2018-13345. TWIC-Reader Requirements; Delay of Effective Date

AGENCY:

Coast Guard, DHS.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The Coast Guard proposes delaying the effective date for certain facilities affected by the final rule entitled “Transportation Worker Identification Credential (TWIC)—Reader Requirements,” published in the Federal Register on August 23, 2016. The current effective date for the final rule is August 23, 2018. The Coast Guard proposes delaying the effective date for two categories of facilities: Facilities that handle certain dangerous cargoes in bulk, but do not transfer these cargoes to or from a vessel, and facilities that receive vessels carrying certain dangerous cargoes in bulk, but do not, during that vessel-to-facility interface, transfer these bulk cargoes to or from those vessels. The Coast Guard proposes delaying the effective date for these two categories of facilities by 3 years, until August 23, 2021. Other vessels and facilities, including facilities that receive large passenger vessels and facilities regulated under 33 CFR 105.295 that handle certain dangerous cargoes in bulk and transfer it to or from a vessel, would be required to comply with the final rule by August 23, 2018.

DATES:

Comments and related material must be received by the Coast Guard on or before July 23, 2018.

ADDRESSES:

You may submit comments identified by docket number USCG-2017-0711 using the Federal eRulemaking Portal at http://www.regulations.gov. See the “Public Participation and Request for Comments” portion of the SUPPLEMENTARY INFORMATION section of this notice of proposed rulemaking for further instructions on submitting comments.

FOR FURTHER INFORMATION CONTACT:

For information about this document, call or email LCDR Yamaris Barril, Coast Guard CG-FAC-2; telephone [phone], email [e-mail].

SUPPLEMENTARY INFORMATION:

Table of Contents for Preamble

I. Public Participation and Request for Comments

II. Abbreviations

III. Regulatory History

IV. Background

A. Electronic TWIC Inspection

B. Coast Guard Analysis and the Homeland Security Institute (HSI) Report

C. Summary of Methodology Used in the TWIC Rulemaking

D. Petition for Rulemaking and Identified Weaknesses

V. Discussion of the Proposed Rule to Delay the Effective Date

VI. Regulatory Analysis

A. Regulatory Planning and Review

B. Small Entities

C. Assistance for Small Entities

D. Collection of Information

E. Federalism

F. Unfunded Mandates Reform Act

G. Taking of Private Property

H. Civil Justice Reform

I. Protection of Children

J. Indian Tribal Governments

K. Energy Effects

L. Technical Standards

M. Environment

I. Public Participation and Request for Comments

The Coast Guard views public participation as essential to effective rulemaking and will consider all comments and material received during the comment period. Your comment can help shape the outcome of this rulemaking. If you submit a comment, please include the docket number for this rulemaking, indicate the specific section of this document to which each comment applies, and provide a reason for each suggestion or recommendation.

We encourage you to submit comments through the Federal eRulemaking Portal at http://www.regulations.gov. If your material cannot be submitted using http://www.regulations.gov,, contact the person in the FOR FURTHER INFORMATION CONTACT section of this notice of proposed rulemaking for alternate instructions. Documents mentioned in this notice of proposed rulemaking, and all public comments, will be available in our online docket at http://www.regulations.gov,, and can be viewed by following that website's instructions. Additionally, if you go to the online docket and sign up for email alerts, you will be notified when comments are posted or a final rule is published.

We accept anonymous comments. All comments received will be posted without change to http://www.regulations.gov and will include any personal information you have provided. For more information about privacy and the docket, visit http://www.regulations.gov/​privacyNotice.

II. Abbreviations

AHP Analytic Hierarchy Process

ANPRM Advanced notice of proposed rulemaking

BLS U.S. Bureau of Labor Statistics

CDC Certain Dangerous Cargoes

DHS Department of Homeland Security

ECI Employment Cost Index

FR Federal Register

HSI Homeland Security Institute

MSRAM Maritime Security Risk Analysis Model

MTSA Maritime Transportation Security Act of 2002

NPRM Notice of proposed rulemaking

OMB Office of Management and Budget

SAFE Port Act Security and Accountability for Every Port Act of 2006

SME Subject matter expert

§ Section symbol

TSA Transportation Security Administration

TSI Transportation Security Incident

TWIC Transportation Worker Identification Credential

U.S.C. United States Code

III. Regulatory History

Pursuant to the Maritime Transportation Security Act of 2002 (MTSA),^[1] and in accordance with section 104 of the Security and Accountability for Every Port Act of 2006 (SAFE Port Act),^[2] Congress requires the electronic inspection of Transportation Worker Identification Credentials (TWIC®) inside secure areas on vessels and in facilities in the United States. Specifically, the SAFE Port Act required that the Secretary promulgate final regulations that require the deployment of electronic transportation security card readers.^[3] To implement this requirement in an effective manner, the Coast Guard undertook a series of regulatory actions culminating in a requirement to implement electronic TWIC inspection at certain high-risk vessels and facilities regulated under MTSA.

On May 22, 2006, the Coast Guard and the Transportation Security Administration (TSA) jointly published a notice of proposed rulemaking (NPRM) entitled “Transportation

Worker Identification Credential (TWIC) Implementation in the Maritime Sector; Hazardous Materials Endorsement for a Commercial Driver's License.” ^[4] On January 25, 2007, the Coast Guard and TSA published a final rule with the same title.^[5] The 2007 final rule established the requirement, among others, that all persons allowed unescorted access to secure areas in MTSA-regulated vessels and facilities must possess a valid TWIC. The 2007 final rule did not, however, mandate that the TWIC be read with an electronic reader and, as such, allowed for visual inspection. Visual inspection does not make use of the electronic security measures built into the TWIC, such as the challenge/response to the TWIC's unique electronic identifier, comparison of the credential to the TWIC Cancelled Card List, and verification of the biometric template stored on the TWIC to the individual's biometrics.

Although the May 22, 2006, NPRM proposed certain TWIC reader requirements, after reviewing the public comments, the Coast Guard decided not to include the proposed TWIC reader requirements in the 2007 final rule. Instead, the Coast Guard addressed TWIC reader requirements in a separate rulemaking after conducting a pilot program to address the feasibility of reader requirements.^[6] For a detailed discussion of the public comments and our responses to them, refer to section III.B.7 of the 2007 final rule.

On March 27, 2009, the Coast Guard published an advanced notice of proposed rulemaking (ANPRM) on the topic of TWIC reader requirements.^[7] The ANPRM discussed dividing vessels and facilities into three “risk groups”—Risk Group A for the high-risk vessels and facilities, Risk Group B for medium-risk vessels and facilities, and Risk Group C for low-risk vessels and facilities. The ANPRM also considered different electronic inspection requirements for Risk Groups A and B, with no electronic inspection requirements for Risk Group C. On March 22, 2013, we published an NPRM ^[8] that proposed the three risk groups (A, B, and C), but limited the proposed electronic TWIC inspection requirements to Risk Group A vessels and facilities only.

On August 23, 2016, we published a final rule entitled “Transportation Worker Identification Credential (TWIC)—Reader Requirements” ^[9] (“TWIC Reader final rule”) that eliminated the three risk group structure and required that the high-risk vessels and facilities (still referred to as Risk Group A) conduct electronic TWIC inspection for all personnel seeking unescorted access to secure areas of the vessel or facility. The TWIC Reader final rule becomes effective on August 23, 2018. On May 15, 2017, we received a petition for rulemaking from the International Liquid Terminals Association and other industry groups.^[10] The rulemaking petition requested that we revise the scope of the TWIC Reader final rule to impose electronic TWIC inspection requirements on only those vessels and facilities that engage in the maritime transfer of certain dangerous cargoes (CDCs), and extend the compliance date of the TWIC Reader final rule so that vessels and facilities do not incur costs while the Coast Guard reviews the scope of the TWIC Reader final rule. On May 18, 2017, the Coast Guard opened a public docket on www.regulations.gov,, and acknowledged receipt of the rulemaking petition by letter dated May 25, 2017. The industry's rulemaking petition is discussed in greater detail below in section IV.D.

IV. Background

In this NPRM, we propose to delay the effective date of the TWIC Reader final rule, until August 23, 2021, for two categories of facilities. The rationale for the proposed delay is to consider industry input asking us to reconsider the scope of the TWIC Reader final rule and to re-evaluate the underlying methodology used to determine the facilities subject to the electronic TWIC inspection requirements. For these reasons, and to provide appropriate context necessary to understand the purpose of this NPRM, we have included background information in this NPRM that details: (1) Why the electronic TWIC inspection requirements were originally proposed for certain categories of facilities; (2) the Coast Guard's methodology used to analyze risk, including the need to re-evaluate that methodology; and (3) the related petition for rulemaking we received after publication of the TWIC Reader final rule. Specifically, we examine the two technical reports issued in 2008 that explained how we would categorize facilities to analyze risk, which formed the basis for the regulatory framework laid out in the 2009 ANPRM. Overall, these reports provide the foundation for the regulatory framework set forth in the TWIC reader rulemaking documents. In this framework, we first grouped individual facilities by “asset categories”.^[11] Then, we used certain analytical techniques, described below, to rank those categories by relative risk, creating a linear list of 68 different asset categories. Finally, we grouped similarly-risked facilities together into “Risk Groups,” to which different regulatory requirements would apply. This analysis, with its strengths and weaknesses, is discussed below.

