Keeping Business Moving While Stopping Threats 

Last week we defined and explained credentialing and screening.  These activities are vital components of any security program, but we know that they can be tedious, time consuming, and prone to error.  How can we keep business moving while stopping threats?

The TWIC checks that are at the heart of credentialing are problematic, especially for facilities with a high volume of TWIC holders.  Pull out your TWIC and check the photo against that handsome face in the mirror, then check the expiration date against today’s date – what year is it anyway?  Then check the holograms, the condition of the laminate, and the other security features.  Now repeat the process with other TWICs a few dozen times in the next half hour.    Eyes looking down and glazing over, or up and alert to your surroundings?  By the way, the line is growing.  Feeling secure? 

Human beings just aren’t good at this kind of task.  Fortunately, TWICs are designed to be read by machines.  That gold square at the bottom isn’t there for decoration, it has an antenna for contactless reading, and a chip packed with information.  An electronic reader can validate the TWIC and compare it to the CCL, or Canceled Credential List.  If an individual is convicted of certain serious crimes, or is placed on a terrorist watch list, their name is placed on the CCL, effectively canceling their TWIC if they hold one, and preventing them from obtaining a new or replacement TWIC.  This CCL check is only possible with an electronic reader.

Like all electronics, TWIC readers have dropped in price and increased their capability and reliability since they were first introduced.  Most electronic readers I’ve seen work in a few seconds – less time than it takes to conduct even a cursory manual check.  Some work in non-biometric mode, which still require a visual comparison of the individual to the photo, but electronically validate the TWIC and compare it to the CCL.  For Group B facilities, which aren’t required to do a biometric check, this may be an ideal and affordable option. 

While improving speed and reliability, electronic TWIC readers also allow human beings to do what human beings do better than machines – evaluating the individual for suspicious behavior while remaining alert to the general surroundings for other security concerns.  This combination of increased speed and reliability, while allowing your PSD to observe human behavior, makes electronic readers a good choice, especially for high volume facilities. 

Once your PSD have validated the TWIC, how do they then select individuals for screening?  At MARSEC 1, your FSP or VSP probably specifies some percentage of all arrivals for screening.  A common but poor practice is to screen on a steady, rotational basis, such as every 5th arrival to achieve a 20% screening rate.  This creates an easily observable and avoidable pattern.  I’d bet you dollars to donuts that regular employees (also known as insider threats) are quite aware of any existing pattern.  External threats need only the ability to watch your main gate for a few hours and count to arrive at the same information.  Arrive in between the pre-determined screening points and you in the clear. 

A much better approach is to select persons and vehicles for screening on a random basis.  Unpredictability is the relevant security principle in this case.  If threat actors can’t predict when they might be subject to screening, they can’t predict when they might get caught. 

So how do you make that random determination?  Any way that works.  We recommend the “marble method”, where your security guards pull a marble out of a jar when someone arrives.  A given percentage of the marbles are a certain color, and those lucky individuals get screened.  Gumballs in a machine, a roll of the dice, a spinner from a game board, there are many ways to do this.  There are also electronic devices that will randomly generate a “screen or not screen” decision for you.  Whatever method you use, your PSD should have the discretion to select additional arrivals for screening if they have any concerns. 

A description of actual screening techniques is better suited to a classroom than a blog, but I’ll mention that if screening an individual with a vehicle, it is best to ask the person to exit the vehicle, screen the person first, and then the vehicle, all the while keeping the individual in sight.  Hand held metal detectors, mirrors, cameras, and lighting can make the process speedy and effective.  Be sure you have sufficient space for your PSD to conduct screening without stepping into traffic or other safety hazards.  Designing your gate area to allow other traffic to continue while screening promotes security, safety, and keeps business moving. 

While improving your credentialing and screening practices can’t guarantee security for all possible scenarios, they can make your facility or vessel a less attractive target for both insider and external threats.  By focusing on an area that all crew, workers, visitors, and Coast Guard inspectors experience, you will minimize compliance and operational risk, and promote a strong security culture.