The Good, The Bad & The Ugly – “The Bad”
The past two weeks we touched on “The Good” but this week we’ll provide you with “The Bad” - examples of how improper security measures or lack of them will foster a poor security culture and potentially lead to security violations and breaches of security.
- TWIC credentialing – When TWIC card inspections are not done properly, whether at a 100% rate or not, fraudulent TWIC cards will not be detected. For example, one facility discovered fake TWIC cards on two separate occasions in the same month inside the secure regulated facility during a drill to verify TWIC cards.
- Random screening techniques – During separate audits while observing vehicle and pedestrian screening, some improper techniques were discovered. A security guard climbed into the rig of a semitruck and was moving things around – You can only step up and look inside, you cannot climb in the cab of a truck because it is NOT a search. Remember only law enforcement officers are allowed to conduct searches. Another instance a security guard was asking pedestrians that were being screened to lift up their shirts so their waist line can be observed. This will get you in all kinds of trouble.
- Perimeter fencing and gates – On several occasions, we have seen fence lines with so much vegetation and tree overgrowth you cannot see the fence; gaps underneath the fence and between gates large enough for a 200-lb person to squeeze through; Jersey barriers up against the outside of the fence line providing a nice step to climb over or a large, heavy throw rug hanging over the top of the barbed wire fence; swing set chain used to lock the gate to the secure/restricted dock area or little to no fence around pipelines entering the facility, or not restricting access to critical kill points, such as electrical substations.
- Record keeping – There are so many FSOs that are afraid to delete, throw away or shred documents, especially when it comes to security matters. We cannot count how many times during an audit that several years’ worth of paperwork is unnecessarily kept. One facility had over 9 years’ worth of stuff – which equated to 12 two-foot-high stacks of paper on a table that was mostly Sensitive Security Information (SSI) in the FSO’s office, which most of the time was left open. You only need to keep security documents for two years and Declarations of Security (DoS) for 90 days past expiration. Training records are kept for the duration that individual is employed at your facility.
It’s hard to believe a lot of these poor security practices exist, and they are not hard to find if an audit is done properly or if an FSO conducts a thorough review of their facility and documentation.
TWIC Update - Emergency SSIGram
- Posted by Edward Seebald
The TWIC Reader Final Rule, scheduled to go into effect August 23, 2018, has been delayed. A court order from the United States District Court for the Eastern District of Virginia has delayed the enforcement of TWIC Reader Final Rule for facilities that transfer and non-transfer facilities handling bulk cargoes of certain dangerous cargo (CDC). This court order is a result of a lawsuit against the Department of Homeland Security. The timeframe for completing this litigation is unknown.
The court ruling ordered that the TWIC Reader Final Rule will go into effect on August 23, 2018, for facilities that receive vessels certified to carry 1,000 or more passengers.
Pending legislation on TWIC Reader Final Rule
I am going to provide a rudimentary “School House Rock” lesson and explain why this bill came to be. The House of Representatives last week passed a bill and the Senate passed it today, July 26, which now goes to the President’s desk to be signed into law. The bill was introduced to delay the August 23, 2018, TWIC Reader Final Rule until after an assessment study on the effectiveness of the transportation security card program can been completed and submitted to Congress for review.
If the President signs this bill and it becomes a law, it will now depend on how long the study takes, which has period of performance ending in the spring of 2019. If the study determines the transportation security card program to be an effective security strategy for CDC facilities, it may take several more months to implement the TWIC Reader Final Rule, which puts us into the late summer of 2019, but that could easily change to be sooner or later.
The bottom line is we are looking at a potential six-month to one-year delay that is being driven by a court order and a bill going through the legislation process. As soon as we learn more, we will put out an updated blog. If you have any questions, please do not hesitate to contact me or any of my Associates.
The Good, The Bad & The Ugly – “The Good” continued
This week we’ll provide more examples of “The Good” highlighting what it takes to better your facility security.
- Security Measures for Restricted Areas – How is access to certain restricted areas for employees and visitors determined and who authorizes it? The FSO is ultimately responsible and should be the person making this decision. FSOs authorizing access based on a person’s duties and responsibilities and not delegating that authority can greatly reduce unauthorized access and potentially other security violations. FSOs need to make the time to exercise this authority and not delegate it to facility supervisors because the FSO is too busy. When this authority is delegated, it increases your risk of an employee or visitors being given access to restricted areas where those individuals have no business being.