A. Electronic TWIC Inspection

The TWIC Reader final rule was promulgated to fulfill the Congressional mandate found in section 104 of the SAFE Port Act.^[12] The SAFE Port Act, which required the Coast Guard to conduct a pilot program to evaluate the effectiveness of TWIC readers and promulgate regulations in accordance with the findings of that program, led to the development of the TWIC reader rulemaking. The TWIC Reader final rule, the culmination of that rulemaking process, required that high-risk facilities conduct “electronic TWIC inspection,” and mandated security improvements above and beyond the existing requirements set forth in the 2007 final rule that all persons with unescorted access to secure areas possess a TWIC. Specifically, for high-risk facilities called “Risk Group A facilities,” the TWIC Reader final rule required that, upon each entry into a secure area,^[13] the person requesting entry must present a TWIC for electronic inspection before that person would be permitted unescorted access to the area.^[14] Other MTSA-regulated facilities (i.e., those facilities not in Risk Group A) may continue to use visual inspection of the TWIC and are not subject to the requirement for electronic inspection.^[15] Because the TWIC Reader final rule did not change the existing definition of a secure area in 33 CFR 101.105, and imposed no requirements in other areas,^[16] the primary effect of the rule should be to require facilities that are already using visual inspection of the TWIC as part of their access control procedures to use electronic TWIC inspection instead, strengthening existing access control procedures.

Inspection of the TWIC, whether electronic or visual, provides a baseline of information to determine who may be provided unescorted access to secure areas of MTSA-regulated vessels and facilities. While not every person who possesses a TWIC is authorized for unescorted access, the TWIC inspection process ensures that facility security personnel do not grant unescorted access to individuals who have not been vetted or who have been adjudicated unfit for unescorted access to secure areas.

Electronic TWIC inspection is the process by which the TWIC is authenticated and validated, and by which the individual presenting the TWIC is matched to the stored biometric template. This process consists of three discrete parts: (1) Authentication, in which the TWIC presented is identified as an authentic credential issued by TSA; (2) validity check, in which the TWIC presented is compared to the TSA-supplied list of cancelled TWICs to ensure that it has not been revoked and is not expired; and (3) identity verification, in which biometric data stored on the TWIC presented is matched to the person presenting it using a fingerprint scan. Electronic TWIC inspection strengthens the inspection of TWIC, as compared to visual TWIC inspection, resulting in increased security at high-risk facilities. While visual TWIC inspection can accomplish the same three goals as electronic inspection (authentication, validation, and identify verification), visual inspection is not as thorough or reliable.

Electronic TWIC inspection improves on visual inspection by adding additional benefits. With electronic inspection, the authenticity of the TWIC is verified by issuing a challenge/response to the unique electronic identifier of the TWIC, called a Card Holder Unique Identifier. The validity of the TWIC is determined by electronically checking the TWIC against a database with the most recently updated list of cancelled TWICs. Finally, the identity of the person presenting the TWIC is verified by matching the biometric template stored on the TWIC with the presenter's biometrics though use of a fingerprint scan. These three aspects of electronic inspection represent improvements over visual inspection because they are not easily counterfeited or altered within the TWIC.^[17] Additionally, electronic inspection ensures that the TWIC presented has not been invalidated because it was reported lost or stolen (or for other reasons), or revoked because of a criminal conviction.

B. Coast Guard Analysis and the Homeland Security Institute (HSI) Report

The Coast Guard based its decision about which vessels and facilities to include in Risk Group A on a study entitled “Analysis of Transportation Worker Identification Credential (TWIC) Electronic Reader Requirements in the Maritime Sector,” ^[18] (March 6, 2008) (the “Coast Guard TWIC Report”). The Coast Guard TWIC Report documented the risk-based analytic approach used to develop the TWIC reader requirements in the maritime sector, and supported the drafting of the proposed regulatory requirements for the use of TWIC readers as an access control measure. This study was independently verified in a report titled “Independent Verification and Validation of Development of Transportation Worker Identification Credential (TWIC) Reader Requirements,” developed by the Homeland Security Institute (HSI) (October 21, 2008) (the “HSI Report”).^[19]

To develop the Coast Guard TWIC Report, the Coast Guard assembled a panel of maritime security subject matter experts (SMEs) from the Coast Guard and TSA to conduct a risk-based analysis of MTSA-regulated vessels and facilities. The panel determined that the Analytical Hierarchy Process (AHP) would provide an effective basis for applying the panel's judgment to weigh and apply several key factors to the assessment of types of vessels and facilities.^[20] The AHP provides a comprehensive and rational framework for structuring a problem, representing and quantifying its elements, and relating those elements to overall goals, and for evaluating a set of alternative solutions. The AHP has been used by government and industry to assess alternatives and arrive at solutions when faced with problems that present disparate criteria and factors for consideration.

The Coast Guard's panel of SMEs identified 68 distinct types of vessels and facilities (referred to as “asset categories”) based on their purpose or operational description. The panel then assessed each of the 68 asset categories using three factors: (1) Maximum consequences to the vessel or facility resulting from a terrorist attack; (2) criticality to the health and economy of the Nation, and to national security; and (3) utility of the TWIC in reducing risk. The panel used this methodology to develop the framework discussed in the 2009 ANPRM and proposed in the 2013 TWIC Reader NPRM, in which the Coast Guard required vessels and facilities that had the highest vulnerabilities, and that could derive benefits from TWIC readers, to use electronic inspection procedures. The Coast Guard TWIC Report recognized that, while “security measures are not implemented in a `one size fits all' fashion . . . Coast Guard regulations also need to be prescriptive to ensure appropriate implementation in a uniform manner nationally.” ^[21] For that reason, the Coast Guard TWIC Report recommended the Coast Guard determine “. . . the risk level of facilities and vessels . . . as it relates to access control and assign TWIC reader requirements accordingly.” ^[22] Additionally, the Coast Guard TWIC Report noted that “in general, [asset categories] are ranked by the hazards of the cargo (or passenger quantities) carried by the vessel or handled by the facility” ^[23] and thus suggested that the high-risk vessels and facilities were those containing bulk CDCs and those carrying more than 1,000 passengers.^[24]

The HSI Report was designed to determine the validity of the Coast Guard methodology for analyzing the underlying risk to vessels and facilities outlined in the Coast Guard TWIC Report and the effectiveness of the overall TWIC program in mitigating that risk. As stated in the HSI Report, its purpose was to “strengthen the USCG's TWIC reader requirements development efforts by evaluating (1) the validity of the risk assessment methodology, (2) the extent to which the conclusions follow from the analysis, and (3) the overall strengths and limitations of the risk analysis.” ^[25]

The HSI Report validated the Coast Guard's risk assessment methodology. Specifically, the report's foremost conclusion was that HSI “verified the [risk-based] process because we were able to independently reproduce the results based on the information provided in the TWIC report . . . we have also validated the process and found it generally defensible and based on a rigorous risk framework [emphasis in original].” ^[26] The HSI Report also affirmed the three criteria that the Coast Guard panel used to determine the risk ranking for the 68 asset categories (Maritime Security Risk Analysis Model (MSRAM) maximum consequence data, criticality of infrastructure, and TWIC utility), and noted that the MSRAM maximum consequence data were “the most rigorous among the three due to the well-established and ongoing work of the MSRAM.” ^[27] On the other hand, the HSI Report noted that the TWIC utility criterion was “perhaps the most uncertain among the three evaluation criteria.” ^[28]

While the Coast Guard TWIC Report and the HSI Report ranked the relative risk of facilities based on asset category, the HSI Report did not unequivocally state that asset categorization was the best methodology to use. Indeed, in the executive summary, the report noted that “[t]he 68 asset categories considered in the well-established MSRAM were ranked based on their risk scores. The list is considered comprehensive based upon its widespread use. Nevertheless, we also point out that there might still be variations among assets in the same category [emphasis added].” ^[29] Despite this uncertainty, in the 2013 TWIC Reader NPRM, the Coast Guard proposed to use the asset category methodology to determine which types of facilities would be required to use electronic TWIC inspection in their security protocols.

Furthermore, the HSI Report identified several recommendations that could have been used to improve the methodology to develop the Coast Guard's risk analysis. Most fundamentally, the HSI Report suggested that further analysis on risk grouping of asset categories—that is, which categories should be included in Risk Group A—could help to ensure that the results were more defensible. The HSI Report also suggested that the Coast Guard better define TWIC utility and add mechanisms that allow more flexibility in applying TWIC reader requirements. Finally, noting that the electronic TWIC inspection requirements discussed in the Coast Guard TWIC Report (and, in part, ultimately promulgated in the TWIC Reader final rule) were developed based on the 2006 MSRAM data, the HSI Report stated that “there is probably a need to reassess reader requirements using recently updated MSRAM data. At a minimum [emphasis added], a preliminary assessment should be conducted to determine the potential impacts of the use of the new data.” ^[30]

After reviewing the methodology used in the TWIC Reader final rule, we believe that the information the methodology contained was generally accurate. Specifically, we believe that the general conclusions of the MSRAM analysis documented in the Coast Guard TWIC Report and validated in the HSI Report were correct and that the facilities that handle bulk CDC or receive large passenger vessels constitute the most severe vulnerabilities. What the recommendations of the HSI Report indicate, however, is that there is room for improvement within certain aspects of that general methodology, which we discuss in more detail in Section V of this NPRM.

