AGENCY:

Coast Guard, DHS.

ACTION:

Final rule.

SUMMARY:

The Coast Guard is delaying the effective date for three categories of facilities affected by the final rule entitled, “Transportation Worker Identification Credential (TWIC)—Reader Requirements,” published in the Federal Register on August 23, 2016. These three categories are: Facilities that handle certain dangerous cargoes in bulk, but do not transfer these cargoes to or from a vessel; facilities that handle certain dangerous cargoes in bulk, and do transfer these cargoes to or from a vessel; and facilities that receive vessels carrying certain dangerous cargoes in bulk, but do not, during that vessel-to-facility interface, transfer these bulk cargoes to or from those vessels. The Coast Guard is delaying the effective date for these categories of facilities by 3 years. Specifically, this rule will delay the implementation of the TWIC Reader rule for 370 of the 525 affected Risk Group A facilities by 3 years, while the remaining 155 facilities (which are all facilities that receive large passenger vessels), as well as 1 vessel, will have to implement the final rule requirements within 30 days after the effective date of this rule.

DATES:

This final rule is effective May 8, 2020.

ADDRESSES:

Documents mentioned in this preamble as being available in the docket are included under docket number USCG-2017-0711 and available at https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

For information about this document, call or email LCDR Kevin McDonald, Coast Guard CG-FAC-2; telephone 202-372-1120; email Kevin.J.Mcdonald2@uscg.mil.

SUPPLEMENTARY INFORMATION:

Table of Contents for Preamble

I. Abbreviations

II. Basis and Purpose, and Regulatory History

III. Executive Summary

IV. Discussion of Comments and Developments

A. Confusion Relating to the Difference Between “CDC Facilities” and “Facilities That Handle CDC in Bulk”

B. Concerns Relating to the Effectiveness of Electronic TWIC Inspection

C. Concerns Regarding Partial Implementation of the TWIC Reader Rule

D. Problems Estimating the Total Cost of Implementation of the Electronic TWIC Inspection Requirement

E. Use of Electronic TWIC Inspection at Passenger Facilities and Vessels

F. Miscellaneous Comments

G. Comments on the Regulatory Analysis

1. Comments on the Total Cost of the TWIC Reader Rule

2. Comments on the Economic Impact of the Rules

3. Comments on the Use of the TWIC Pilot Program Data

4. Comments on Collecting New Cost Data

H. Conclusion

V. Regulatory Analyses

A. Regulatory Planning and Review

B. Small Entities

C. Assistance for Small Entities

D. Collection of Information

E. Federalism

F. Unfunded Mandates Reform Act

G. Taking of Private Property

H. Civil Justice Reform

I. Protection of Children

J. Indian Tribal Governments

K. Energy Effects

L. Technical Standards

M. Environment

I. Abbreviations

ANPRM Advanced notice of proposed rulemaking

CDC Certain Dangerous Cargoes

CFR Code of Federal Regulations

COTP Captain of the Port

DHS Department of Homeland Security

GDP Gross Domestic Product

FSO Facility Security Officer

FSP Facility Security Plan

FR Federal Register

GAO Government Accountability Office

HSI Homeland Security Institute

HSOAC Homeland Security Operational Analysis Center

MSRAM Maritime Security Risk Analysis Model

MTSA Maritime Transportation Security Act of 2002

NPRM Notice of proposed rulemaking

OIG Office of the Inspector General

OMB Office of Management and Budget

PAC Policy Advisory Council

PACS Physical access control system

RA Regulatory analysis

SAFE Port Act Security and Accountability for Every Port Act of 2006

§ Section symbol

TSA Transportation Security Administration

TSI Transportation Security Incident

TWIC Transportation Worker Identification Credential

USCG United States Coast Guard

II. Basis and Purpose, and Regulatory History

Pursuant to the Maritime Transportation Security Act of 2002 (MTSA),^[1] and in accordance with section 104 of the Security and Accountability for Every Port Act of 2006 (SAFE Port Act),^[2] Congress requires the electronic inspection of Transportation Worker Identification Credential (TWIC®) cards (“electronic TWIC inspection”) upon entry to secure areas on vessels and in facilities in the United States. Specifically, the SAFE Port Act mandates that the Secretary promulgate final regulations that require the deployment of electronic transportation security card readers.^[3] To implement this requirement in an effective manner, the Coast Guard undertook a series of regulatory actions culminating in a requirement to implement electronic TWIC inspection at certain high-risk vessels and facilities regulated under MTSA. Beginning in 2006, the Coast Guard and the Transportation Security Administration (TSA) conducted a variety of rulemaking actions to implement the requirements. This culminated in the 2016 publication of a final rule implementing the requirement for electronic TWIC inspection (the “TWIC Reader rule”).^[4] A detailed summary of these actions is available in the preamble to the notice of proposed rulemaking (NPRM) (the “TWIC Delay NPRM”) for this rule.^[5]

Existing regulations require all eligible persons who require unescorted access to secure areas of MTSA-regulated facilities to possess a TWIC card. However, while the TWIC card contains sophisticated authentication, validation, and verification capabilities using biographic and biometric information, operators of vessels and facilities are not required to use these features in ascertaining whether persons are authorized to enter secure areas. Instead, security personnel must inspect the card visually (i.e., printed name, facial photograph, expiration date, and overt security features) to allow entry. The TWIC reader rule changed this requirement for a subset of high-risk MTSA-regulated facilities (called “Risk Group A facilities”), requiring that they conduct an “electronic TWIC inspection” before allowing access to secure areas. This involves electronic authentication using the TWIC card's Card Holder Unique Identifier (CHUID), validating that the credential has not been revoked by comparing it to a TSA-maintained canceled card list, and verifying a person's biometric (e.g., fingerprint) to the biometric template stored on the card's chip. Because electronic TWIC inspection requires either purchasing TWIC readers, integration into an existing physical access control system (PACS), or other solutions, and electronic inspection may take longer than visually inspecting the card, the TWIC reader rule applied the electronic TWIC inspection requirement only to a high-risk subset of MTSA vessels and facilities.

After the publication of the TWIC reader rule, the Coast Guard received a variety of communications from persons affected by the rule concerning the scope and cost of the rule. Most significantly, numerous parties took issue with how the Coast Guard defined some of the high-risk facilities that were subject to the electronic TWIC inspection requirement. While the Coast Guard had proposed and finalized text that applied the electronic TWIC inspection requirement to “facilities that handle certain dangerous cargoes (CDC) in bulk,” various parties expressed confusion with that phrase. After the rule published, they stated that they had interpreted that phrase to mean that the regulation applied only to facilities where bulk CDC was transferred from a facility to a vessel (or vice versa), instead of the interpretation utilized by the Coast Guard.^[6] Because of this confusion, various parties stated that they had not been aware of the full scope of the proposed requirements in the NPRM, and thus not had an adequate opportunity to comment on the rule. In response to these inquiries, the Coast Guard published an informal enforcement guidance document in the “Maritime Commons” blog, stating that it would not enforce the electronic TWIC inspection requirements on facilities that did not transfer bulk CDC to or from a vessel.^[7]

On May 15, 2017, several parties petitioned the Coast Guard to amend the TWIC reader rule.^[8] The petitioners specifically requested that the Coast Guard promulgate a new rule that would limit the scope of the TWIC Reader rule to apply only to facilities that transfer bulk CDC to or from a vessel, and that facilities where bulk CDC was otherwise transferred, stored, produced, or used be excluded from the requirements.^[9] They also requested that the Coast Guard delay implementation of the TWIC Reader rule immediately, until we promulgated the new rule.^[10] The Coast Guard denied this petition, stating, “[w]hile you suggest that bulk CDC is only dangerous if it is being transferred to or from a vessel, nothing in our analysis of target or attack scenarios would indicate that such a distinction would be relevant.” ^[11] In addition to the petition, the parties also sued the Coast Guard, seeking to have the TWIC Reader rule vacated on the basis that the plaintiffs had not had adequate opportunity to comment on the rule.^[12] However, the court dismissed the lawsuit on ripeness grounds, without a decision on the merits of the plaintiffs' claims.^[13]

Congress also passed several laws that impacted implementation of the TWIC reader program. On December 16, 2016, the President signed the bill entitled “Transportation Security Card Program Assessment.” ^[14] This law required, among other things, the Secretary of Homeland Security to commission a report reviewing the security value of the TWIC program by: (1) Evaluating the extent to which the TWIC program addresses known or likely security risks in the maritime and port environments; (2) evaluating the potential for a non-biometric credential alternative; (3) identifying the technology, business process, and operational impact of the TWIC card and readers in maritime and port environments; (4) assessing the costs and benefits of the Program, as implemented; and (5) evaluating the extent to which the Department of Homeland Security (DHS) has addressed the deficiencies of the TWIC program previously identified by the Government Accountability Office (GAO) and the DHS Office of the Inspector General (OIG). On August 2, 2018, the President followed up by signing the “Transportation Worker Identification Credential Accountability Act of 2018,” which prohibited the Coast Guard from implementing the TWIC Reader rule until at least 60 days after it submits the above report to Congress.” ^[15]

In response to the petition for rulemaking and other actions taken by private parties and Congress, the Coast Guard proposed to delay implementation of the TWIC Reader rule for some facilities subject to the electronic TWIC inspection requirement. In doing so, we took note of concerns raised in the original analytical works that formed the basis for the TWIC Reader rule, namely the question of “asset categorization” that had been raised by the original Homeland Security Institute (HSI) report on the Coast Guard's risk methodology. That report specifically “suggested that further analysis on risk grouping of asset categories . . . could help to ensure that the results were more defensible.” ^[16] The purpose of the NPRM was to allow for time to better assess the risk methodology and conduct this refinement. Accordingly, we stated that “delaying the implementation of the TWIC Reader final rule requirements for certain facilities could allow us to develop a more precise risk-analysis methodology that would better identify which of these facilities . . . would benefit from the electronic TWIC inspection requirements.” ^[17]

We note that the NPRM did not seek to delay the rule for all facilities covered under Risk Group A. In drawing a distinction between the facilities that would be subject to the proposed delay (the non-transfer facilities), and those we believed should comply on the original 2018 start date, we noted that “unlike situations where CDC is not transferred to or from a vessel, [the categories of facilities covered by the delay NPRM] present a clear risk of a Transportation Security Incident (TSI).” ^[18] While we continue to believe this to be the case, as shown in the discussion below, additional information related to the incurred expenses of partial implementation of the rule, as well as the findings of new studies on TWIC effectiveness, has influenced the scope of this final rule. The reasons for changes between the TWIC Delay NPRM and final rule are discussed below in Section IV, “Discussion of Comments and Developments.”