- Gates – Whether it is the main vehicle gate, the rail gate or the pedestrian gate to the parking lot, they should be kept secured and not left opened for convenience. In addition to keeping gates closed, make sure there are no gaps between or underneath them for personnel to easily gain access. Leaving gates opened for convenience and not closing gaps enables a breach of security to take place, which may lead to worse things.
- Linking company proximity & TWIC cards – Greatly reduce the chance of a breach of security of an expired TWIC card. A lot of facilities integrate their company proximity card, used to gain access to the facility and other areas to include restricted areas, with a person’s TWIC card. When the TWIC card expires, the connected proximity card’s access is denied. Some facility’s Physical Access Control System (PACS) also alert the person at least a month prior to the TWIC card expiring. A way to use technology to reduce human error.
- Training – An established security training program provides PSDs and All Others with the necessary knowledge required by 33 CFR 105.210 and 105.215 respectively. Since the Maritime Transportation Security Act is a performance based law, some FSOs want to guarantee their PSDs and All Others know their security knowledge by requiring annual training. The “best of the best” shun computer-based training and use classroom training. Using technology to ensure everyone completes it annually, the company proximity card is used to document attendance or is associated to the person’s online training account and when annual training is not completed, ACCESS DENIED. This saves the FSO a lot of time trying to figure out who has and who hasn’t had training, plus everyone stays knowledgeable in their security duties.
Again, how did we find all these best practices? By getting out and physically checking, confirming and testing all aspects of the Coast Guard’s facility compliance inspection checklist – NVIC 03-03 change 2 during our audits.
The Good, The Bad, & The Ugly
The Good, The Bad, & The Ugly will be broken down into three security categories with this week’s blog focusing on “The Good”
- 100% TWIC Credentialing - is required by law and facilities properly carrying this out significantly reduce their risk for a potential security breach. That means each TWIC card is physically inspected to verify TWIC picture matches the person entering, the TWIC card has not expired and it is not a fake by using an ultra violet flashlight.
- Random screening techniques - properly carried out to the prescribed screening rate per your facility’s security plan deters personnel from trying to enter the facility with prohibited items especially weapons or explosive devices. Randomly screening personnel leaving the facility will greatly reduce tool theft.
- Perimeter fencing – fencing that meets industry standards (chain link fence, minimum height – 7ft, taut wire or cable at top, bottom rail, outriggers facing the proper direction with barbed wire or razor wire) with proper signage informs outsiders the facility is a restricted area and deters unauthorized access. Some areas commonly overlooked are pipelines entering the facility and around piers or shoreline. These areas can be an easy access for unauthorized personnel.
- Drills and Exercises – drills are required to be conducted once every three months and they cover at least one element of the facility security plan (FSP). Facility security officers that regularly use drills to test themselves, their Alternate FSOs, Personnel with Security Duties (PSD) and All Others stay proficient in their security duties. Do not simulate during drills and exercises unless it’s a necessity because too often procedures, information (e.g., phone numbers), knowledge, or policy is found to be outdated, in error or not being carried out. Remember, we do not master anything by only completing the minimums. Exercises are a full test of the security program and is an excellent barometer on identifying areas of improvement or that your training program and security procedures are working.
How does Seebald & Associates discover all “The Good” or best practices? Our audits, security assessments and plan developments are not just a paper drill. It requires getting out and physically inspecting the facility, questioning PSDs and All Others, and observing security procedures not to assume someone knows something or that a procedure is being carried out properly per their FSP.
New TWIC Card issued by Transportation Security Administration
Current TWIC card holders do not need to replace a valid TWIC card with the new TWIC card design.
- Regulated entities that require TWIC for access will accept and recognize both the current and new TWIC designs until the card’s expiration.
- The new card design is compatible with qualified TWIC readers.
- To deter alteration of the card’s expiration date, the new card includes a color-coded expiration date box that will update on an annual basis.
- The fee for the newly re-designed TWIC card remains unchanged ($125.25) and the credential is valid for five years.