C. Summary of Methodology Used in the TWIC Rulemaking

To ensure that the TWIC reader requirement was applied only to those facilities where the readers could enhance security the most, the Coast Guard designated certain facilities as high risk, putting them into Risk Group A. The TWIC Reader final rule requires that facilities in Risk Group A conduct electronic TWIC inspection to identify that a person seeking unescorted access to a secure area has undergone a biometric identification check, a card authentication check, and a card validation check to ensure that the person is authorized to have access. To determine which vessels and facilities should be included in Risk Group A, we relied on MSRAM. MSRAM is a risk-analysis tool used to analyze vulnerabilities and risk-mitigation measures in a wide variety of scenarios.

MSRAM identified three hypothetical scenarios in which a TWIC reader could be useful in preventing or mitigating terrorist attacks: (1) A truck bomb; (2) a terrorist assault team; and (3) an explosive attack carried out by a passenger or passerby (with the specific stipulation that the terrorist is not an “insider”).^[31] MSRAM also identified risk factors that made a facility or vessel particularly susceptible to these types of attacks and thus warranted the inclusion of that facility or vessel in Risk Group A. As we stated in the NPRM, “in determining the cutoff points between risk groups, risk rankings were graphed to identify natural breaks that occurred in the data . . . for facilities, these breaks generally occurred where there was a change in the hazardous nature of the materials stored or handled at a facility, or where the number of passengers accessing a facilities increased.” ^[32]

Using the asset categories identified in the HSI Report and the risk analysis conducted under MSRAM, the Coast Guard found that three discrete classes of facilities could experience security benefits that are significant enough to warrant the requirement for electronic TWIC inspection. These included: (1) Facilities that handle CDC in bulk; ^[33] (2) facilities that receive vessels carrying CDC in bulk; and 3) facilities that receive vessels certificated to carry more than 1,000 passengers.^[34] Each of these types of facilities contain targets—either bulk CDC or groups of more than 1,000 passengers—that could be attacked using a method identified above, with a result potentially catastrophic enough to be classified as a TSI.

In the TWIC Reader final rule, our goal was to apply the requirements for electronic TWIC inspection only to those high-risk facilities that could most benefit from its use. Because the asset categories identified in this NPRM contained a vulnerable target, and the threat to that vulnerability could be mitigated by electronic TWIC inspection, we believe that the security benefits justify the cost of the upgraded security. As reported in the Regulatory Analysis section of the TWIC Reader final rule, we estimated that the electronic TWIC inspection provision would extend to 290 bulk liquid facilities, 16 break bulk and solid facilities, 3 container facilities, 61 “mixed use” facilities, and 165 passenger facilities, for a total of 525 facilities.^[35]

D. Petition for Rulemaking and Identified Weaknesses

After publication of the TWIC Reader final rule in August 2016, we received several questions from the public about our risk analysis, as well as a rulemaking petition to reconsider the scope of the TWIC Reader final rule.^[36] A primary issue that arose was whether the Coast Guard's risk analysis properly analyzed the location of bulk CDC in a facility. For example, the rulemaking petitioner raised the issue that, because many Risk Group A facilities store or handle bulk CDC in areas unconnected to their maritime nexus, such facilities may not pose as large a risk to transportation infrastructure as those Risk Group A facilities that handle bulk CDC in the marine transfer area and actively transfer it to or from vessels. In addition, we received several inquiries regarding how the Coast Guard would categorize small quantities of bulk ^[37] CDC used for the direct operations of the facility. Examples of this issue include operational use of CDCs, such as relatively small tanks of propane used internally at a facility to generate electricity or to power port equipment, that would still fall into the broad category of “CDC in bulk,” ^[38] and yet would also seem to pose few of the security concerns described in the Coast Guard's risk analysis.

Furthermore, even though bulk CDC could be attacked by the identified attack methods from the Coast Guard's risk analysis no matter where it is located in the facility,^[39] the petitioner suggested that the consequence of such an attack may not be as severe if the bulk CDC is kept far from the marine transfer area. For example, many gasoline refineries may be considered Risk Group A under the TWIC Reader final rule, as they receive shipments of bulk oil, which are not a CDC, from tankships and combine it with chemicals that are CDCs, which may be stored and processed in an inland part of the facility. The petitioner requested, among other things, that the Coast Guard revise the requirements for electronic TWIC inspection so that only facilities that transfer bulk CDC to or from a vessel would be subject to the TWIC Reader final rule requirements. This would exclude from the regulation those facilities where bulk CDC exists but is not transferred to or from a vessel, including facilities where the CDC is stored on land or stored on the water and not transferred to land (i.e., facilities that receive vessels carrying CDC in bulk but do not transfer bulk CDC to or from these vessels).

At this time, we are not issuing a grant or denial for the petition for rulemaking, but we do wish to acknowledge that the issue of bulk CDC located in non-maritime areas, which were raised by the petitioner, factored into the Coast Guard's rationale to re-examine the asset categorization that underpins the risk analysis methodology in the TWIC rulemaking.^[40] Specifically, it was one of the factors that caused us to focus on the conclusions in the HSI Report that we “consider further analysis on risk grouping of asset categories,” and that we “consider adding mechanisms that allow flexibility in applying reader requirements.” ^[41] We also note that during the TWIC rulemaking process, other commenters raised similar issues, suggesting that the Coast Guard incorporate additional mechanisms for waivers and exemptions for various types of situations in which the commenters did not believe additional security measures were warranted.^[42] While we stated at the time that existing waiver provisions in 33 CFR 105.130 enable the Coast Guard to grant “a waiver of any requirement that the owner or operator considers unnecessary,” ^[43] at this time, we do not have a full and consistent picture of what specific security vulnerabilities would need to be addressed in order to grant a waiver based on equivalency. Specifically, because any equivalency determination would need to be based on a determination of TWIC utility, which is not covered in the facility's security assessment, we would be applying any such waivers on an inconsistent and uncertain basis. For that reason, there is a need to develop a more comprehensive analysis of the risk factors of facilities that handle CDC on an individualized basis, and the results of that analysis could inform either a revision of the TWIC reader rule applicability or, alternatively, to develop a consistent methodology for applying waivers. Further analysis could allow the Coast Guard to provide broad relief from security requirements for a wide variety of facilities currently characterized as Risk Group A due to the asset categorization methodology.

In the NPRM, the Coast Guard addressed the issue of bulk CDC located outside of areas related to maritime transportation. In response to a comment suggesting that facility owners should not be required to use TWIC readers for certain portions of their facilities, we noted that facilities already had an “option to redefine their `secure area' as only that portion of their access control area that is directly related to maritime transportation . . .” and that “facilities whose footprint includes portions that are not directly related to maritime transportation can submit a [Facility Security Plan] for Coast Guard approval that removes those areas from the definition of the facility's `secure area' for Coast Guard regulatory purposes.” ^[44] The Coast Guard went on to note that “[s]uch facilities would typically include refineries, chemical plants, factories, mills, power plants, smelting operations, or recreational boat marinas.” ^[45]

In the TWIC Reader final rule, we also addressed the issue of bulk CDC located outside of the maritime nexus of the facility. We noted that a facility where bulk CDC is stored and handled away from the maritime nexus would be a Risk Group A facility (because the bulk CDC would still be protected by the facility's security plan and, thus, would present a vulnerability), and stated that “when the bulk CDC is not a part of the maritime transportation activities, it may be that a facility could define its MTSA footprint in such a way as to exclude that area . . . [with the result that] the TWIC reader requirements . . . would not apply in that area.” ^[46]

In summary, we believe that the manner in which the TWIC Reader final rule defines Risk Group A may be overbroad. While some facilities that handle bulk CDC that is not transferred to or from a vessel present a serious risk of a TSI, the fact that it was evident that exceptions and waivers would be necessary to implement the program indicates that there may be a need for more refinement of the Risk Group A category. The petitioners and others, such as owners and operators of facilities that would have to comply with the TWIC Reader final rule and members of Congress who represent this interests of those persons, who have discussed the TWIC Reader final rule with the Coast Guard have raised valid issues about whether the risk groupings established in the TWIC Reader final rule represent the best definition of high-risk facilities that can benefit from the requirement of electronic TWIC inspection. Because it is our goal to impose a requirement only where there is clear evidence that the benefits will justify the costs, we believe that these issues warrant additional study.

V. Discussion of the Proposed Rule To Delay the Effective Date

Based on industry input, the recommendations outlined in the HSI Report, and the length of time that has passed since the development of the original risk analysis, we are proposing in this NPRM a temporary, partial delay in implementing the requirements for electronic TWIC inspection for certain facilities. Specifically, we are proposing to delay for 3 years implementation of the requirements for electronic TWIC inspection at facilities that handle bulk CDC but do not transfer it to or from a vessel and facilities that receive vessels that carry bulk CDC but, during that vessel-to-facility interface, do not transfer bulk CDC to or from the vessel. All other vessels and facilities subject to the electronic TWIC inspection requirements, including facilities that receive large passenger vessels and facilities regulated under 33 CFR 105.295 that handle bulk CDC and transfer it to or from a vessel, would still be required to comply on the August 23, 2018, compliance date.