III. Executive Summary

This final rule finalizes and expands on the proposal in the NPRM to delay the implementation of the TWIC Reader rule for certain facilities. While the NPRM proposed limiting the delay only to those facilities that handle CDC in bulk, but do not transfer it to or from a vessel and facilities that receive vessels that carry bulk CDC but do not transfer bulk CDC to or from the vessel, this final rule delays implementation of the electronic TWIC inspection requirement for all that handle bulk CDC and facilities that receive vessels carrying CDC, including faciltiies that transfer bulk CDC to or from a vessel. The TWIC reader requirement will only go into effect for facilities that receive large passenger vessels and passenger vessels certificated to carry 1000 or more passengers and more than 20 TWIC-credentialed crewmembers. We based this change on comments received, discussed in further detail below, showing that the cost of implementing electronic TWIC inspection will be lower if facility operators can implement the procedure on an enterprise-wide level, rather than in a piecemeal fashion. We believe that this delay best balances the need for security with the economic realities of the affected population. Facilities that receive large passenger vessels will have 60 days from the date of publication in the Federal Register to implement the TWIC reader requirements. 33 CFR 104.263, which covers vessels, is not being amended at this time. Presently, there are no U.S. flagged vessels that carry bulk CDC, and the one passenger vessel certificated to carry more than 1000 passengers and more than 20 TWIC-credentialed crew members is already complying with the 2016 TWIC reader rule, so providing the 60 day delay is unnecessary.

Delaying implementation of TWIC reader requirements at facilities that handle CDC in bulk while implementing the requirements at passenger vessels and facilities carries several benefits. The delay for facilities that handle CDC in bulk will provide DHS time to further analyze the results of the Congressionally-mandated TWIC program assessment and continue the Coast Guard's study of CDC risk. Furthermore, implementation at passenger vessel facilities will improve the security at these public-facing facilities, which handle 60-plus million passengers per year. Finally, it will allow facilities that handle CDC in bulk operators more time to plan their implementation of electronic TWIC inspection requirements, an opportunity to assess new, more flexible reader solutions and technology, and the opportunity to implement a solution(s) on a larger, enterprise-wide scale, improving efficiency.

We note that because DHS only received the results of the TWIC “comprehensive security assessment” (titled “The Risk-Mitigation Value of the Transportation Worker Identification Credential: A Comprehensive Security Assessment of the TWIC Program”) in early August 2019, and the Coast Guard is still analyzing the assessment, this final rule is only one step in our further evaluation of the TWIC reader requirements. The Congressional requirement to implement electronic TWIC inspection requirements in 46 U.S.C. 70105 still stands, and while we still believe that electronic validation of TWIC cards provides valuable security benefits, we also believe the implementation of the electronic TWIC inspection requirement will be improved by additional data and further evaluation.

As a result of this delay, regulated facilities and vessels should not infer that readers, access control systems, or other electronic inspection solutions provide no security value. While certain reader requirements are delayed, facilities or vessels may choose to incorporate such inspection solutions into their Facility or Vessel Security Plans. Specifically, the use of the electronic inspection solutions and the TWIC Canceled Card List (CCL) may enhance security and minimize the risk of an ineligible transportation worker entering a secure area.

Overall, we estimate that delaying the implementation of the TWIC Reader rule for the estimated 370 facilities that handle CDC in bulk will result in cost savings to both industry and the government of $23.74 million (discounted at 7 percent) over a 10-year period of analysis, and an annualized cost savings of $3.38 million (discounted at 7 percent).^{[19]  [20]} Using a perpetual period of analysis, we estimated the total annualized cost savings to industry and the government of the rule to be $1.53 million in 2016 dollars, discounted back to 2016. For the purpose of this economic analysis, we use a 10-year period of analysis in order to properly compare the costs of this final rule and the TWIC reader rule, where we also estimated the costs and benefits using a 10-year period of analysis.

IV. Discussion of Comments and Developments

In response to the publication of the NPRM, the Coast Guard received 13 public comments. All commenters supported the Coast Guard's proposal to delay implementation of the TWIC reader rule, and most urged the Coast Guard to expand that delay in implementation to the class of facility represented by the commenter. Commenters also made a wide variety of statements about their understanding of the electronic TWIC inspection rulemaking documents demonstrating substantial confusion about numerous aspects of the TWIC reader rule, which are addressed extensively below. Finally, commenters provided additional information relating to the costs and implementation concerns surrounding the electronic TWIC inspection requirement that the Coast Guard has, where applicable, integrated into its analysis.

In this document, the Coast Guard has grouped together issues from various commenters into five broad categories, as laid out below. When possible, we have attempted to identify the specific comment to which we are responding. Where applicable, we have included a citation to the comment and page of a statement to which we are responding.

A. Confusion Relating to the Difference Between “CDC Facilities” and “Facilities That Handle CDC in Bulk”

Many commenters expressed confusion about the scope of the population affected by the TWIC reader rule, specifically those that are required to implement electronic TWIC inspection because they meet the requirements in title 33 Code of Federal Regulations (CFR) 105.253(a)(1) for “facilities that handle Certain Dangerous Cargoes (CDC) in bulk.” ^[21] Those commenters argued that they believe this phrase should only attach to facilities where bulk CDC is transferred from a vessel to facility or vice versa. These individuals stated that, if a facility received bulk CDC by other means, or the facility produces, stores, or uses it in its processes, it should not be described as “handling” bulk CDC.

The primary source of this argument is an unrelated requirement in 33 CFR 105.295, which sets forth additional security requirements for “CDC Facilities.” This requirement was established in 2003, and, while the term “CDC Facility” was not defined in regulation, a subsequently-issued policy document from the Policy Advisory Council (PAC 20-04) stated that “in order for a facility to classify as a CDC Facility, a vessel-to-facility interface must occur, or be capable of occurring, and involve the transfer of CDC's in bulk.” ^[22] PAC 20-04 also stated that facilities receiving CDC from entities other than vessels, such as rail cars and tanker trucks, would not be considered CDC Facilities, but that the Facility Security Plan (FSP) for these facilities “must address the fact that they handle such cargoes.” ^[23] This explanation of the meaning of “CDC Facility” contrasted markedly with the elucidation of the phrase “facilities that handle Certain Dangerous Cargoes in bulk” provided in the 2016 TWIC Reader final rule. In that document, we stated that, in the situation where a facility stored or used CDC, or the facility was used to transfer CDC in bulk through rail or other non-maritime means, “such a facility would be considered to `handle CDC in bulk' and would be classified as Risk Group A.” ^[24] We went on to say that “this is because the bulk CDC would be on the premises of a MTSA-regulated facility, and thus the facility's access control system would need to be used to mitigate the risk of a TSI.” ^[25]

While the terms “CDC Facilities” and “facilities that handle CDC in bulk” sound similar, they are not identical, and the Coast Guard did not intend to conflate the two terms or use them interchangeably. The Coast Guard never used the term “CDC Facilities” in any of the TWIC Reader rulemaking documents, and has been using consistent language since the publication of the Advance Notice of Proposed Rulemaking (ANPRM) in 2009 (74 FR 13360). We also note substantial differences in the rationales for the different requirements associated with the two terms. Various elements in 33 CFR 105.295 specifically relate to maritime-specific issues, such as searching waterfront areas for dangerous devices ^[26] and a requirement to release cargo only in the presence of the Facility Security Officer (FSO) or designated representative,^[27] and form the basis for a maritime-based interpretation of the applicability of that section. Such requirements would not make sense for a facility that did not transfer bulk CDC across a dock. Conversely, the attack scenarios that electronic TWIC identification is designed to mitigate are all exclusively land-based, specifically limited attacks from truck bombs, passersby, and (land-based) assault squads,^[28] and there is no reason a maritime nexus should be assumed.

Despite the Coast Guard's use of distinct language and an exclusively land-based rationale in the NPRM, many commenters asserted or implied their belief that the terms were interchangeable, and the Coast Guard's interpretation of the term “facilities that handle CDC in bulk” in the final rule, therefore, contradicted its guidance in PAC 20-04. One commenter submitted a copy of PAC 20-04 with scenarios in which a facilitiy would not be classified as a CDC facility highlighted, and statement “here are several reasons why there are several contradictions.” ^[29] One commenter stated that “the scope of the Final Rule was expanded beyond what was initially proposed and departed from established Coast Guard policy (PAC 20-04),” ^[30] while another requested that the Coast Guard revise the scope of the final rule to make it consistent with PAC 20-04. Yet another commenter stated that applying electronic TWIC inspection requirements to “facilities without a maritime nexus or where there is no transfer of CDC over a dock was unanticipated and unusual based on historical actions taken by the Coast Guard,” ^[31] and while the commenter did not elaborate on what those “historical actions” were, we assume they are referring to the issuance of PAC 20-04. A fifth commenter referred to the application of the term “facilities that handle CDC in bulk” to include facilities that don't transfer CDC over a dock as “a mistake in the August 23, 2016 publication,” ^[32] but did notcomment on the rationale provided in that document.

One commenter stated that “in the proposed versions of the reader rule, Risk Group A included . . . those that exchange [CDC] between the facility and a vessel.” ^[33] The commenter provided various pinpoint citations with this statement, which we examined. The first citation, from the 2009 ANPRM, uses the phrase “Facilities that handle CDC in bulk” ^[34] to describe the facilities that we expected would be included in Risk Group A, without any indication that we meant anything other than the plain meaning of those words. The second citation, from the NPRM (78 FR 17785-86), is unclear. The section of the document that spans these two pages, entitled “Summary of the Major Provisions of the TWIC Reader Advanced Notice of Proposed Rulemaking and This NPRM,” mainly discusses the decision to not propose the ANPRM's suggestion of separate requirements for Risk Group B vessels and facilities. With regard to the issue of Risk Group A facilities, the only relevant text we could find is in Table ES-1, which summarizes the proposal for Risk Group A facilities using identical language to that described in the ANPRM, “Facilities that handle CDC in bulk.” The third citation the commenter provides, 78 FR at 17811, does not appear to contain any relevant textual information, containing only discussions of the HSI report relied upon in the rulemaking and information on additional data sources used in the rulemaking. While the commenter goes on to state that, “in the final rule, other facilities were included, specifically those that contain CDCs and those that transfer CDCs only via non-maritime means, such as by truck, rail, or pipeline,” ^[35] the commenter's citations provide no basis to conclude any differences between the language in the ANPRM, NPRM, and final rule or any basis to conclude that the same phrasing used in each of the documents referred to anything other than the plain meaning of the words.

One commenter expressed confusion regarding the applicability of the electronic TWIC inspection requirement, specifically in regard to how they would implement the requirement if they determined they were a Risk Group A facility.^[36] The regulatory text states that “prior to each entry into a secure area of the facility, all persons must pass an electronic TWIC inspection before being granted unescorted access to secure areas of the facility.” The definition of “secure area” reads, in part, “the area . . . at a facility . . . over which the owner/operator has implemented security measures for access control in accordance with a Coast Guard approved security plan.” This was described at length in the TWIC Reader final rule, and has been clear for some time, such as when stated by the GAO in 2011,^[37] “[f]or most maritime facilities, the secure area is generally any place inside the outer-most access control point.” Nonetheless, one commenter asserted that it had based its planning on “the assumption that electronic TWIC inspections will only be required in those locations where bulk CDC is actually transferred to or from a vessel.” Based on that assumption, the commenter suggested that its current planning processes could lead to unforeseen costs if the Coast Guard does not change its regulations to meet those expectations. We note that the TWIC Delay NPRM did not propose or contemplate the commenter's theory that facilities that handle CDC and transfer it to or from a vessel would only be required to implement electronic TWIC inspection in the “maritime nexus” areas of their facility. If such a transfer facility also handled CDC in other parts of the facility, under the proposed TWIC Delay rule, it would still be required to implement electronic TWIC inspection “at each entry to a secure area” according to the regulatory text.

