • Within secure areas, there are two methods of escorting: • Any TWIC-holder, including a contractor, may physically escort up to 10 non-TWIC holders; or • Monitoring by camera, roving watches, security patrols, automatic intrusion-detection devices, or other means that “enable sufficient observation to determine if they are engaging in unauthorized activity or enter an unauthorized area.” Where monitoring by camera, a means of rapid response must be in place. • Within restricted areas, there is one method of escorting: • A TWIC-holder may physically escort up to 5 non-TWIC holders. • Escorting requirements do not apply when non-TWIC holders are being transported in an enclosed vehicle, though they would apply once individuals depart the vehicle.

12. All 5. Reporting lost, stolen or damaged cards (NVIC, Section 3.3 h, p. 24-25) • The individual must immediately report the loss to TSA at 1-866-DHS-TWIC. • This initiates the process of producing a new card. • The replacement TWIC must be picked up at an enrollment center, designated by the individual. • During the interim, the individual may be granted continued unescorted access to secure and restricted areas for up to seven calendar days.

13. Sec 2b. Formal recognition of a valid TWIC (NVIC, Section 3.3 a, p. 4-5) • Positive TWIC identification is required for each TWIC holder at least once daily. • The regulations do not currently require use of readers to verify the electronic features of TWIC (including 6-digit passcode). • IF a facility incorporates TWIC into existing access control systems, the TWIC must be verified by company personnel before unescorted access is granted.

14. Sec 3b. Requirements for secure and restricted areas of the facility • Security personnel should understand facility policies and practices for separating restricted areas from secure areas. • Fencing • Signage • Sections 4 and 4b address escorting requirements for each.

15. Sec 4b. Additional escorting req’ts (NVIC, Section 3.3c, p.10-13) • When a portion of a facility may be shut down for repairs and a large number of contractors may be brought in, the area may be secured and the escorting requirements relaxed within the area. • This practice requires prior approval from the COTP.

16. Sec 5b. Access after reporting a lost, stolen or damaged card(NVIC, Section 3.3 h, p. 24-25) • The individual must produce documentation indicating that the lost, stolen or damaged card has been reported. The facility may grant unescorted access to the individual for seven consecutive calendar days provided: • Another photo id is produced • Possession of a valid TWIC has been verified • It has been reported • No suspicious circumstances surround the card or the employee.

17. Sec 6. Resolution of violations (forged or tampered TWICs; security breaches) (NVIC, Section 4.3, p. 1-2) • If a TWIC is suspected of being invalid or fraudulent, the facility should: • Deny unescorted access. Escorted access would still be allowable. • Check for an alternate source of identification, and check for authenticity • Photocopy the suspect TWIC, if possible • Conduct internal notifications as appropriate, and notify the COTP. • If directed by the Coast Guard, request the individual to remain at the access point, but do not attempt to restrain the individual. • Legal counsel should be sought regarding whether to take the TWIC. • Any additional suspicious activity by an individual or individuals must be reported per the FSP. • The Coast Guard will advise whether an inspector will arrive to investigate.

18. FSO 7. Integration of the TWIC program into existing access control systems (NVIC Section 3.3 f, p. 15-16) • Facility-issued access cards may be used to grant unescorted access if facility systems are associated with physical TWIC validation and expiration. • The system must deactivate a facility card when the TWIC expires. • Where a facility card is utilized in lieu of the TWIC for access, random checks for possession of TWIC should be conducted periodically. • An employee must either carry their TWIC or keep it in “close proximity,” defined as accessible within 10 minutes.

19. FSO 8. New hire procedures (NVIC Section 3.3 h, p.17-21) NOTE: This applies to direct employees ONLY, and not to contractors, truck drivers or any other worker pool • For up to 30 days, new hires that have applied (and paid) for, but have not yet received, their TWIC may be granted access to secure areas by “accompaniment” as opposed to being “escorted”. • To the new hire, this means he may conduct his normal duties within secure areas without being escorted, provided: • All other facility security measures must remain in place. • No more than 25% of employees per company, or work group, may meet this definition at a given time. • The new hire must possess an alternate form of identification. • New hire identification should be considered that references the expiration of his accompanied access provision.

20. FSO 8. New hire procedures (NVIC Section 3.3 h, p.17-21) • Under new hire provisions, conventional secure area monitoring is required in restricted areas. • The employer must be able to articulate to the USCG during a spot check the need for the new hire to have access. • Before these provisions may commence, the employer must submit new hire information to the Coast Guard: • This information must be submitted through Homeport. • The submittal will initiate a name-based check. • Notification is required from the USCG that the new hire passed the check before access may be granted. • There must be no known records suggesting the employee may fail to obtain a TWIC. • New hire provisions are not available for individuals hired with security as a primary responsibility.

21. FSO 9. Employee notification (NVIC, Section 3.3 d., p.14) • Facility owners must notify employees of the requirement to possess a TWIC and which areas of the facility are secure and/or restricted. Notification should provide guidance to an employee on: • The responsibility to possess a TWIC • Whether job requirements will require having unescorted access to a secure or restricted area • Areas of the facility that are public access • Compliance start date(s) • Location of local enrollment centers

22. FSO 9. Employee notification (NVIC, Section 3.3 d., p.14) • Notification may be made by any of the following: • Signage in common areas • Company newsletter notices • Official company announcements • Website postings • Inserts in payroll documents • Facilities are required to provide employees with all required training, and to administer a program that complies specifically with 33 CFR 105 and the requirements of TWIC and the NVIC.

23. Questions?

24. 10/15/08 4/15/09

26. TWIC Railroad Update,( LCDR Jon Maiorine, 7/15 TWIC Stakeholder Meeting) • Coast Guard has met with rail organizations, reviewed with them the latest numbers and what they need to know about TWIC, including COTP compliance dates. They have been questioned about the details of “escorted access” – there are two varieties: side-by-side escorting and monitoring (by camera) escorting. Escorting can be defined different ways. For entry to a restricted area side-by-side is needed for those without a TWIC. Secure areas require either type of escort as long as it complies with regulation and is approved by port owners/operators in the given area, so it will differ from area to area. For the majority of regulated facilities, the entire designated area will be secure and there will be certain small subsets that are restricted. For container facilities the entire area can be restricted, particularly because HAZMAT is not always clearly delineated. Facility security plans regulated under the MTSA are required to be revised and approved by the Coast Guard every 5 years which for most facilities will occur sometime in 2009. As part of the upcoming revisions changes to facility footprints based on the implementation of TWIC provisions can be made. • We now have a commitment from the majority of rail groups that they will comply with TWIC. They are not just requesting to be escorted, but are starting to identify how compliance will impact them. Rail has responded in short order and has stayed flexible in coming up with new ideas. We have encouraged our rail contacts to identify who in these companies interface with MTSA-regulated facilities, to talk to those ports in advance to go over issues of escorting.

27. TWIC: Access Control for Parking Lots and Office Buildings • "Secure" and "Restricted" areas do not (necessarily) have to be separated by fences ! • i.e. tank fields must be restricted, but parking lots might be secure. • Escorting by surveillance is acceptable in secure area, e.g. for visitors and delivery personnel. • Loading racks in some instances (NE) have been deemed secure, allowing less stringent controls, with some remaining restricted due to location and expedience. • Access control to restricted areas might be handled by a combination of chains across roadways or gates, surveillance cameras, signs, painted lines on road surfaces, and patrolling. • This approach has reportedly been accepted by the local COTP in Boston, Portland, New York, Providence and New Haven.