We are proposing this delay because we believe that we can better consider the risk methodology used in the TWIC Reader final rule. When we determined that the presence of CDC in bulk within the MTSA footprint was enough justification for a facility to be considered Risk Group A (i.e., used the asset categorization methodology from the original Coast Guard TWIC Report and HSI Report), we eliminated more precise risk analysis capabilities for assessing whether a particular facility is high risk and warrants the additional regulatory burden of requiring electronic TWIC inspection. That is, when using the asset categorization methodology, the Coast Guard did not examine each facility individually to determine the precise amount of risk posted by a specific facility. We believe that delaying the implementation of the TWIC Reader final rule requirements for certain facilities could allow us to develop a more precise risk-analysis methodology that would better identify which of these facilities subject to the 3-year delayed implementation date would benefit from the electronic TWIC inspection requirements.

The items raised by the petitioners and recommendations provided by the HSI Report establish the parameters of what the Coast Guard plans to study and reevaluate during the proposed delay period. Specifically, we would analyze whether we can divide the general asset category of “facilities that handle CDC in bulk” into more specific asset categories for purposes of implementing the electronic TWIC inspection requirement. Additionally, the delay period would allow the Coast Guard to determine factors that, if they do not lend themselves to subdividing the asset categories, would be able to provide guidance for waiver procedures. These factors could include, but are not limited to, the quantity of bulk CDC handled or stored, the location within the facility where the CDC is handled or stored, and the population density or other critical infrastructure elements in and around the facility. Furthermore, more precise analysis of specific facility aspects, such as plume modeling, analysis of prevailing winds and currents, and other potential factors could be useful in determining whether an attack on a particular facility presents enough of a security threat to warrant a requirement for enhanced security measures. Finally, we could analyze existing security measures and take them into consideration to determine the marginal TWIC utility, as suggested by the HSI Report.

The goals of the additional study would be to prevent situations where electronic TWIC inspection requirements would provide little or no protection and, conversely, to capture situations where the existing Risk Group A may not cover the full range of necessary facilities. As an example, a 1,000 lb. propane tank remotely located in a large facility away from a population center may have a relatively low risk of causing a TSI. That same propane tank located in a small facility in an urban environment may have a much higher risk of causing a TSI, and therefore may warrant designation of the facility as Risk Group A. The current asset categorization methodology used by the Coast Guard cannot make such distinctions.

We believe that a 3-year delay period is needed to allow time for the Coast Guard to attain and analyze data from individual MTSA facilities that contain hazardous chemicals, and implement electronic TWIC inspection for those facilities that would benefit from electronic TWIC inspection requirements. The first 18 months of the delay would be dedicated to physical analysis of individual facilities, during which we would develop the specific data entry requirements for field inspectors, analyze data from facility inspections, and, potentially, develop a new risk methodology based on that analysis. After the data entry requirements are established, Coast Guard inspectors would incorporate any additional data gathering as part of the annual or spot inspection of each facility. As data are gathered, they would be entered into and analyzed through a risk analysis tool to score for operational risks. This process would require several months to collate and analyze data to determine the risk values of MTSA facilities with regard to electronic TWIC inspection, verify whether the new risk values coincide with previous parameters of Risk Group A, and determine which facilities have the highest risk of a TSI.

Based on the information collected and analyzed during the first half of the proposed 3-year delay period, we would take one of two next steps. If the new data indicates that the risk groupings in the TWIC Reader final rule were appropriate, we would not make any changes to the existing requirements for electronic TWIC inspection, and would publish a document in the Federal Register explaining the results of our new data and analysis. If, on the other hand, the data suggest that there is a different and preferable way to implement requirements for electronic TWIC inspection, and the revised Coast Guard risk analysis suggests that additional or fewer facilities not included in the TWIC Reader final rule's risk analysis should be covered, we would use the remaining time of the proposed 3-year delay period to conduct a rulemaking using the new information, including the publication of a notice of proposed rulemaking to allow for a public comment period.

During the proposed delay period, facilities that receive large passenger vessels and facilities that transfer bulk CDC to or from a vessel will be required to implement electronic TWIC inspection. We believe that, unlike situations where CDC is not transferred to or from a vessel, these two categories of facilities present a clear risk of a TSI. Facilities that transfer CDCs to or from a vessel typically transfer large quantities. Similarly, large passenger facilities present an inherent risk of a TSI. Unlike the scenarios described above involving bulk CDC, the loss of human life that could occur as a result of an attack at a large passenger facility is not related to the location of the facility (e.g., near or far from a population center), because the lives would be lost at the facility itself. For these reasons, the August 23, 2018, implementation date of the TWIC Reader final rule continues to be appropriate for these classes of facilities. We also note that the petitioners referred to above did not request that the electronic TWIC inspection requirements be delayed for these categories of facilities.

VI. Regulatory Analysis

This proposed rule would delay implementation of the TWIC Reader final rule by 3 years, until August 23, 2021, for two types of Risk Group A facilities: (1) Those that handle CDCs in bulk, but do not transfer CDCs to or from a vessel, and (2) those that receive vessels carrying bulk CDC but, during the vessel-to-facility interface, do not transfer bulk CDC to or from the vessel. Other facilities and vessels would still be required to comply with the TWIC Reader final rule by August 23, 2018.

Below, we provide an updated Regulatory Analysis of the TWIC Reader final rule that presents the impacts of delaying the effective date of the final rule for the two types of Risk Group A facilities defined in the preceding paragraph. For this updated analysis, we estimated the impact of delaying the final rule by calculating the 10-year cost of this proposed rule, where only certain facilities will incur costs starting in year one and other facilities will incur no costs in the first 3 years, and compare it to the 10-year cost presented in the Regulatory Analysis for the TWIC Reader final rule. We then calculated the difference between the two costs to estimate the impact of this proposed rule. To properly compare the costs and benefits of this proposed rule and the TWIC Reader final rule, we first updated the costs of the final rule from 2012 dollars to 2016 dollars.

A. Regulatory Planning and Review

Executive Orders 12866 (Regulatory Planning and Review) and 13563 (Improving Regulation and Regulatory Review) direct agencies to assess the costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying costs and benefits, reducing costs, harmonizing rules, and promoting flexibility. This proposed rule is expected to be an Executive Order 13771 (Reducing Regulation and Controlling Regulatory Costs) deregulatory action. Details on the estimated cost savings of this proposed rule can be found in the rule's economic analysis.

This proposed rule is a significant regulatory action under section 3(f) of Executive Order 12866. The Office of Management and Budget (OMB) has reviewed it under that Order. It requires an assessment of potential costs and benefits under section 6(a)(3) of Executive Order 12866. Because this proposed rule would delay the implementation of the TWIC Reader final rule by only 3 years (until August 23, 2021) for facilities that handle CDC in bulk, but do not transfer it to or from a vessel, and facilities that receive vessels carrying bulk CDC but, during that vessel-to-facility interface, do not transfer bulk CDC to or from the vessel, we did not revise our fundamental methodologies or key assumptions for the TWIC Reader final rule Regulatory Analysis.^[47]

In the 2016 final rule Regulatory Analysis, we estimated that 525 facilities and 1 vessel out of the MTSA-regulated entities (13,825 vessels and more than 3,270 facilities) will have to comply with the final rule's electronic TWIC inspection requirements using MSRAM's risk-based tiered approach.^[48] Using data from MSRAM, we estimate that this proposed rule would delay the implementation of the final rule for 122 of the 525 affected Risk Group A facilities by 3 years, while the remaining 403 facilities and 1 vessel would have to implement the final rule requirements by August 23, 2018. These 122 facilities handle bulk CDC, but do not transfer it to or from a vessel. This proposed rule would also apply to facilities that receive vessels carrying bulk CDC but, during the vessel-to-facility interface, do not transfer the bulk CDC to or from the vessel. We did not include these facilities in our MSRAM risk analysis for the final rule or in the final rule Regulatory Analysis. Therefore, we cannot determine the number of these facilities at this time, and we did not include them in our cost estimates for this proposed rule. We updated our final rule cost estimates from 2012 to 2016 based on Gross Domestic Product (GDP) Deflator data from the U.S. Bureau of Economic Analysis (BEA).^[49] The GDP deflator is a measure of the change in price of domestic goods and services purchased by consumers, businesses, and the government.

Table 1 summarizes the costs and benefits of the TWIC Reader final rule as well as this proposed rule, which would delay the final rule. We do not anticipate any new costs to industry if the final rule is implemented, because this proposed rule would not change the applicability of the 2016 final rule. This proposed rule would result in no other changes to the final rule. The impact to the one affected vessel, along with the qualitative costs and benefits, remain the same. Because this proposed rule would delay the implementation of the final rule by 3 years for 122 facilities, it would result in cost savings to both industry and the government of $8.1 million (discounted at 7 percent) over a 10-year period of analysis ($162.9 million minus $154.8 million). At a 7-percent discount rate, we estimate the total annualized cost savings to be $1.2 million ($23.2 million minus $22.0 million). Using a perpetual period of analysis, we estimated the total annualized cost savings of the proposed rule to be $0.552 million in 2016 dollars, using a 7-percent discount rate.