This confusion, and the potential impact, is also discussed in the August 2019 “comprehensive security assessment” mandated by Public Law 114-278, titled The Risk-Mitigation Value of the Transportation Worker Identification Credential: A Comprehensive Security Assessment of the TWIC Program. The authors of the assessment, the Homeland Security Operational Analysis Center (HSOAC), anticipated that this confusion could “potentially increase the number of facilities . . . subject to the TWIC Reader Rule to an even larger population of facilities.” HSOAC estimates that up to three times as many facilities as estimated in the TWIC Reader final rule may fall under the broader definition of a facility that handles CDC in bulk, driving the estimate from 525 facilities to 1,500.^[38]

Based on the comments received, and the information presented in the HSOAC assessment, we recognize the similarity between the phrases “CDC facilities” and “Facilities that handle CDC in bulk,” which contributed to some confusion among commenters. While we do not believe that the confusion affects the purpose of electronic TWIC inspection or should be the cause for delaying implementation of the rule as a whole, we do understand it may have affected the ability of some facility operators to effectively comment on the full costs of the rule. Accordingly, we are expanding on the proposal in the NPRM to delay the implementation of the TWIC Reader rule at facilities that handle CDC in bulk and transfer such cargoes from or to a vessel.

B. Concerns Relating to the Effectiveness of the Electronic TWIC Inspection Requirement

Since the TWIC Reader rule was published Congress and stakeholders have questioned the extent to which electronic TWIC inspection, compared to visual TWIC inspection, improves security and mitigates the possibility of a TSI. As described above, the TWIC Accountability Act of 2018 delayed implementation of the TWIC Reader rule until after an assessment of its effectiveness.^[39] The HSOAC assessment “review[ed] the security value of the [TWIC] program,” including “evaluating the extent to which the program . . . addresses known or likely security risks in the maritime and port environments” and the extent to which the “deficiencies in the program” identified by the GAO and DHS OIG have been addressed.^[40] The results of this assessment, which are discussed in more detail below and are being considered by the Coast Guard in the decision to delay the TWIC reader requirements, and will be taken in to account in our consideration of follow-up actions to be taken during the delay period provided by this final rule. While this TWIC Reader delay was proposed in order for the Coast Guard to reassess the risk anaylsis methodology for electronic TWIC inspection, questions about the effectiveness of electronic TWIC inspection, and the TWIC program generally, have been raised by various entities over the years. In the comments to this rulemaking, several commenters raised concerns about the effectiveness of TWIC, and we have responded to and contextualized those comments here.

In the TWIC Reader NPRM and final rule, the Coast Guard set forth the security rationale for the electronic TWIC inspection procedure, and explained how it could help mitigate specific terrorist attacks and lessen the possibility of a TSI. The Coast Guard emphasized three particular “attack scenarios”—an attack by a truck bomb, a terrorist assault team, and a passerby/passenger explosive device situation. These were considered the “attack scenarios that are most likely to be mitigated by the . . . enhanced access control afforded by TWIC readers, as they require would-be attackers gaining access to the target in question . . . to inflict maximum damage.” ^[41] Similarly, in the final rule, we noted that we “limited our consideration to attack scenarios that require physical proximity to the intended target and for which access control would affect the ability to conduct an attack.” ^[42] In the response to comments during that rulemaking process, we acknowledged that there were other ways to attack vessels and facilities (for example, by secreting an explosive device in cargo) that would not be mitigated by electronic TWIC inspection. We noted that “[f]or this reason, our analysis in this final rule focuses on threats that could be prevented or mitigated through the use of electronic TWIC inspection.” ^[43]

Many commenters raised questions about the efficacy of the TWIC program in preventing attacks. One commenter stated that a TWIC reader would not prevent the three identified attack scenarios, and that, if it did, “we should be using them in Syria and Iraq.” ^[44] While we cannot speak on the particular security measures used in overseas military bases, we do note that many U.S. government facilities around the world indeed do use some form of access control measures for security purposes.

Another commenter questioned the utility of electronic TWIC inspection in the three identified scenarios, asserting that “an individual or group intent on executing such an attack would not be deterred simply because the targeted facility requires electronic TWIC inspections rather than visual TWIC inspections.” (emphasis in original) ^[45] We disagree that electronic TWIC inspection would offer no additional security value over visual inspection in such a case. Visual inspection cannot detect if a card has been revoked, cancelled, or stolen. It is also less effective at determining if a card is counterfeit or if the person presenting the card is the person to whom the card was issued. In short, it would be likelier for an adversary to gain unescorted access to the target—the secure area of the facility—if the facility relied only on visual TWIC inspection. The commenter went on to assert that “terrorists generally use brute force when attacking a target—particularly when carrying out the types of attacks identified by [the Coast Guard's Maritime Security Risk Analysis Model] MSRAM, . . . or blow up a checkpoint or other barrier rather than stop to use false credentials to gain access.” (emphasis in original).^[46] We agree that the inability to infiltrate a facility could cause a terrorist group to employ additional means to initiate a full-scale attack on a facility, if electronic inspection were used. However, we would consider this an issue of electronic TWIC inspection “mitigating” an attack, as the latter scenarios may be more difficult to mount, easier to detect, provide more time for responders to arrive, or give potential targets advance warning of an attack and time to clear the targeted area, among many other considerations. We also note that the measures taken to mitigate these sorts of brute-force attacks, such as bollards, fences, or other barriers, are generally ineffective at preventing the infiltrations mitigated by electronic TWIC inspection. The two types of security measures are complementary, not mutually exclusive.

Several commenters ^[47] raised concerns that the Coast Guard had not adequately addressed concerns raised by the GAO in its 2013 report on the TWIC program.^[48] While the 2013 GAO report raised some concerns about the TWIC program, we do not believe that report exposed specific problems with the electronic TWIC inspection requirement. Instead, it noted concerns about the TWIC program that are outside the scope of the electronic TWIC inspection requirement (e.g., unreliable cards and readers used in the TWIC pilot program, or the ability of GAO operatives to obtain genuine TWIC cards at enrollment centers using fraudulent means), and noted that the Coast Guard had not conducted an effectiveness assessment of the TWIC program as GAO had recommended in 2011.^[49] Many of the GAO findings, for example, noting that “the use of TWIC with readers would not stop terrorists from detonating a truck at the perimeter of a facility, . . . or obtaining a TWIC card using fraudulent documents as we did through covert means” are in fact identical to the Coast Guard's analysis of these same facts, where we noted that electronic TWIC inspection does not prevent every conceivable security threat.^[50] Furthermore, we note that the Coast Guard and TSA addressed many of the issues that GAO raised, such as questions about the appropriateness of a single TWIC credential versus state and local credentials, improved fraud detection techniques, the establishment of internal and quality controls, or data collection questions regarding the TWIC program, programmatically, and they no longer presented an issue by the time we issued the TWIC Reader final rule.

Several commenters asserted that the Coast Guard's failure to heed GAO's recommendation to perform an effectiveness study render the final rule flawed. One commenter stated that “the Coast Guard's insistence on promulgating a TWIC Reader Rule while refusing to substantively respond to the GAO's and HSI's ^[51] critiques was arbitrary and capricious, and was contrary to the obvious intent of the SAFE Port Act that the rule be based on empirical cost-benefit data. Although the Coast Guard admits TWIC reader utility requires further study . . . it nevertheless insists on partial implementation.” ^[52]

We believe the commenter here has conflated several ideas. First, we note that while the GAO report stated that an effectiveness study should be performed, the report was directed at Congress, which declined to act on the recommendation until after the Coast Guard promulgated the final rule.^[53] The HSI study, on the other hand, expressed concerns about the use of asset categorization and, separately, the mechanism by which the Coast Guard integrated the “TWIC utility” factor in determining risk assessments to inform asset categorization.^[54] Those topics, while important, are not the same thing as effectiveness. Furthermore, we disagree with the commenter's assertion that promulgating the rule despite the concerns in these reports renders the rule legally invalid. We note that the HSI report, despite expressing concerns, did validate the Coast Guard's risk analysis methodology and endorse the asset groupings the Coast Guard suggested. In addressing the public comments on the TWIC rule, written after the GAO report was released, we noted that the overwhelming majority of the commenters supported the electronic TWIC inspection requirements in general based on the security analysis conducted by the Coast Guard, the lack of a generalized “effectiveness” study notwithstanding. While the issues raised by stakeholders after the final rule was promulgated merited consideration regarding implementation of the electronic TWIC inspection requirement, we did not then and do not now believe that they invalidate the fundamental principles upon which Congress and the Coast Guard based the analysis.

Nonetheless, as recommended by GAO, and mandated by Congress, DHS has provided the HSOAC assessment of the security value of the TWIC program. While many of the assessment's conclusions concern areas outside of the particular security effectiveness of the electronic TWIC inspection requirement, the assessment found that there were some security benefits to electronic inspection of TWIC cards and that readers may be a beneficial investment for facilities and vessels. Specifically, the assessment found that “the TWIC program is strongest in reducing the risk presented by individuals who are known or suspected terrorists and who seek to conduct an attack on a maritime facility that would require persistent insider access via possession of a TWIC credential.” ^[55] The assessment determined that “TWIC does impose costs on the adversary,” and “likely contributes to pushing threatening actors toward simpler and potentially less harmful attacks.” ^[56] Furthermore, the assessment found that the TWIC card reader could “increase the likelihood that invalid TWIC cards are detected, and biometrics provide a robust mechanism for identity verification.” ^[57] Moreover, some existing users have found that the use of biometric, electronic readers can be both cost saving and security enhancing. However, the assessment reiterated that the value of TWIC is directly related to the quality of security that a vessel or facility has overall, including having other security mechanisms in place, such as security guards, PACS, and deployable security barriers. Ultimately, the assessment found that adversaries are capable of gaining unauthorized access via other means and that “threats TWIC is best intended to mitigate are . . . not the most pressing.” ^[58]

The cost effectiveness analysis on the electronic inspection requirements in the TWIC Reader rule provided by the HSOAC assessment was less favorable, stating that “one would be hard-pressed to state the benefits of TWIC reader rule outweigh the costs.” ^[59] In making this determination, the assessment examined the Coast Guard's methodology for determining the costs and benefits in the regulatory analysis of the 2016 final rule. HSOAC then conducted their own analysis using the same methodology with new cost data, when available. The assessment found that the Coast Guard underestimated the costs of the programs and overestimated the benefits by using the highest maximum consequence scores. The “break-even” analysis used by the Coast Guard to determine the benefits of the rule was found to be appropriate, because it is well-established in the cost-benefit literature, and has been widely used in previous DHS rulemaking projects. However, the assessment found the Coast Guard overestimated the benefits by using the average maximum consequence of a successful terrorist attack, as provided by MSRAM, as the “worst case” scenario in the analysis.^[60] The assessment suggests the use of a range of consequence scores or the average consequence score would be more appropriate.^[61] However, as noted in the report, the use of MSRAM data is limited due to classification restrictions on the data, and in the 2016 analysis, the Coast Guard was only able to use the maximum consequence for this reason.