Table 1—Summary of Costs Saving and Change in Benefits: Final Rule and NPRM To Delay the Final Rule

Category	TWIC Reader final rule (2016 $)	Proposed rule to delay final rule (2016 $)
Applicability	High-risk MTSA-regulated facilities and high-risk MTSA-regulated vessels with greater than 20 TWIC-holding crew	Same as in final rule except the facilities and vessels handling bulk CDC, but not transferring it to or from the vessel.
Affected Population	1 vessel	No change from final rule.
	525 facilities (to comply by Aug. 23, 2018)	122 facilities that handle bulk CDC, but do not transfer it to or from a vessel (to comply by Aug. 23, 2021). The proposed rule would also apply to facilities that receive vessels carrying bulk CDC but, during that vessel-to-facility interface, do not transfer bulk CDC to or from the vessel. However, the number of these facilities cannot be determined at this time and will not be known until after an additional study is conducted to improve the risk methodology and determine the new risk groups to comply by August 23, 2021.
Costs to Industry and Government ($ millions, 7% discount rate) *	Industry: $23.2 (annualized) Government: $0.014 (annualized) Both: $23.2 (annualized) Industry: $162.8 (10-year)	Industry: $22.0 (annualized). Government: $0.013 (annualized). Both: $22.0 (annualized) Industry: $154.7 (10-year)
	Government: $0.097 (10-year)	Both: $154.8 (10-year).
	Both: $162.9 (10-year)	Government: $0.092 (10-year).
Change in Costs (Qualitative)	Time to retrieve or replace lost PINs for use with TWICs	The proposed rule would delay the cost to retrieve or replace lost PINs for use with TWICs for the facilities with delayed implementation.
Change in Benefits (Qualitative)	Enhanced access control and security at U.S. maritime facilities and on board U.S.-flagged vessels	Delaying enhanced access control and security for the facilities with delayed implementation.
	Reduction of human error when checking identification and manning access points	Delaying the reduction of human error when checking identification and manning access points for the facilities with delayed implementation.
* The TWIC Reader final rule Regulatory Analysis estimated an annualized cost to industry of $21.9 million (at a 7-percent discount rate), and a 10-year cost of $153.7 million (at a 7-percent discount rate) in 2012 dollars. For the purposes of this analysis, all costs are presented in 2016 dollars and are updated using annual GDP deflator data from the BEA. The annualized total industry cost of $21.9 million in 2012 dollars is now $23.2 million in 2016 dollars and the 10-year cost of $153.7 million is now $162.8 million in 2016 dollars.

Methodology

Final Rule Costs Inflated to 2016 Dollars

As shown in table 1, we updated the annualized cost of the 2016 final rule from 2012 dollars to 2016 dollars (over a 10-year period), which is approximately $23.2 million at a 7-percent discount rate. We performed this update to compare them to this proposed rule's total industry costs on the same basis.

To do this, we used an inflation factor from the annual GDP deflator data . We calculated the inflation factor of 1.059 by dividing the annual 2016 index number (111.445) by the annual 2012 index number (105.214).

We then applied this inflation factor to the costs for vessels and additional costs, which include additional delay costs, travel costs, and the cost to replace TWIC readers that fail (Table 4.38 of the final rule RA). These inflated costs are shown in table 2.

Table 2—Comparison of Total Cost for Vessels and Additional Costs in 2012 Dollars and 2016 Dollars Under 2016 TWIC Reader Final Rule

[Millions]

Year	Vessel		Additional costs
	2012 $	2016 $	2012 $	2016 $
1	$0.021	$0.022	$4.21	$4.46
2	0.0036	0.0038	4.21	4.46
3	0.0036	0.0038	4.21	4.46
4	0.0036	0.0038	4.21	4.46
5	0.0036	0.0038	4.21	4.46
6	0.018	0.019	4.21	4.46
7	0.0036	0.0038	4.21	4.46
8	0.0036	0.0038	4.21	4.46
9	0.0036	0.0038	4.21	4.46
10	0.0036	0.0038	4.21	4.46
Total	0.068	0.072	42.10	44.59

For facilities, we applied this inflation factor to the total cost-by-cost component (table 4.17 of the final rule RA) because the proposed rule would apply only to some of these cost elements. Facility costs include capital costs, maintenance costs, and operational costs. Capital costs consist of the cost to purchase and install TWIC readers, as well as the cost to fully replace TWIC readers 5 years after the original installation. Maintenance costs account for the costs to maintain TWIC readers every year after the original installation. Operational costs include costs that occur only at the time of the TWIC reader installation, such as those for amending security plans, creating a recordkeeping system, and initial training. Operational costs also include ongoing costs, such as those for keeping and maintaining records, downloading the canceled card list, and ongoing annual training. Table 3 presents a comparison of the facility costs in 2012 and 2016 dollars, as well as an estimate of the total number of facilities complying with the regulation each year.

Table 3—Comparison of Total Cost for Facilities in 2012 Dollars and 2016 Dollars Under 2016 TWIC Reader Final Rule

[Millions]

Year	Number of new facilities	Total number of facilities	Capital costs		Maintenance costs		Operational costs		Undiscounted total
			2012 $	2016 $	2012 $	2016 $	2012 $	2016 $	2012 $	2016 $
1	263	263	$49.49	$52.41	$0	$0	$1.99	$2.10	$51.47	$54.51
2	262	525	49.49	52.41	0.99	1.05	2.16	2.29	52.64	55.74
3	0	525	0	0	1.97	2.09	1.34	1.42	3.31	3.51
4	0	525	0	0	1.97	2.09	1.34	1.42	3.31	3.51
5	0	525	0	0	1.97	2.09	1.34	1.42	3.31	3.51
6	0	525	9.87	10.45	1.97	2.09	1.34	1.42	13.18	13.96
7	0	525	9.87	10.45	1.97	2.09	1.34	1.42	13.18	13.96
8	0	525	0	0	1.97	2.09	1.34	1.42	3.31	3.51
9	0	525	0	0	1.97	2.09	1.34	1.42	3.31	3.51
10	0	525	0	0	1.97	2.09	1.34	1.42	3.31	3.51
Total			118.71	125.72	16.78	17.77	14.84	15.72	150.33	159.20

Table 4 summarizes the total costs to industry of the final rule in 2016 dollars. We estimated the annualized cost to be $23.2 million at a 7-percent discount rate.

Table 4—Total Industry Cost Under 2016 TWIC Reader Final Rule

[Millions, 2016 dollars]

Year	Facility	Vessel	Additional costs *	Undiscounted	7%	3%
1	$54.51	$0.022	$4.46	$58.99	$55.13	$57.27
2	55.74	0.0038	4.46	60.20	52.58	56.75
3	3.51	0.0038	4.46	7.97	6.50	7.29
4	3.51	0.0038	4.46	7.97	6.08	7.08
5	3.51	0.0038	4.46	7.97	5.68	6.87
6	13.96	0.019	4.46	18.44	12.28	15.44
7	13.96	0.0038	4.46	18.42	11.47	14.98
8	3.51	0.0038	4.46	7.97	4.64	6.29
9	3.51	0.0038	4.46	7.97	4.33	6.11
10	3.51	0.0038	4.46	7.97	4.05	5.93
Total	159.20	0.072	44.59	203.86	162.76	184.01
Annualized					23.17	21.57
* These costs include additional delay, travel, and TWIC replacement costs due to TWIC failures.
Totals may not sum due to rounding.

Proposed Rule Costs

This proposed rule would delay the effective date of the final rule by 3 years (until August 23, 2021) for 122 facilities that handle bulk CDC, but do not transfer it to or from a vessel, and an unestimated number of facilities that receive vessels carrying bulk CDC, but do not transfer it to or from the vessel during that vessel-to-facility interface. To allow for a consistent comparison between the baseline estimates and the costs of this proposed rule, we maintain the assumption that 50 percent of facilities will comply each year of the implementation period. Therefore, we expect that 50 percent of the 403 facilities unaffected by the delayed implementation will comply in year 1 (202 facilities), and the remaining 50 percent will comply in year 2 (201 facilities). For the 122 facilities with the 3-year implementation delay, we assume that 50 percent will comply in year 3 (61 facilities), and 50 percent will comply in year 4 (61 facilities).

The costs are separated into three categories: Capital costs, maintenance costs, and operating costs. To estimate the capital costs in a given year, we multiplied the total baseline capital costs for all facilities by the percentage of facilities incurring costs in a given year.^[50] Because maintenance costs are not incurred until the year after the TWIC readers are installed, we calculated the proposed rule maintenance costs in a given year by multiplying the total baseline costs for all facilities by the percentage of facilities complying in the previous year.^[51] We estimated operational costs in a similar manner, multiplying total operational costs by the percentage of facilities complying in a given year.^[52] Table 5 presents the total cost to facilities under the proposed rule.