The assessment also provided several suggestions and alternatives to the existing program to improve the cost-effectiveness, including limiting the facilities subject to the regulation by using a narrower definition, or using different readers (such as portable readers that can be used intermittently, access control systems or other inspection solutions). Despite the reservations regarding the cost effectiveness and benefits surrounding the TWIC readers, the assessment found that approximately 50 percent of facilities HSOAC visited and examined have implemented electronic inspection for TWIC, either in a PACS or portable reader, and that in some cases those PACS also verify identity using biometric systems.^[62] Also, nearly 20 percent of facilities sampled by the assessment used more technologically sophisticated biometric readers. During this delay period, USCG will be looking at various means of implementing the use of TWICs at maritime facilities including more efficient and cost effective electronic validation modes and methods.

The facilities interviewed in the HSOAC assessment that effectively integrated readers or access control solutions into operations have had largely positive experiences.^[63] Perceptions were mixed on the degree of enhanced security that the readers added, with over half of the facilities interviewed finding some benefit. Those facilities found specifically that “if the readers are working properly, they are an effective tool and provide an additional level of comfort and security.” ^[64] While the HSOAC assessment favors a system approach to risk-mitigation and does not advocate the use of TWIC as a sole means of security for vessels and facilities, the Coast Guard is encouraged by positive feedback provided by those facilities that preemptively use TWIC readers, particularly the satisfaction with the program as a whole. The Coast Guard is further analyzing the suggestions and comments provided in the assessment, and determining if modifications should be made to the program during the delay period.

C. Concerns Regarding Partial Implementation of the TWIC Reader Rule

In the delay NPRM, the Coast Guard cited concerns about the risk analysis methodology for electronic TWIC inspection as the chief reason for proposing a partial delay of the TWIC Reader final rule. Specifically, we highlighted concerns about “asset categorization,” the practice of grouping and analyzing facilities by class, as a basis for the application of the electronic TWIC inspection requirement. For example, the Coast Guard treats all facilities that “handle CDC in bulk” as being in the same class, regardless of the geographical location of the facility (e.g., whether it is near a large population center) or the specific types and quantities of the bulk CDC handled at the facility (e.g., whether it is a few thousand gallons of propane or several thousand tons of chlorine). While questions about how the Coast Guard would consider particular situations where the presence of bulk CDC did not pose a threat above a particular threshold were addressed in the TWIC Reader final rule, concerns raised after its publication caused us to re-evaluate whether the risk analysis methodology was adequate or satisfactory.^[65] Furthermore, we began the process of reconsidering whether asset categorization was an appropriate means by which to evaluate the risk potential of facilities, as opposed to a more individualized methodology that incorporates factors such as local population, environmental considerations, and similar factors. The possibility of inadvertently capturing low-risk facilities in the mix of Risk Group A facilities was the reason we proposed to delay the TWIC Reader rule for “non-transfer” facilities. However, because “transfer” facilities and passenger facilities are high risk due to the targets inside the facilities themselves, irrespective of exogenous considerations, we declined to propose delaying the electronic TWIC inspection requirements for those classes of facilities.^[66]

Several commenters responded negatively to the Coast Guard's proposal to implement the electronic TWIC inspection requirement in only some Risk Group A facilities. One commenter urged the Coast Guard to delay the requirement for all Risk Group A facilities “rather than work piecemeal.” ^[67] Another commenter asserted that a delay for all facilities is necessary because “manufacturers need regulatory certainty to make appropriate, economically justifiable long-term investments to protect facilities' threat and vulnerability conditions,” and that a partial delay will “continue to create regulatory uncertainty.” ^[68] A third commenter asserted that “Coast Guard personnel offered that delays for implementation for the Final Rule were likely,” and that “it was expected that any delay for the implementation would apply to all facilities.” ^[69]

We take seriously concerns that Coast Guard statements and actions taken subsequent to the issuance of the final rule, including the passage of legislation that postponed the implementation of the rule, could create regulatory uncertainty. One commenter noted that “the regulated community and equipment manufacturers had reason to believe the compliance deadline would be extended and the scope of the rule possibly narrowed,” leading to “equipment manufacturers [delaying] production until there is more certainty on the rule.” ^[70] Similarly, one commenter noted that compliance with the reader rule would take significant preparation, including “restructuring access points, training security operators, [and] testing the security interplay between the TWIC readers and our existing access controls,” ^[71] which it had not begun to implement due to belief that the rule would be postponed.

Several commenters expressed concern about additional costs associated with partial implementation of the electronic TWIC inspection requirement. In addition to concerns regarding delayed production mentioned above,^[72] “manufacturers remain concerned that they lack the required lead time to sufficiently plan and install new equipment, infrastructure, software, and to train new employees,” ^[73] and asserted that partial delay of the final rule would create “logistical and financial challenges for facilities that are already in compliance with the TWIC visual inspection requirements.” ^[74] These sentiments are echoed in the TWIC HSOAC assessment, where some interviewees from Risk Group A facilities have experienced increased costs and have found the number of vendors shrinking.^[75]

One commenter suggested that an option set forth in the TWIC rulemaking to limit electronic TWIC inspection to discrete areas of a facility where it handles bulk CDC—originally intended to be an option designed to reduce costs—could end up creating problems if the delay is limited to CDC transfer facilities only. The commenter laid out two scenarios to show how this could happen, as described below.

In the first scenario, the facility expends resources to isolate the discrete bulk CDC area to the maritime transfer area. The commenter writes that “[i]f after the three-year delay period, the USCG determines the bulk CDC handled by non-maritime means in many locations throughout the facility does require electronic TWIC inspections, then the facility will have no choice but to expand electronic TWIC inspections to its perimeter fence-line (which also defines its secure area). In this [scenario], the time effort, resources, and money spent now isolating the discrete area(s) where bulk CDC is transferred to or from a vessel will have been wasted.” (emphasis in original) ^[76] This commenter is confusing the 2016 final rule, and the proposed changes in the TWIC Delay NPRM. The NPRM did not propose to limit electronic TWIC inspections to the areas of the facility where bulk CDC is transferred to or from a vessel. Instead, it proposed to limit the requirement to “[f]acilities that handle Certain Dangerous Cargoes (CDC) in bulk and transfer such cargoes from or to a vessel.” ^[77] Such facilities would still have been subject to the general requirement that they conduct electronic TWIC inspection pursuant to 33 CFR 101.535(b), which requires electronic TWIC inspection before being granted unescorted access to secure areas of the facility. The option to isolate electronic TWIC inspection to discrete areas of the facility where bulk CDC is handled still required electronic TWIC inspection at all locations within the applicable facilities where CDC is handled, regardless of whether that was the location it was being transferred to or from a vessel. There was never a proposal to limit the requirement to maritime transfer areas, and, thus, we would not expect this scenario to occur.

In the second scenario, the commenter imagines that “rather than isolating the discrete area(s) where bulk CDC is transferred to or from a vessel, a facility chooses to conduct electronic TWIC inspections of all personnel seeking unescorted access into its secure area (i.e., at the perimeter fence line. . . . If after the three-year delay period, the USCG determines the bulk CDC handled by non-maritime means at the facility does not require electronic TWIC inspections, then the facility will have wasted significant time, effort, resources, and money.” ^[78] While the Coast Guard has not ever proposed limiting electronic TWIC inspection criteria to the maritime area, we realize that if we were to change the regulation in that way after promulgating a wider regulation, it could result in significant unnecessary expenditures. While the commenter's analysis mischaracterizes the proposal in the TWIC Delay NPRM, we believe this demonstrates that there remains significant confusion regarding the scope of the rule. This is a valid point and one that we have considered in promulgating this delay.

D. Problems Estimating the Total Cost of Implementation of the Electronic TWIC Inspection Requirement

In the TWIC Reader rulemaking, the Coast Guard limited the electronic TWIC inspection to high-risk facilities for purposes of producing an efficient regulatory scheme. While we acknowledged that electronic TWIC inspection would improve security at all MTSA-regulated facilities, we concluded that, for many facilities, the cost of implementing such measures would be too high relative to the security benefits achieved. For that reason, we conducted extensive analysis as to which types of facilities posed the greatest threat to persons and key infrastructure targets, as well as which types of facilities would reap the greatest benefits from the proposed countermeasures. We determined that applying electronic TWIC inspection requirements only to Risk Group A facilities provided the most efficient security measures. The TWIC Reader rule final regulatory analysis (RA) estimated that the rule would require compliance actions by 525 facilities and 1 vessel, for a total cost of $153.8 million (discounted at 7-percent) over a 10-year period.^[79]

In response to the TWIC Delay NPRM, several commenters challenged the underlying assumptions that the Coast Guard used in developing this figure. Commenters first argued that the Coast Guard's analysis undercounted the number of facilities by including both transfer facilities and non-transfer facilities in its total estimate of 525 estimated facilities. Secondly, commenters argued that the inclusion of the phrase “and receive vessels carrying CDC” in the text of the final rule added additional regulated facilities, which were not included in the RA. We address each of these issues below. We note that specific comments relating to the Coast Guard's economic analysis are addressed below in Section IV. G., “Comments on the Regulatory Analysis.”

One major issue raised by commenters concerned the number of facilities subject to the electronic TWIC inspection requirements, specifically the idea that the Coast Guard had underestimated the number of facilities that would be characterized as Risk Group A under the new regulations. In the 2013 TWIC Reader NPRM, the Coast Guard estimated that 532 facilities would be classified as Risk Group A,^[80] a number that was modified in the 2016 final rule due to the exclusion of 7 barge fleeting facilities.^[81] In the TWIC Delay NPRM, we broke down the nature of these 525 facilities, indicating that they consisted of 122 “non-transfer” facilities, as well as 403 passenger and “transfer” facilities combined.^[82] One commenter stated “neither the [2013 TWIC Reader NPRM RA] nor the [2016 TWIC Reader final rule RA] ever discusses this class of facilities.” ^[83] This commenter is correct: both the TWIC Reader NPRM and final rule applied the requirement to “facilities that handle CDC in bulk,” and did not draw a distinction between those that transfer it to/from vessels and those that do not, and so never separated the types of facilities for the purposes of economic analysis. Because the TWIC Delay NPRM was the first instance in which the Coast Guard considered different requirements for transfer and non-transfer facilities, we included a separate count of the non-transfer facilities.

The commenter also suggested that the Coast Guard had dramatically underestimated the number of non-transfer facilities. The commenter states, “it is likely that approximately 525 (or more) facilities handle bulk CDC by non-maritime means.” It is unclear if the commenter is suggesting that there are a total of 525 facilities that handle bulk CDC by non-maritime means (in line with our estimates), or if there are 525 facilities that handle bulk CDC by non-maritime means exclusively, which would exceed the Coast Guard's estimates. The commenter also cited the 2017 Petition for Rulemaking,^[84] noting, “the Petition estimated that there are closer to 1,500 Non-Transfer Facilities nationwide, most of which handle bulk CDC by non-maritime means.” ^[85] (The use of the phrase “most of which” does appear to imply that the number of facilities is a total count, in line with Coast Guard estimates.) This figure is cited in the TWIC assessment report also, as mentioned above. Based on the information provided by both the commenter and HSOAC, we will attempt to get a much fuller estimate of the population in future studies, as described in the TWIC Delay NPRM.

Commenters expressed concern about the inclusion, in the TWIC Reader final rule, of regulatory text that the Coast Guard did not originally propose in the TWIC Reader NPRM. Specifically, while the proposed regulatory text in the TWIC Reader NPRM (and the associated text discussed in the TWIC Reader ANPRM) applied the Risk Group A requirements to “Facilities that handle Certain Dangerous Cargoes (CDC) in bulk,” ^[86] the TWIC Reader final rule added the phrase “or receive vessels carrying CDC in bulk” to that sentence.^[87] In the final rule, we explained the rationale for the additional language. In explaining our interpretation of the word “handle” in § 105.253(a), the TWIC Reader final rule stated that the purpose of the additional language at issue was to “clarify risk groups.” ^[88] The Coast Guard explained that a facility that receives vessels carrying CDC bulk, even if the CDC is not transferred to the facility, is functionally the same as a facility that creates, stores, processes, or transfers (i.e., “handles”) bulk CDC, insofar as there is bulk CDC present and it is the responsibility of the facility to restrict access to those CDCs to valid TWIC-holders. We reasoned that, “[w]hile moored at a facility, a vessel must rely on the facility's security program to adequately secure the interface between the facility and vessel and mitigate the threat of a TSI.” ^[89] Thus, the Coast Guard does not consider the phrase “or receives vessels carrying CDC in bulk” to be a new class of facilities subject to the electronic TWIC inspection requirements, but merely clarification of the original proposed text of § 105.253(a).

Because the Coast Guard did not consider the new language to add new requirements to the rule, we did not list “facilities that receive vessels carrying CDC in bulk” as a separate category of facilities in the regulatory text, nor did we consider that it would change the number of facilities affected by the electronic TWIC inspection rule in the delay NPRM. Furthermore, based on the information available at the time, the Coast Guard did not believe there were any facilities that received vessels carrying CDC, but did not in any other way store, use, process, or transfer bulk CDC on the facility (even if some vessels carrying bulk CDC did not unload their cargo at the facility), and so we did not add them to the affected population. However, after the publication of the final rule, various parties informed the Coast Guard, without presenting data, that they believed there was a population of facilities that received vessels carrying CDC bulk without otherwise handling bulk CDC on their facilities. The Coast Guard took such statements in good faith, and thus, in the TWIC Delay NPRM, we stated, “we cannot determine the number of [facilities that receive vessels carrying CDC in bulk] at this time.” ^[90]

One commenter argued that because the number of affected facilities remained consistent between the NPRM and final rule despite the addition of the new language to § 105.253(a), the Coast Guard's “accounting for Non-Transfer facilities are so suspect that they should be ignored.” ^[91] We disagree. As explained above, the affected population remained consistent between the TWIC reader NPRM and final rule because the policy in the documents was consistent. Furthermore, we note that despite its assertion that the lack of a separate accounting for this class of facility renders the Coast Guard's calculations moot, the commenter affirms the Coast Guard's original logic, noting in a parenthetical that “relatively few facilities that receive vessels carrying CDC without transferring them do not also handle bulk CDC by non-maritime means.” ^[92] Similarly, one commenter argues, “the methodology defining the risk categories does not include lay-berth ^[93] or other cargoes contained or not transferred.” ^[94] For the reasons described above, the Coast Guard disagrees, and notes the 2016 TWIC Reader rule methodology explicitly accounts for these situations.

E. Use of Electronic TWIC Inspection at Passenger Facilities and Vessels

Unlike facilities that handle CDC in bulk, the Coast Guard did not propose to delay the final rule for any passenger facilities, and based upon comments to this rulemaking, is not extending the delay to those facilities at this time. We believe that implementing the electronic TWIC inspection requirement at passenger facilities and vessels will provide improved security benefits for these facilities, which include large ferry and cruise terminals that handle 60 plus million passengers per year.

We received only one comment specific to the treatment of passenger vessels and facilities, which contained several major arguments. First, the commenter argued that passenger facilities that do not receive vessels subject to electronic TWIC inspection requirements should also be exempt from the requirements, regardless of how many passengers use the facility. More specifically, the commenter suggested that facilities receiving vessels with less than 20 crewmembers should be exempt from the electronic TWIC inspection requirement. Finally, the commenter suggested that electronic TWIC inspection does not substantially enhance security at passenger facilities.^[95] We address each of these arguments below.

The commenter raised an issue, also raised in the TWIC Reader rulemaking, that facilities that receive vessels be exempted from the electronic TWIC inspection requirement due to low numbers of crew. The comment noted that vessels with 20 or fewer TWIC-holding crewmembers are exempt from the electronic TWIC inspection requirement, but that this exemption does not apply to facilities. It stated that, if a Coast Guard-approved vessel security plan for a larger ferry designates certain portions of the vessel as off-limits to a passenger and requires a person to possess a valid TWIC to have unescorted access secure areas, the same standard should apply to a terminal that receives such a vessel. The commenter asserted that it was an “anomaly” that certain passenger vessels are not required to carry and deploy TWIC readers, but a facility that receives such a vessel is required to have and use TWIC readers.^[96] We do not believe this is an anomaly, and would refer the commenter back to the logic underpinning the requirement. In the TWIC final rule, in a section entitled, “The Crewmember Exemption Does Not Apply to Facilities,” ^[97] we explained that “the rationale that justifies an exemption for vessels with a low crew count does not transfer to facilities,” ^[98] noting that while at sea, few persons board or depart a vessel, while persons constantly do so at facilities. We continue to stand by the reasoning laid out in that section of the TWIC final rule. The Coast Guard also reiterated that the statutory provision in 46 U.S.C. 70105(m)(1) mandates an exemption from the electronic TWIC inspection requirement for vessels with a low crew count, and noted that there was no such provision for facilities.

The commenter also suggested that the value of electronic TWIC inspection at passenger facilities is minimal, and that the current level of security is adequate. The commenter stated that “One [Passenger Vessel Association] ferry operator subject to the current rule reports that its facility security plan designated only the office of the facility security officer (FSO) as a secure space and that only the FSO works in the office. Under the current rule, there will need to be a TWIC reader installed in this space so the FSO can validate his own TWIC each time he enters his office.” ^[99] While we cannot speak to individual circumstances, we note that the definition of a “secure area” is, in part, “the area . . . at a facility over which the owner/operator has implemented security measures for access control in accordance with a Coast Guard approved security plan. It does not include passenger access areas, employee access areas, or public access areas.” ^[100] While it is possible that a facility could have no access control measures outside of the FSO's office, we note that many passenger facilities do contain substantial secure areas.

We do agree with the commenter that there are differences in the layouts and security profiles of passenger facilities and other Risk Group A facilities (that handle CDC in bulk), and note that these differences are paramount in the Coast Guard's decision not to delay the electronic TWIC inspection for passenger facilities. We stated the differences explicitly in the final rule, highlighting the differences between chemical cargo facilities where the entire facility may be considered a “secure area” and facilities that have public access areas, like parking lots with TWIC inspection conducted at a secure access point would be outside of the public access area.^[101] For passenger facilities, the majority of the areas may be designated “public access areas,” “passenger access areas,” or “employee access areas” (such as break rooms). In such an instance, electronic TWIC inspection points may only be located at entrances to secure areas such as the pier or FSO's office.^[102]

While we agree with the commenter that the secure area footprint of a passenger facility may be small, we disagree that this constitutes a rationale for delaying or eliminating the electronic TWIC inspection requirements at passenger facilities. Unlike a facility that handles CDC in bulk, where the targets of a potential terrorist attack would be located exclusively inside the secure area, at passenger facilities the potential target—the passengers themselves—would be almost exclusively located outside the area secured by a TWIC, as passengers are not escorted, nor do they generally hold TWICs. However, vital parts of the facility, including waterside access to the vessel, baggage handling and security areas, storage areas for equipment such as vessel fuel or cleaning supplies, and administrative offices, are all secured by electronic TWIC inspection. These security measures help to ensure that access to those targeted areas is restricted to persons who have been granted unescorted access to these areas. By implementing TWIC inspection for waterside access to the vessel and baggage handling and storage area, and the like, the potential for a TSI is decreased. For these reasons, the Coast Guard believes it is imperative that we begin implementation of this part of the electronic TWIC inspection requirement as soon as possible.

F. Miscellaneous Comments

The Coast Guard received several comments that do not fit into any of the above categories. One commenter asked why some Captains of the Port (COTPs) are authorized to grant waivers to facilities and some are not, as well as under what conditions waivers are authorized.^[103] We note that all COTPs are authorized to permit facilities to continue to operate in the event of non-compliance pursuant to 33 CFR 105.125, which is different than authority to grant waivers. Waivers can be authorized under the provisions of 33 CFR 105.130. The regulatory text in 33 CFR part 105 contains explanations of noncompliance and waivers and when they will be granted. The commenter also asked whether the existence of waivers implied that the TWIC delay final rule should include all facilities subject to the electronic TWIC inspection. For the reasons discussed above, the answer is no.

One commenter stated that the proposed rule does not define “bulk storage.” ^[104] We note that the term “bulk” is defined in 33 CFR 101.105, and we apply the plain meaning to the term “storage.” The commenter also suggested that, to avoid confusion, the rule should list the CDC chemicals, and asked about the treatment of a mixture of chemicals listed as CDCs. We agree with the commenter that a list of CDCs would be helpful, and to that end, are publishing such a list concurrently with this rule, in accordance with 33 CFR 160.202. The list is published in the docket and will be maintained in Homeport. With regard to “mixtures,” we note it could depend on the particular chemistry at issue; therefore, we do not have enough information to provide an answer.

G. Comments on the Regulatory Analysis

The Coast Guard did not receive any comments on the costs and benefits associated with delaying the implementation of the TWIC Reader final rule. However, we received several comments regarding the costs and benefits associated with the requirement for electronic TWIC inspection, as published in the 2016 TWIC Reader final rule RA.^[105] As the 2016 TWIC Reader final rule RA is the main data source for the RA published in the TWIC Delay NPRM, we address these comments below.

1. Comments on the Total Cost of the TWIC Reader Rule

One commenter stated that the Coast Guard underestimated the total cost of the final TWIC Reader rule, citing the declaration of a Dow chemical employee.^[106] The employee estimated the TWIC Reader Rule would result in an annual productivity loss resulting from the delay time of using the TWIC readers of $3.65 million for one Dow facility, and a $10 million cost to all Dow facilities including productivity losses, and hardware, infrastructure, installation, and maintenance costs. The commenter states that Dow's costs alone are almost half of the $22.5 million in annualized costs as estimated by the final rule.