Table 5—Total Cost for Facilities From Partially Delaying the Effective Date of Final Rule

[Millions 2016 dollars]

Year	Number of new facilities	Total number of facilities	Capital costs	Maintenance costs	Operational costs	Undiscounted total
1	202	202	$40.33	$0	$1.62	$41.95
2	201	403	40.13	0.80	2.16	43.09
3	61	464	12.18	1.60	1.58	15.36
4	61	525	12.18	1.85	1.74	15.77
5	0	525	0	2.09	1.42	3.51
6	0	525	8.04	2.09	1.42	11.55
7	0	525	8.00	2.09	1.42	11.51
8	0	525	2.43	2.09	1.42	5.93
9	0	525	2.43	2.09	1.42	5.93
10	0	525	0	2.09	1.42	3.51
Total			125.72	16.80	15.58	158.10
Note: Totals may not sum due to rounding.

Table 6 summarizes the total costs to industry of this proposed rule, which would delay the TWIC Reader final rule, in 2016 dollars.⁵³ This proposed rule would not impact the compliance schedule to vessels. Therefore, these costs remain unchanged from the baseline. We calculated the additional costs by multiplying the totals in table 2 by the percentage of facilities complying within a given year and phasing them in in 2 years. Over 10 years, we estimate the annualized cost to industry to be $22.03 million at a 7-percent discount rate.

Table 6—Total Industry Cost Under the Proposed Rule Partially Delaying the Effective Date of the 2016 Final Rule

[Millions, 2016 dollars]

Year	Facility	Vessel	Additional costs *	Undiscounted	7%	3%
1	$41.95	$0.022	$1.73	$43.70	$40.84	$42.43
2	43.09	0.0038	3.41	46.50	40.62	43.83
3	15.36	0.0038	3.94	19.30	15.75	17.66
4	15.77	0.0038	4.46	20.23	15.43	17.97
5	3.51	0.0038	4.46	7.97	5.68	6.87
6	11.55	0.019	4.46	16.03	10.68	13.42
7	11.51	0.0038	4.46	15.97	9.95	12.99
8	5.93	0.0038	4.46	10.40	6.05	8.21
9	5.93	0.0038	4.46	10.40	5.66	7.97
10	3.51	0.0038	4.46	7.97	4.05	5.93
Total	158.10	0.072	40.29	198.46	154.71	177.28
Annualized					22.03	20.78
* These costs include additional delay, travel, and TWIC replacement costs due to TWIC failures.
Totals may not sum due to rounding.

Table 7 presents the estimated change in total costs to industry from delaying the implementation of the TWIC Reader final rule by 3 years (until August 23, 2021) for facilities that handle bulk CDC, but do not transfer it to or from a vessel, and facilities that receive vessels carrying bulk CDC, but do not transfer it to or from the vessel during that vessel-to-facility interface. We estimated an annualized cost savings to industry of $1.15 million at a 7-percent discount rate.

Table 7—Total Change in Industry Cost From the Final Rule to the NPRM Partially Delaying the Effective Date of Final Rule

[Millions, 2016 dollars]

	Total 10-year cost (not discounted)	Total 10-year cost (discounted)		Annualized cost
		7%	3%	7%	3%
TWIC Reader Final Rule	$203.86	$162.76	$184.01	$23.17	$21.57
NPRM to Delay Final Rule by 3 years	198.46	154.71	177.28	22.03	20.78
Change	(5.40)	(8.05)	(6.73)	(1.15)	(0.79)

Qualitative Costs

Qualitative costs are as shown in table 1. This proposed rule would delay the cost to retrieve or replace lost PINs for use with TWICs for the facilities with delayed implementation.

Government Costs

We expect that this proposed rule would also generate a cost savings to the government from delaying the review of the revised security plans for 122 Risk Group A facilities that handle bulk CDC, but do not transfer it to or from a vessel, and facilities that receive vessels carrying bulk CDC. There is no change in cost to the government resulting from TWIC inspections, because inspections are already required under MTSA and the TWIC reader requirements do not modify these requirements. As such, there is no additional cost to the government

To estimate the cost to the government we followed the same approach as the industry cost analysis and adjusted the cost estimate presented in the final rule Regulatory Analysis from 2012 dollars to 2016 dollars. For the government analysis, we used the fully loaded 2016 wage rate for an E-5 level staff member, $51 per hour, from Commandant Instruction 7310.1R: Reimbursable Standard Rates, in place of the 2012 wage of $49 per hour.^[54] We then followed the calculations outlined on page 72 of the final rule Regulatory Analysis to estimate a government cost of $53,550 in the first 2 years ($51 × 4 hours per review × 262.5 plans). Table 8 presents the annualized baseline government costs of $13,785 at a 7-percent discount rate.

Table 8—Total Government Cost Under 2016 TWIC Reader Final Rule

[2016 dollars]

Year	Cost of FSP	7%	3%
1	$53,550	$50,047	$51,990
2	53,550	46,773	50,476
3	0	0	0
4	0	0	0
5	0	0	0
6	0	0	0
7	0	0	0
8	0	0	0
9	0	0	0
10	0	0	0
Total	107,100	96,819	102,466
Annualized		13,785	12,012

Table 9 presents the government cost under the proposed rule. We estimated the annualized government cost to be $13,047 at a 7-percent discount rate. To estimate government costs in year 1 and year 2, we used the same approach as the baseline cost estimates.^[55]

Table 9—Total Government Cost Under the NPRM Partially Delaying the Effective Date of the 2016 Final Rule, Risk Group A

[2016 dollars]

Year	Cost of FSP	7%	3%
1	$41,208	$38,512	$40,008
2	41,004	33,471	38,650
3	12,444	10,158	11,388
4	12,444	9,493	11,056
5	0	0	0
6	0	0	0
7	0	0	0
8	0	0	0
9	0	0	0
10	0	0	0
Total	107,100	91,635	101,102
Annualized		13,047	11,852

Table 10 presents the estimated change in government costs from delaying the implementation of the TWIC Reader final rule by 3 years (until August 23, 2021) for facilities that handle bulk CDC, but do not transfer it to or from a vessel, and facilities that receive vessels carrying bulk CDC, but do not transfer it to or from the vessel during that vessel-to-facility interface. We estimated an annualized cost savings to the government of $738 at a 7-percent discount rate.

Table 10—Total Change in Government Cost From the Final Rule to the NPRM Delaying the Effective Date of Final Rule

[2016 dollars]

	Total cost (not discounted)	Total cost (discounted)		Annualized cost
		7%	3%	7%	3%
TWIC Reader Final Rule	$107,100	$96,819	$102,466	$13,785	$12,012
NPRM to Delay Final Rule by 3 years	107,100	91,635	101,102	13,047	11,852
Change	0.0	(5,184.3)	(1,364.0)	(738.1)	(159.9)

Using a perpetual period of analysis, we estimated the total annualized cost savings of the proposed rule to be $0.552 million in 2016 dollars, using a 7-percent discount rate.

Change in Benefits

As noted, this proposed rule would delay the effective date of the TWIC reader requirement for two categories of facilities: (1) Facilities that handle bulk CDC, but do not transfer it to or from a vessel (to comply by Aug. 23, 2021), and (2) facilities that receive vessels carrying bulk CDC but do not transfer bulk CDC to or from the vessel during that vessel-to-facility interface. The facilities for which the TWIC Reader final rule would be delayed will not realize the enhanced benefits of electronic inspection, such as ensuring that only individuals who hold valid TWICs are granted unescorted access to secure areas, enhanced verification of personal identity, and a reduction in potential vulnerability by establishing earlier the intent of perpetrators who attempt to bypass or thwart the TWIC readers, until August 23, 2021.

Summary of Cost Savings Under Executive Order 13771

We do not anticipate any new costs to the industry and government if this proposed rule is implemented and the effective date of the TWIC Reader final rule is delayed by 3 years. Therefore, this proposed rule is expected to be an Executive Order 13771 deregulatory action. Table 11 summarizes the cost savings of this rule by comparing and subtracting the costs of this proposed rule from the TWIC Reader final rule costs. Because this proposed rule would delay the implementation of the final rule by 3 years for 122 facilities, it would result in cost savings of $8.1 million for industry, $0.005 million for government, and $8.1 million total (all discounted at 7 percent) over a 10-year period of analysis. At a 7-percent discount rate, we estimate the annualized cost savings to be $1.15 million to the industry, $0.0007 to the government, and $1.15 million total. Using a perpetual period of analysis, we found total annualized cost savings of the proposed rule to be $0.552 million to industry and the government.

Table 11—Summary of Costs Savings Under Executive Order 13771: Final Rule and NPRM To Delay the Effective Date of the Final Rule

Category	Cost savings of this NPRM (millions 2016$)
Costs to Industry, Government and Total ($ millions, 7% discount rate)	Industry: $8.050 (10-year). Government: $0.005 (10-year).
	Total: $8.055 (10-year).
	Industry: $1.146 (annualized).
	Government: $0.0007 (annualized).
	Total: $1.147 (annualized).
	Industry: $0.522 (perpetual).
	Government: $0.00017 (perpetual).
	Total: $0.522 (perpetual).