The cost estimates provided in the final TWIC Reader rule represent the average burden across all facilities subject to that rulemaking, and therefore the estimates may not reflect the individual circumstances of each facility or firm. In addition, the $10 million value provided by the commenter is an annual value and is not comparable to the $22.5 million annualized cost estimate provided in the final rule. An annualized value accounts for the fact that the costs of the rule will differ over time and provides an estimate that spreads these costs equally over the analysis period, taking a discount rate into account. This value accounts for years where a facility may have larger costs associated with implementing the rule due to one time or infrequent costs such as purchasing hardware, installation, and infrastructure costs, as well as years where the facility will have much smaller ongoing costs. During the first two years of the cost analysis, the Coast Guard accounted for these large onetime costs and estimated a much larger total annual cost of approximately $56 million per year. The $10 million value provided by the commenter includes onetime costs such as hardware and, therefore, is not directly comparable to the $22.5 million annualized cost estimate, which smooths these costs over time.

Furthermore, we note that the majority of the measured costs the commenter cites are operational losses due to “average daily loss in productivity of $10,000 per day.” The TWIC Reader rule provided facility operators flexibility with regard to the purchase, installation, and use of electronic readers, allowing facilities to adjust their operations to reduce large delay times. The RA for the TWIC Reader rule accounted for the fact that some facilities may have to make modifications to business operations to accommodate electronic TWIC inspection requirements, such as increasing the number of access points for vehicles. Thus, we believe most facilities would be able to adjust their operations to ensure the most efficient use of the readers rather than incurring large delay costs.

2. Comments on the Economic Impact of the Rules

We received one comment on the potential “significant economic impact” of the TWIC Reader rule.^[107] The commenter believes the TWIC Reader rule will disrupt the efficient transportation of goods, which, in turn, may result in “very high economic costs.” As evidence, the commenter provided information on the contribution of Louisiana's oil and gas and chemical sectors to the Gross Domestic Product (GDP), employment numbers, and household earnings, information on the amount of cargo shipped through ports located in Louisiana, as well as information on the tank truck industry. The commenter also asserts that the Coast Guard did not regulate container facilities not otherwise categorized in Risk Group A because of the “significant levels” of ”delay costs,” and states this is evidence of the high economic costs of transportation delays.

While the economic data presented by the commenter provides information on the oil and gas industry in Louisiana and on the tank truck industry, it does not provide any information on how the TWIC Reader rule may impact these industries, or the cost of the TWIC Reader rule to these industries. We do note the commenter provides context to the enormous importance of securing these facilities from terrorist attack, given their large role in the local, as well as national, economy.

Further, the Coast Guard disagrees that we did not regulate container facilities that would not otherwise be categorized in Risk Group A because of significant delay costs associated with the TWIC Reader rule, and this is evidence of the high economic costs of delays. Rather, the Coast Guard did not regulate these container facilities because, upon review, we found that many of the high-risk threat scenarios at container facilities would not be mitigated by electronic TWIC inspection. Therefore, the costs of electronic TWIC inspection for container facilities not in Risk Group A would not be justified by the amount of potential risk reduction at these facilities. This is keeping with the requirements of Executive Order 12866, which directs agencies to select approaches which maximize the net benefits to society.

3. Comments on the Use of the TWIC Pilot Program Data

The Coast Guard received two comments on the 2016 RA's use of cost information from the TWIC Reader pilot program.^[108] One commenter stated that the data from the TWIC Pilot Program is too out-of-date to be used, and that the pilot program failed to accurately evaluate delay times associated with the 2016 TWIC Reader rule. Both commenters cite the May 2013 GAO report “Transportation Worker Identification Credential: Card Reader Pilot Results Are Unreliable; Security Benefits Need to Be Reassessed,” (GAO-13-198) as evidence the pilot data is inaccurate, and believe the Coast Guard's reliance on this data contravenes the GAO's findings. Issues with the pilot data were also raised in the HSOAC assessment. The assessment stated that the use of the pilot study data in generating the 2015 regulatory analysis was flawed in that it made faulty assumptions of the number of readers required at facilities.^[109]

While the Coast Guard acknowledges there were many challenges in the implementation of the TWIC reader pilot program, we believe the considerable data obtained were of sufficient quantity and quality to support the general findings and conclusions of the TWIC reader Pilot Report. The pilot program obtained sufficient data to evaluate TWIC reader performance and assess the impact of using TWIC readers at maritime facilities. Furthermore, the Coast Guard supplemented the information from the TWIC Pilot Program with other sources of information. For example, in the 2016 RA, the Coast Guard estimated the number of access points per facility type through the use of an independent data source (Facility Security Plans), and estimated the costs of TWIC readers through published pricing information. The Coast Guard did not use this data from the pilot program for the exact reasons the commenters suggest.

4. Comments on Collecting New Cost Data

One commenter stated that the TWIC Delay NPRM gave no indication the Coast Guard would use the three-year delay period to gather new economic data, and thus any economic analysis supporting future rule makings would be based on the same “faulty” cost data as the previous rulemakings.^[110]

While the Coast Guard did not explicitly state it would gather new cost information to support future rulemaking efforts, that does not mean we would not gather additional cost information to support future rulemakings. If the Coast Guard chooses to implement a new rulemaking, the supporting RA would use the best reasonably available economic information, as required by OMB circular A-4. Depending on the information available, this cost data may or may not be new.

H. Conclusion

Based on the concerns of commenters regarding implementation problems, particularly involving confusion regarding the final rule and delay NPRM, delays in undertaking compliance action, and difficulty acquiring equipment, a delay for all facilities that handle CDC in bulk represents the best path forward. In doing so, we can give facilities that handle CDC in bulk additional time to acquire and install equipment, train personnel, make operational adjustments, and update FSPs to account for use of electronic TWIC inspection in areas that contain bulk CDC. We also note that, as described in this document and in the TWIC Delay NPRM, we are studying the distribution of bulk CDC at MTSA-regulated facilities, with the goals of determining the exact population of affected facilities and the properties of the particular chemicals stored at these facilities. We believe that delaying the implementation of the rule for facilities that handle CDC in bulk will allow those facilities to reduce costs by providing adequate time to implement the requirements under conditions of more regulatory certainty and equipment availability. We also believe that the implementation of electronic TWIC inspection requirements at passenger facilities, and for the one large passenger vessel, will provide immediate security benefits at those facilities and vessel in protecting vital parts of the facility from potential TSI. Overall, we estimate that this policy implements the electronic TWIC inspection requirement at 155 facilities, primarily cruise and large ferry terminals that handle 60 plus million passengers per year and 1 vessel, in furtherance of enhanced security measures to protect passengers and the public. In order to comply with this immediate security need, facilities and vessels will have 60 days to implement the TWIC reader requirement. It also provides the Coast Guard time to analyze the suggestions and comments relating to the TWIC program provided in the assessment, and determine what modifications should be made during the delay period.

V. Regulatory Analysis

This final rule will delay implementation of the TWIC Reader rule for 3 years for all facilities that handle CDC in bulk, which are comprised of three types of Risk Group A facilities: (1) Facilities that handle certain dangerous cargoes in bulk, but do not transfer these cargoes to or from a vessel; (2) facilities that handle certain dangerous cargoes in bulk, and do transfer these cargoes to or from a vessel; and (3) facilities that receive vessels carrying certain dangerous cargoes in bulk, but do not, during that vessel-to-facility interface, transfer these bulk cargoes to or from those vessels. This rule will delay the implementation of the TWIC Reader rule for 370 of the 525 affected Risk Group A facilities. The remaining 155 facilities (which are all facilities that receive large passenger vessels), and 1 vessel will have to implement the requirements of the TWIC reader rule by June 8, 2020.

Below, we provide an updated regulatory analysis of the TWIC Reader rule that presents the impacts of delaying the effective date of the TWIC Reader rule for the three types of Risk Group A facilities defined in the preceding paragraph. We developed this rule after considering numerous statutes and Executive orders related to rulemaking. Below we summarize our analyses based on these statutes or Executive orders.

For this updated analysis, we estimated the impact of delaying the TWIC Reader rule by calculating the 10-year cost of this final rule, where only certain facilities will incur costs starting in Years 1 and 2 and other facilities will incur no costs in the first 2 years, and compare it to the 10-year cost presented in the RA for the TWIC Reader rule.^[111] We then calculated the difference between the two costs to estimate the impact of this final rule. To properly compare the costs and benefits of this final rule and the TWIC reader rule, we first updated the costs of the TWIC Reader rule from 2012 dollars to 2016 dollars.

A. Regulatory Planning and Review

Executive Orders 12866 (Regulatory Planning and Review) and 13563 (Improving Regulation and Regulatory Review) direct agencies to assess the costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. Executive Order 13771 (Reducing Regulation and Controlling Regulatory Costs) directs agencies to reduce regulation and control regulatory costs and provides that “for every one new regulation issued, at least two prior regulations be identified for elimination, and that the cost of planned regulations be prudently managed and controlled through a budgeting process.”

This rule is a significant regulatory action under section 3(f) of Executive Order 12866. The Office of Management and Budget has reviewed it under that Order. It requires an assessment of potential costs and benefits under section 6(a)(3) of Executive Order 12866. DHS considers this rule to be an Executive Order 13771 deregulatory action. See the OMB Memorandum titled “Guidance Implementing Executive Order 13771, titled `Reducing Regulation and Controlling Regulatory Costs'” (April 5, 2017). Details on the estimated cost savings of this rule can be found in the rule's regulatory analysis (RA) that follows.

We have determined that this final rule does not have an annual effect on the economy of $100 million or more. This rule is an “other” significant regulatory action under Executive Order 12866, because of its impact on industry.^[112] Therefore, in accordance with OMB Circular A-4, we have prepared an accounting statement showing the classification of impacts associated with this final rule.^[113]

Because this final rule does not modify any of the regulatory requirements in the TWIC Reader rule but, rather, delays the implementation of that 2016 final rule for some facilities, we did not revise our fundamental methodologies or key assumptions from the 2016 TWIC Reader final rule RA.^[114]

Table 2 summarizes the changes to the RA between the TWIC Delay NPRM and this final rule. In this final rule, the Coast Guard modified the population of facilities that will delay the implementation of the TWIC reader rule, to include all facilities that handle CDC in bulk. In addition, we fixed mathematical errors from the 2016 TWIC Reader rule which impacted the estimated average number of readers per access point, and the average installation and infrastructure costs for facilities. Although we have updated our analysis from the NPRM to reflect these changes, this did not modify the methodology of our RA.

In the 2016 TWIC Reader final rule RA, we estimated that 525 facilities and 1 vessel out of the MTSA-regulated entities (13,825 vessels and more than 3,270 facilities) will have to comply with the final rule's electronic TWIC inspection requirements using MSRAM's risk-based tiered approach.^[115] This rule will delay the implementation of the TWIC reader rule for 370 of the 525 affected Risk Group A facilities by 3 years, while the remaining 155 facilities (which are all facilities that receive large passenger vessels), and 1 vessel will have to implement the requirements of the TWIC Reader rule by June 8, 2020. The results reflect that 370 facilities out of the 525 facilities either handle certain dangerous cargoes in bulk but do not transfer these cargoes to or from a vessel, or handle certain dangerous cargoes in bulk and do transfer these cargoes to or from a vessel. This final rule will also apply to facilities that receive vessels carrying bulk CDC but, during the vessel-to-facility interface, do not transfer the bulk CDC to or from the vessel. We did not include these facilities in our MSRAM risk analysis or RA for the TWIC Reader rule, or in this final rule's RA because we are unable to determine the number of these facilities at this time.

2016 TWIC Reader rule cost estimates from 2012 dollars to 2016 dollars based on Gross Domestic Product (GDP) Deflator data from the U.S. Bureau of Economic Analysis (BEA).^[116] The GDP deflator is a measure of the change in price of domestic goods and services purchased by consumers, businesses, and the government.

Table 3 summarizes the costs and benefits of the 2016 TWIC Reader final rule as well as this rule. We do not anticipate any new costs to industry as a result of implementing this final rule, because it will not change the applicability of the 2016 final rule or result in any other changes to the TWIC Reader rule. The impact to the one affected vessel, along with the qualitative costs and benefits, remain the same. Because this rule will delay the implementation of the TWIC Reader rule by 3 years for 370 facilities, it will result in cost savings to both industry and the government of $23.74 million (discounted at 7 percent) over a 10-year period of analysis ($191.81 million minus $168.07 million). As stated above, we used the same 10-year period of analysis in order to be able to properly compare the costs of this final rule and the TWIC Reader rule, which estimated the costs and benefits over a 10-year period. At a 7-percent discount rate, we estimate the total annualized cost savings to be $3.38 million ($27.29 million − $23.92 million), and $2.14 million ($25.18 million −$23.04 million). Using a perpetual period of analysis, and 2019 as the first year of analysis, we estimated the total annualized cost savings of this rule to be $1.53 million in 2016 dollars, discounting back to 2016 dollars.

Methodology

TWIC Reader Rule Costs Inflated to 2016 dollars

As shown in table 3, after adjusting the annualized cost from the 2016 TWIC Reader rule from 2012 dollars to 2016 dollars (over a 10-year period) and fixing the mathematical errors in 2016 TWIC Reader rule RA, the annualized cost of the 2016 TWIC Reader rule is approximately $27.29 million at a 7-percent discount rate.^[117] We performed this update to compare them to this final rule's total industry costs on the same basis. We also modified the 2016 final rule cost estimates to fix mathematical errors identified in the TWIC effectiveness assessment, which affected estimates of the average number of readers per access point, and the average installation and infrastructure cost per reader at facilities. These errors impact the capital and maintenance cost estimates for facilities, and we identified them after the publication of the NPRM, and after fixing the mathematical errors in the 2016 TWIC Reader rule RA, the annualized total cost increased by $4.12 million to $27.29 million (in 2016$ with a 7-percent discount rate). These errors, however, did not impact the estimated costs for vessels.^[118]

We used an inflation factor derived from the GDP deflator data. We calculated the inflation factor of 1.059 by dividing the annual 2016 index number (111.445) by the annual 2012 index number (105.214).

We then applied this inflation factor to the costs for vessels and additional costs, which include additional delay costs, travel costs, and the cost to replace TWIC readers that fail (table 4.38 of the TWIC Reader final rule RA).^[119] Table 4 presents these inflated costs.

For facilities, we applied this inflation factor to capital, maintenance, and operational costs because the final rule will apply only to these cost elements. Capital costs consist of the cost to purchase and install TWIC readers, as well as the cost to fully replace TWIC readers 5 years after the original installation. Maintenance costs account for the costs to maintain TWIC readers every year after the original installation. Operational costs include costs that occur only at the time of the TWIC reader installation and initial training. Operational costs also include ongoing costs, such as those for keeping and maintaining records, downloading the canceled card list, and ongoing annual training. We also modified the 2016 final rule cost estimates to correct errors in the calculations of the average number of readers per access point, the average installation cost per reader, and the average infrastructure cost per reader. We used these values to calculate capital and maintenance costs, and by correcting these errors the annualized total capital and maintenance costs increased by approximately $4.11 million and 0.01 million respectively (in 2016 $ with a 7-percent discount rate). Table 5 presents a comparison of these facility costs before and after our corrections, as well as a comparison of the costs in 2012 and 2016 dollars, and an estimate of the total number of facilities complying with the regulation each year.

Table 6 summarizes the total costs to industry of the 2016 TWIC Reader rule in 2016 dollars. We estimated the annualized cost to be $27.29 million at a 7-percent discount rate.

Final Rule Costs

This rule will delay the effective date of the TWIC Reader rule by 3 years for 370 facilities that handle bulk CDC and an unestimated number of facilities that receive vessels carrying bulk CDC, but do not transfer it to or from the vessel during that vessel-to-facility interface. For analytical purposes, we maintain the assumption from the 2016 TWIC Reader rule RA that 50 percent of facilities will comply each year of the implementation period. Therefore, for this rule we assume that 50 percent of facilities with a 3-year implementation delay will comply in year 3, and 50 percent of facilities with a 3-year implementation delay will comply in year 4. We maintain this assumption to provide a consistent comparison between the baseline cost estimates presented in the TWIC Reader rule, and the costs of this rule.

The costs are separated into three categories: Capital costs, maintenance costs, and operating costs. To estimate the capital costs in a given year, we multiplied the total baseline capital costs for all facilities by the percentage of facilities incurring costs in a given year. We calculated the total initial baseline capital costs for TWIC installation for all facilities by adding the baseline capital costs presented in table 5 for years 1 and 2 ($68.31 million + $68.31 million = $136.63 million). We calculated the total baseline capital costs for replacing TWIC readers 5 years after the original installation by adding the baseline capital costs presented in table 5 for years 6 and 7 ($10.53 million + $10.53 million = $21.06 million). We then multiplied these numbers by the percentage of facilities incurring the cost in a given year. For example, in year 1, a total of 78 facilities are expected to incur capital costs, for a total industry cost of $20.30 million ($136.63 million × (78 facilities ÷ 525 facilities)). Table 7 presents annual capital costs for all years.

Because maintenance costs are not incurred until the year after the TWIC readers are installed, we calculated the maintenance costs in a given year by multiplying the total baseline costs for all facilities by the percentage of facilities complying in the previous year. The total initial baseline maintenance costs for TWIC readers, $2.11 million, is found in year 3 of table 5 as this is the first year that all facilities will incur maintenance costs under the baseline. To estimate maintenance costs, we multiplied the percentage of facilities incurring the cost in a given year by the total costs. Because maintenance costs are not incurred until the year after the TWIC reader is installed, the total number of facilities incurring the cost is equal to the total number of complying facilities in the previous year. For example, we calculated Year 2 costs as follows: $2.11 million × (78 facilities ÷ 525 facilities) = $0.31 million. Table 8 presents annual maintenance costs for all years.

We estimated operational costs in a similar manner, multiplying total operational costs by the percentage of facilities complying in a given year. Table 7 presents the total cost to facilities under this final rule. We calculated total operational costs by adding the baseline operational costs in Years 1 and 2 as presented in table 5 ($2.10 million + $2.29 million = $4.39 million). However, this total includes a $0.187 million in costs for ongoing costs such as training, which do not occur the first year a facility installs a TWIC reader. Therefore, the total initial operational cost to industry is $4.206 million ($4.39 million − $0.187 million). We then multiplied the total cost by the percentage of new facilities complying in a given year. We also accounted for ongoing costs to industry, which we calculated by multiplying the total ongoing operational costs of $1.42 million per year (see year 3 of table 5) by the percentage of facilities incurring ongoing costs. For example, in year 2, we calculated the total initial costs to be $0.617 million ($4.206 million × (77 facilities ÷ 525 facilities)), and we calculated the total ongoing costs to be $0.210 million ($1.416 million × (78 facilities ÷ 525 facilities)), for a total cost of $0.827 million ($2.10 million + $0.21 million). The $1.416 million ongoing cost includes not only the $0.187 million in ongoing costs, but also the cost to update the canceled card list annually. Table 9 presents annual operational costs.

Table 10 presents the total undiscounted cost to facilities under this final rule, including all capital, maintenance, and operational costs.

Table 11 summarizes the total costs to industry of this rule. This rule will not impact the compliance schedule of vessels. Therefore, these costs remain unchanged from the baseline. We calculated the additional costs by multiplying the totals in Table 5 by the percentage of facilities complying within a given year and phasing them in 2 years. Over 10 years, we estimate the annualized cost to industry to be $23.92 million at a 7-percent discount rate.

Table 12 presents the estimated change in total costs to industry from delaying the implementation of the TWIC reader rule by 3 years for facilities that handle bulk CDC, but do not transfer it to or from a vessel, and facilities that receive vessels carrying bulk CDC, but do not transfer it to or from the vessel during that vessel-to-facility interface. We estimated an annualized cost savings to industry of $3.38 million at a 7-percent discount rate.

Qualitative Costs

Qualitative costs are as shown in table 3. This rule will delay the cost to retrieve or replace lost Personal Identification Numbers (PINs) for use with TWICs for the facilities with delayed implementation.

Government Costs

This final rule will also generate a cost savings to the government from delaying the review of the revised security plans for 370 Risk Group A facilities that handle bulk CDC and facilities that receive vessels carrying bulk CDC. There is no change in cost to the government resulting from TWIC inspections, because inspections are already required under MTSA, and the TWIC reader requirements do not modify these requirements. As such, there is no additional cost to the government.

To estimate the cost to the government, we followed the same approach as the industry cost analysis and adjusted the cost estimate presented in the TWIC Reader rule RA from 2012 dollars to 2016 dollars. For the government analysis, we used the fully loaded 2016 wage rate for an E-5 level staff member, $51 per hour, from Commandant 7310.1R: Reimbursable Standard Rates, in place of the 2012 wage of $49 per hour.^[122] We then estimate a government cost of $53,550 in the first 2 years ($51 × 4 hours per review × 262.5 plans).^[123] Table 13 presents the annualized baseline government costs of $13,785 at a 7-percent discount rate.

Table 14 presents the government cost under this final rule, from delaying the effective date of the 2016 TWIC Reader rule for facilities that handle CDC in bulk. We estimated the annualized government cost to be $12,556 at a 7-percent discount rate. To estimate government costs in year 1 and year 2, we used the same approach as the baseline cost estimates.^[124]

Table 15 presents the estimated change in government costs from delaying the implementation of the TWIC Reader rule by 3 years for facilities that handle bulk CDC and facilities that receive vessels carrying bulk CDC. We estimated an annualized cost savings to the government of $1,229 at a 7-percent discount rate.

Using a perpetual period of analysis, we estimated the total annualized cost savings of the rule to be $1.53 million in 2016 dollars, discounted back to 2016 dollars.