Alternatives

One regulatory alternative to this proposed rule is for the Coast Guard to take no action. Under this alternative, the TWIC Reader final rule would become effective on August 23, 2018, and all 122 facilities we identified in our final rule Regulatory Analysis, in addition to the unknown number of facilities, would be expected to comply with the final rule. These entities would be required to implement the requirements for the electronic inspection of TWICs and would incur the costs we estimated in our final rule Regulatory Analysis unless a waiver was granted by the Coast Guard.

Another alternative the Coast Guard considered was a waiver approach. However, because we currently lack a comprehensive risk analysis on the level of individualized facilities, we do not believe this approach maximizes benefits. In the absence of a new comprehensive risk analysis, the Coast Guard might issue blanket waivers that include facilities that may indeed warrant the additional security of electronic inspection. For example, take 2 facilities with a 5,000 gallon tank of a CDC each. The tank in the first facility is placed near enough to the perimeter fence in a populated area that, if the tank explodes, it would kill enough people to cause a TSI and therefore should require electronic TWIC inspection. That same tank on the other facility is located away from the water in an isolated area within the MTSA footprint (not near a population). If it explodes it does not cause a TSI and therefore should not need to conduct electronic TWIC inspection. If the Coast Guard issued a blanket waiver for those facilities with a storage tank of CDC with 5,000 gallons or less, then we would not be properly implementing these requirements to mitigate the risks as intended.

We rejected both alternatives (`no action' and `waiver approach') because they do not address our need to conduct a comprehensive risk analysis at the individual facility level to determine whether or not those 122 facilities and an unknown number of facilities would be required to comply with the final rule after August 23, 2018, and also develop a consistent methodology that would form the rationale for Coast Guard when issuing waivers.

B. Small Entities

Under the Regulatory Flexibility Act, 5 U.S.C. 601-612, we have considered whether this proposed rule would have a significant economic impact on a substantial number of small entities. The term “small entities” comprises small businesses, not-for-profit organizations that are independently owned and operated and are not dominant in their fields, and governmental jurisdictions with populations of less than 50,000.

The Coast Guard proposes to delay the effective date of the TWIC Reader final rule (August 23, 2018) by 3 years, until August 23, 2021, for facilities that handle bulk CDC, but do not transfer it to or from a vessel, and facilities that receive vessels carrying bulk CDC but, during that vessel-to-facility interface, do not transfer it to or from the vessel. These facilities will experience a cost savings. Therefore, we estimate that this proposed rule would provide cost savings to 122 facilities.

Given this information, the Coast Guard certifies under 5 U.S.C. 605(b) that this proposed rule would not have a significant economic impact on a substantial number of small entities. If you think that your business, organization, or governmental jurisdiction qualifies as a small entity and that this proposed rule would have a significant economic impact on it, please submit a comment to the docket at the address listed in the ADDRESSES section of this preamble. In your comment, explain why you think it qualifies and how and to what degree this proposed rule would economically affect it.

C. Assistance for Small Entities

Under section 213(a) of the Small Business Regulatory Enforcement Fairness Act of 1996, Public Law 104-121, we want to assist small entities in understanding this proposed rule so that they can better evaluate its effects on them and participate in the rulemaking. If this proposed rule would affect your small business, organization, or governmental jurisdiction and you have questions concerning its provisions or options for compliance, please contact the person in the FOR FURTHER INFORMATION CONTACT section of this NPRM. The Coast Guard will not retaliate against small entities that question or complain about this proposed rule or any policy or action of the Coast Guard.

Small businesses may send comments on the actions of Federal employees who enforce, or otherwise determine compliance with, Federal regulations to the Small Business and Agriculture Regulatory Enforcement Ombudsman and the Regional Small Business Regulatory Fairness Boards. The Ombudsman evaluates these actions annually and rates each agency's responsiveness to small business. If you wish to comment on actions by employees of the Coast Guard, call 1-888-REG-FAIR (1-888-734-3247).

D. Collection of Information

This proposed rule would call for no new collection of information under the Paperwork Reduction Act of 1995, 44 U.S.C. 3501-3520.

E. Federalism

A rule has implications for Federalism under E.O. 13132 (Federalism) if it has a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. We have analyzed this proposed rule under that order and have determined that it is consistent with the fundamental federalism principles and preemption requirements described in E.O. 13132. Our analysis is explained below.

This proposed rule would delay the implementation of existing regulations that create a risk-based set of security measures for MTSA-regulated facilities. Based on this analysis, each facility is classified according to its risk level, which then determines whether the facility will be required to conduct electronic TWIC inspection. As this proposed rule would not impose any new requirements, but simply delay the implementation of existing requirements, it would not have a preemptive impact. Please refer to the Coast Guard's federalism analysis in the final rule entitled “Transportation Worker Identification Credential (TWIC)—Reader Requirements,” (81 FR 57652, 57706) for additional information.

While it is well settled that States may not regulate in categories in which Congress intended the Coast Guard to be the sole source of a vessel's obligations, States and local governments have traditionally shared certain regulatory jurisdiction over waterfront facilities. Therefore, MTSA standards contained in 33 CFR part 105 (Maritime security: Facilities) are not preemptive of State or local law or regulations that do not conflict with them (i.e., they would either actually conflict or would frustrate an overriding Federal need for uniformity).

The Coast Guard recognizes the key role that State and local governments may have in making regulatory determinations. Additionally, for rules with federalism implications and preemptive effect, Executive Order 13132 specifically directs agencies to consult with State and local governments during the rulemaking process. If you believe this rule has implications for federalism under Executive Order 13132, please contact the person listed in the FOR FURTHER INFORMATION section of this preamble.

F. Unfunded Mandates Reform Act

The Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1531-1538, requires Federal agencies to assess the effects of their discretionary regulatory actions. In particular, the Act addresses actions that may result in the expenditure by a State, local, or tribal government, in the aggregate, or by the private sector of $100 million (adjusted for inflation) or more in any one year. Although this proposed rule would not result in such expenditure, we discuss the effects of this NPRM elsewhere in this preamble.

G. Taking of Private Property

This proposed rule would not cause a taking of private property or otherwise have taking implications under Executive Order 12630 (Governmental Actions and Interference with Constitutionally Protected Property Rights).

H. Civil Justice Reform

This proposed rule meets applicable standards in sections 3(a) and 3(b)(2) of Executive Order 12988 (Civil Justice Reform) to minimize litigation, eliminate ambiguity, and reduce burden.

I. Protection of Children

We have analyzed this proposed rule under Executive Order 13045 (Protection of Children from Environmental Health Risks and Safety Risks). This proposed rule is not an economically significant rule and will not create an environmental risk to health or risk to safety that might disproportionately affect children.

J. Indian Tribal Governments

This proposed rule does not have tribal implications under Executive Order 13175 (Consultation and Coordination with Indian Tribal Governments) because it would not have a substantial direct effect on one or more Indian tribes, on the relationship between the Federal Government and Indian tribes, or on the distribution of power and responsibilities between the Federal Government and Indian tribes.

K. Energy Effects

We have analyzed this proposed rule under Executive Order 13211 (Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use). We have determined that it is not a “significant energy action” under that order because although it is a “significant regulatory action” under Executive Order 12866, it is not likely to have a significant adverse effect on the supply, distribution, or use of energy, and the Administrator of OMB's Office of Information and Regulatory Affairs has not designated it as a significant energy action.

L. Technical Standards

The National Technology Transfer and Advancement Act, codified as a note to 15 U.S.C. 272, directs agencies to use voluntary consensus standards in their regulatory activities unless the agency provides Congress, through OMB, with an explanation of why using these standards would be inconsistent with applicable law or otherwise impractical. Voluntary consensus standards are technical standards (e.g., specifications of materials, performance, design, or operation; test methods; sampling procedures; and related management systems practices) that are developed or adopted by voluntary consensus standards bodies.

This proposed rule does not use technical standards. Therefore, we did not consider the use of voluntary consensus standards.

M. Environment

We have analyzed this proposed rule under Department of Homeland Security Management Directive 023-01 and Commandant Instruction M16475.lD, which guide the Coast Guard in complying with the National Environmental Policy Act of 1969 (42 U.S.C. 4321-4370f), and have made a preliminary determination that this action is one of a category of actions that do not individually or cumulatively have a significant effect on the human environment. A preliminary Record of Environmental Consideration (REC) supporting this determination is available in the docket where indicated under the “Public Participation and Request for Comments” section of this preamble. This proposed rule would be categorically excluded under paragraph L54 of Appendix A, Table 1 of DHS Instruction Manual 023-01(series). Paragraph L54 pertains to regulations that are editorial or procedural. We seek any comments or information that may lead to the discovery of a significant environmental impact from this proposed rule.

List of Subjects in 33 CFR Part 105

• Maritime security
• Reporting and recordkeeping requirements
• Security measures

For the reasons listed in the preamble, the Coast Guard proposes to amend 33 CFR part 105 as follows:

PART 105—MARITIME SECURITY: FACILITIES

1. The authority citation for part 105 continues to read as follows:

Authority: 33 U.S.C. 1226, 1231; 46 U.S.C. 70103; 50 U.S.C. 191; 33 CFR 1.05-1, 6.04-11, 6.14, 6.16, and 6.19; Department of Homeland Security Delegation No. 0170.1.