Change in Benefits

As noted, this rule will delay the effective date of the TWIC reader requirement for three categories of facilities: (1) Facilities that handle certain dangerous cargoes in bulk, but do not transfer these cargoes to or from a vessel; (2) facilities that handle certain dangerous cargoes in bulk, and do transfer these cargoes to or from a vessel; and (3) facilities that receive vessels carrying certain dangerous cargoes in bulk, but do not, during that vessel-to-facility interface, transfer these bulk cargoes to or from those vessels. The facilities for which the TWIC reader rule will be delayed will delay the enhanced benefits of electronic inspection, such as ensuring that only individuals who hold valid TWICs are granted unescorted access to secure areas, enhanced verification of personal identity, and a reduction in potential vulnerability by establishing earlier the intent of perpetrators who attempt to bypass or thwart the TWIC readers.

Summary of Cost Savings Under Executive Order 13771

This rule will generate a cost savings to both the industry and government, and therefore, this rule is an Executive Order 13771 deregulatory action. Table 16 summarizes the cost savings of this rule by comparing and subtracting the costs of this rule from the TWIC Reader rule costs. Because this rule will delay the implementation of the TWIC Reader rule by 3 years for 370 facilities, it will result in cost savings of $23.73 million for industry, $0.01 million for government, and $23.74 million total (all discounted at 7 percent) over a 10-year period of analysis. At a 7-percent discount rate, we estimate the annualized cost savings to be $3.38 million to the industry, $0.001 million to the government, and $3.38 million total. Using a 3-percent discount rate, we estimate the annualized cost savings to be $2.14 million to the industry, $0.0005 million to the government, and $2.14 million total. Using a perpetual period of analysis, we found total annualized cost savings of the rule to industry and the government to be $1.53 million in 2016 dollars, discounted back to 2016.

Alternatives

One regulatory alternative to this final rule is for the Coast Guard to take no action. Under this alternative, the TWIC Reader rule would become effective 60 days after Congress receives the HSOAC assessment, and all 370 facilities we identified in our 2016 TWIC Reader rule RA, in addition to the unknown number of facilities, would be expected to comply with the TWIC Reader rule. These entities would be required to implement the requirements for the electronic inspection of TWICs and would incur the costs we estimated in our 2016 TWIC Reader rule RA unless a waiver was granted by the Coast Guard.

Another alternative the Coast Guard considered was a waiver approach. However, because we currently lack a comprehensive risk analysis on the level of individualized facilities, we do not believe this approach maximizes benefits. In the absence of a new comprehensive risk analysis, the Coast Guard might issue blanket waivers that include facilities that may indeed warrant the additional security of electronic inspection. For example, consider two facilities with a 5,000 gallon tank of a CDC each. The tank in the first facility is placed near enough to the perimeter fence in a populated area that, if the tank explodes, would kill enough people to cause a TSI and, therefore, should require electronic TWIC inspection. That same tank on the other facility is located away from the water in an isolated area within the MTSA footprint (not near a population). If this tank explodes, it does not cause a TSI and therefore should not need to conduct electronic TWIC inspection. If the Coast Guard issued a blanket waiver for those facilities with a storage tank of CDC with 5,000 gallons or less, then we would not be properly implementing these requirements to mitigate the risks as intended.

We rejected both alternatives (`no action' and `waiver approach') because they do not address our need to conduct a comprehensive risk analysis at the individual facility level to determine whether or not those 370 facilities and an unknown number of facilities would be required to comply with the final rule 60 days after Congress receives the HSOAC assessment, and also develop a consistent methodology that would form the rationale for Coast Guard when issuing waivers.

B. Small Entities

Under the Regulatory Flexibility Act, 5 U.S.C. 601-612, we have considered whether this rule will have a significant economic impact on a substantial number of small entities. The term “small entities” comprises small businesses, not-for-profit organizations that are independently owned and operated and are not dominant in their fields, and governmental jurisdictions with populations of less than 50,000.

The Coast Guard will delay the effective date of the TWIC Reader rule until May 8, 2023 for facilities that handle CDC in bulk. We estimate these facilities will experience an annualized cost savings of approximately $9,000 (with a 7-percent discount rate), and that on average each entity owns two facilities and will save approximately $18,000. We calculate that approximately 2% of the small entities impacted by this delay rule will have a cost savings that is greater than 1% but less than 3% of their annual revenue. The other 98% will have a cost savings that is less than 1% of their annual revenue.

Given this information, the Coast Guard certifies under 5 U.S.C. 605(b) that this rule will not have a significant economic impact on a substantial number of small entities.

C. Assistance for Small Entities

Under section 213(a) of the Small Business Regulatory Enforcement Fairness Act of 1996, Public Law 104-121, we offer to assist small entities in understanding this rule so that they can better evaluate its effects on them and participate in the rulemaking. The Coast Guard will not retaliate against small entities that question or complain about this rule or any policy or action of the Coast Guard.

Small businesses may send comments on the actions of Federal employees who enforce, or otherwise determine compliance with, Federal regulations to the Small Business and Agriculture Regulatory Enforcement Ombudsman and the Regional Small Business Regulatory Fairness Boards. The Ombudsman evaluates these actions annually and rates each agency's responsiveness to small business. If you wish to comment on actions by employees of the Coast Guard, call 1-888-REG-FAIR (1-888-734-3247).

D. Collection of Information

This rule calls for no new collection of information under the Paperwork Reduction Act of 1995, 44 U.S.C. 3501-3520.

E. Federalism

A rule has implications for federalism under Executive Order 13132 (Federalism) if it has a substantial direct effect on States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. We have analyzed this rule under Executive Order 13132 and have determined that it is consistent with the fundamental federalism principles and preemption requirements described in Executive Order 13132. Our analysis follows.

This rule will delay the implementation of existing regulations on certain facilities after evaluation by a risk-based set of security measures of MTSA-regulated facilities. Based on this analysis, each facility is classified according to its risk level, which then determines whether the facility will be required to conduct electronic TWIC inspection. As this rule does not impose any new requirements, but simply delays the implementation of existing requirements, it does not have preemptive impact.

Additionally, Executive Order 13132 require that for any rules with preemptive effect, the Coast Guard provide elected officials of affected State and local governments and their representative national organizations the notice and opportunity for appropriate participation in any rulemaking proceedings, and consultation with such officials early in the rulemaking process. Please refer to the TWIC Reader final rule for additional information regarding the federalism analysis of the substantive requirements (81 FR 57652, 57706).

While it is well settled that States may not regulate in categories in which Congress intended the Coast Guard to be the sole source of a vessel's obligations, the Coast Guard recognizes the key role that State and local governments may have in making regulatory determinations. Additionally, for rules with federalism implications and preemptive effect, Executive Order 13132 specifically directs agencies to consult with State and local governments during the rulemaking process. If you believe this rule has implications for federalism under Executive Order 13132, please call or email the person listed in the FOR FURTHER INFORMATION CONTACT section of this preamble.

F. Unfunded Mandates

The Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1531-1538, requires Federal agencies to assess the effects of their discretionary regulatory actions. In particular, the Act addresses actions that may result in the expenditure by a State, local, or tribal government, in the aggregate, or by the private sector of $100,000,000 (adjusted for inflation) or more in any one year. Although this rule will not result in such expenditure, we do discuss the effects of this rule elsewhere in this preamble.

G. Taking of Private Property

This rule will not cause a taking of private property or otherwise have taking implications under Executive Order 12630 (Governmental Actions and Interference with Constitutionally Protected Property Rights).

H. Civil Justice Reform

This rule meets applicable standards in sections 3(a) and 3(b)(2) of Executive Order 12988 (Civil Justice Reform) to minimize litigation, eliminate ambiguity, and reduce burden.

I. Protection of Children

We have analyzed this rule under Executive Order 13045 (Protection of Children from Environmental Health Risks and Safety Risks). This rule is not an economically significant rule and will not create an environmental risk to health or risk to safety that might disproportionately affect children.

J. Indian Tribal Governments

This rule does not have tribal implications under Executive Order 13175 (Consultation and Coordination with Indian Tribal Governments), because it will not have a substantial direct effect on one or more Indian tribes, on the relationship between the Federal Government and Indian tribes, or on the distribution of power and responsibilities between the Federal Government and Indian tribes.

K. Energy Effects

We have analyzed this rule under Executive Order 13211 (Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use). We have determined that it is not a “significant energy action” under Executive Order 13211, because although it is a “significant regulatory action” under Executive Order 12866, it is not likely to have a significant adverse effect on the supply, distribution, or use of energy, and the Administrator of OMB's Office of Information and Regulatory Affairs has not designated it as a significant energy action.

L. Technical Standards

The National Technology Transfer and Advancement Act, codified as a note to 15 U.S.C. 272, directs agencies to use voluntary consensus standards in their regulatory activities unless the agency provides Congress, through OMB, with an explanation of why using these standards would be inconsistent with applicable law or otherwise impractical. Voluntary consensus standards are technical standards (e.g., specifications of materials, performance, design, or operation; test methods; sampling procedures; and related management systems practices) that are developed or adopted by voluntary consensus standards bodies.

This rule does not use technical standards. Therefore, we did not consider the use of voluntary consensus standards.

M. Environment

We have analyzed this rule under Department of Homeland Security Management Directive 023-01 and Environmental Planning Commandant Instruction (COMDTINST) 5090.1 (series), which guide the Coast Guard in complying with the National Environmental Policy Act of 1969 (42 U.S.C. 4321-4370f), and determined that this action is one of a category of actions that do not individually or cumulatively have a significant effect on the human environment. A Record of Environmental Consideration (REC) supporting this determination is available in the docket where indicated under the ADDRESSES portion of the preamble. This rule is categorically excluded under paragraph L54 in Table 3-1 of U.S. Coast Guard Environmental Planning Implementing Procedures. Paragraph L54 pertains to regulations that are editorial or procedural. This rule establishes a 3 year postponement of the effective date for deploying electronic transportation security card readers and requiring electronic TWIC inspection at certain facilities affected by the final rule entitled “Transportation Worker Identification Credential (TWIC)—Reader Requirements,” published in the Federal Register on August 23, 2016. This rule supports the Coast Guard's statutory mission to ensure port, waterway, and coastal security.

List of Subjects in 33 CFR Part 105

• Maritime security
• Navigation (water)
• Reporting and recordkeeping requirements
• Security measures
• Waterways

For the reasons discussed in the preamble, the Coast Guard amends 33 CFR part 105 as follows:

PART 105—MARITIME SECURITY: FACILITIES

1. The authority citation for part 105 continues to read as follows:

Authority: 33 U.S.C. 1226, 1231; 46 U.S.C. 70103; 50 U.S.C. 191; Sec. 811, Pub. L. 111-281, 124 Stat. 2905; 33 CFR 1.05-16.04-11, 6.14, 6.16, and 6.19; Department of Homeland Security Delegation No. 0170.1.

2. In § 105.253, revise paragraphs (a)(1) and (2) and add paragaphs (a)(3) and (4) to read as follows:

Editorial note:

The U.S. Coast Guard requested that the Office of the Federal Register hold this document from publication until delivery to Congress of the assessment required by the Transportation Worker Identification Credential Security Card Program Act (Pub. L. 114-278).

Footnotes