2. Amend § 105.253, as proposed to be added August 23, 2018 at 81 FR 57712, by revising paragraphs (a)(1) and (2) and adding paragraphs (a)(3) and (4) to read as follows:

§ 105.253

Risk Group classifications for facilities.

(a) * * *

(1) Beginning August 23, 2018: Facilities that receive vessels certificated to carry more than 1,000 passengers.

(2) Beginning August 23, 2018: Facilities that handle Certain Dangerous Cargoes (CDC) in bulk and transfer such cargoes from or to a vessel.

(3) Beginning August 23, 2021: Facilities that handle CDC in bulk, but do not transfer it from or to a vessel.

(4) Beginning August 23, 2021: Facilities that receive vessels carrying CDC in bulk but, during the vessel-to-facility interface, do not transfer it from or to the vessel.

* * * * *

Dated: June 15, 2018.

Karl L. Schultz,

Admiral, U.S. Coast Guard, Commandant.

Footnotes

1.  Public Law 107-295, 116 Stat. 2064 (November 25, 2002).

2.  Public Law 109-347, 120 Stat. 1884, 1889 (October 13, 2006).

3.  See 46 U.S.C. 70105(k)(3).

4.  71 FR 29396 (May 22, 2006).

5.  72 FR at 3492 (January 25, 2007).

6.  The SAFE Port Act required DHS to conduct a pilot program to test the business processes, technology, and operational impacts of TWIC readers in the maritime environment, and to issue regulations that require the deployment of TWIC readers that are consistent with the findings of the pilot program. See 46 U.S.C. 70105(k)(1) and (3).

7.  74 FR 13360 (March 27, 2009).

8.  78 FR 17782 (March 22, 2013).

9.  81 FR 57652.

10.  See Docket number USCG-2017-0447, available at www.regulations.gov.

11.  Each of these “asset categories” describes a certain purpose or operational description. For example, “gravel transfer facilities” would be considered under the same umbrella (i.e., in one “asset category”), rather than as individual facilities.

12.  Because this NPRM addresses facilities only, we have omitted further discussion about application of the TWIC program to vessels and outer continental shelf facilities (33 CFR parts 104 and 106, respectively).

13.  “Secure area” is defined in 33 CFR 101.105 as “the area onboard a vessel or at a facility or outer continental shelf facility over which the owner/operator has implemented security measures for access control in accordance with a Coast Guard approved security plan. It does not include passenger access areas, employee access areas, or public access areas, as those terms are defined in §§ 104.106, 104.107, and 105.106, respectively, of this subchapter. Vessels operating under the waivers provided for at 46 U.S.C. 8103(b)(3)(A) or (B) have no secure areas. Facilities subject to part 105 of this subchapter located in the Commonwealth of the Northern Mariana Islands and American Samoa have no secure areas. Facilities subject to part 105 of this subchapter may, with approval of the Coast Guard, designate only those portions of their facility that are directly connected to maritime transportation or are at risk of being involved in a transportation security incident as their secure areas.”

14.  See TWIC Reader final rule, section 105.255(a)(4).

15.  Pursuant to existing Coast Guard guidance, facilities not included in Risk Group A may use electronic inspection in lieu of visual inspection on a voluntary basis. See PAC-01-11, “Voluntary use of TWIC Readers,” available at https://homeport.uscg.mil.

16.  The definition of “secure area” specifically excludes areas like passenger access areas, employee access areas, facilities in the Commonwealth of the Northern Mariana Islands and American Samoa, etc. The TWIC Reader final rule imposed no requirements on those types of areas.

17.  That is, one can create a lookalike of a TWIC card, which does not have a working chip or is not linked to the TSA database, and it may not be detected as a counterfeit card if the card was only subject to visual inspection. However, the non-working chip and lack of connection to the TSA database would be detected if the counterfeit card were scanned by a TWIC reader, and the reader could not confirm the authenticity of the card or match it to known card.

18.  While the full Coast Guard TWIC Report contains sensitive security information, a redacted version of the document is available on the public docket for the TWIC rulemaking, available at www.regulations.gov as docket number USCG-2007-28915-0117.

19.  “Independent Verification and Validation of Development of Transportation Worker Identification Credential (TWIC) Reader Requirements,” developed by the Homeland Security Institute (HSI) (October 21, 2008) (the “HSI Report”). While the full HSI Report contains sensitive security information, a redacted version of the document is available on the public docket for the TWIC rulemaking, available at www.regulations.gov as docket number USCG-2007-28915-0119.

20.  Coast Guard TWIC Report, p. 4.

21.  Coast Guard TWIC Report, p.3.

22.  Coast Guard TWIC Report, p.3.

23.  Coast Guard TWIC Report, p.11.

24.  Coast Guard TWIC Report, p.13, figure 12.

25.  HSI Report, p.1.

26.  HSI Report, p.2.

27.  HSI Report, p.2.

28.  HSI Report, p.2.

29.  HSI Report, p.2.

30.  HSI Report, p.3.

31.  See 81 FR 57652, 57659. While there are other means of attacking a facility, we focused on these three scenarios because there is a significant improvement in threat mitigation by moving from visual TWIC inspection to electronic TWIC inspection.

32.  See 78 FR 17782, at 17791.

33.  The term “Certain Dangerous Cargo” is defined in 33 CFR 101.105 by reference to 33 CFR 160.202, which lists all covered substances.

34.  See text for 33 CFR 105.253(a)(1) and (2), 81 FR 57652, 57712.

35.  See 81 FR 57712, at 57698, Table 5.

36.  This petition is located in the docket at www.regulations.gov,, docket number USCG-2017-0447. While we acknowledge some of the issues raised in that petition here, we note that this NPRM does not constitute a grant or denial of that petition.

37.  Bulk, in this context, refers to how the cargoes are packaged rather than to an amount. The terms “bulk” or “in bulk” are defined in 33 CFR 101.105, in part, as “a commodity that is loaded or carried without containers or labels, and that is received and handled without mark or count.” See similar definitions in 33 CFR 126.3 and 160.3.

38.  As this term is used in the text of 33 CFR 105.253(a)(1), 81 FR 57652, 57712.

39.  The specific attack methods were discussed in the TWIC Reader final rule, Section V.A.2, “Risk analysis methodology,” These scenarios were: (1) A truck bomb, (2) a terrorist assault team, and (3) an explosive attack carried out by a passenger or passerby (with the specific caveat that the terrorist is not an “insider”). 81 FR 57652, 57659.

40.  Several other issues raised by the petitioner, such as questions regarding administrative procedure and economic analysis, are not addressed in this document. We plan to issue a formal response to that petition that will respond to all issues it raised.

41.  HSI Report, p. 3.

42.  See Section III.E.3.a of the NPRM “Public Comments Received in Response to the ANPRM and Public Meeting,” 78 FR 17782, 17796.

43.  78 FR 17782, at 17811.

44.  78 FR 17782, at 17803.

45.  Id.

46.  See 81 FR 57712, at 57681.

47.  Available in the docket, docket number USCG-2007-28915-0231.

48.  See Table 2.8 on page 26 of the TWIC Reader final rule Regulatory Analysis for the estimate of 525 facilities, and Table 2.1 on page 23 for the estimate of 1 vessel.

49.  For consistency across rulemaking analyses we are using the annual Implicit Price Deflators for Gross Domestic Product (BEA National Income and Product Accounts (NIPA) Table 1.1.9) values updated in March 2017. See page 9. https://faq.bea.gov/​scb/​pdf/​2017/​04%20April/​0417_​selected_​nipa_​tables.pdf.

50.  We calculated the total initial baseline capital costs for TWIC installation for all facilities by adding the baseline capital costs presented in table 3 for years 1 and 2 ($52.41 million + $52.41 million = $104.81 million). We calculated the total baseline capital costs for replacing TWIC readers 5 years after the original installation by adding the baseline capital costs presented in table 3 for years 6 and 7 ($10.45 million + $10.45 million = $20.90 million). We then multiplied these numbers by the percentage of facilities incurring the cost in a given year. For example, in year 1, a total of 202 facilities are expected to incur capital costs, for a total industry cost of $40.33 million ($104.81 million × (202 facilities/525 facilities) = $40.33 million).

51.  The total initial baseline maintenance costs for TWIC readers, $2.09 million, is found in year 3 of table 3, as this is the first year that all facilities will incur maintenance costs under the baseline. To estimate maintenance costs, we multiplied the percentage of facilities incurring the cost in a given year by the total costs. Because maintenance costs are not incurred until the year after the TWIC reader is installed, the total number of facilities incurring the cost is equal to the total number of complying facilities in the previous year. For example, we calculated year 2 costs as follows: $2.09 million × (202 facilities/525 facilities) = $0.80 million.

52.  We calculated total operational costs by adding the baseline operational costs in years 1 and 2 as presented in table 3 ($2.10 million + $2.29 million = $4.39 million). However, this total includes a $0.187 million in costs for ongoing recordkeeping and training which do not occur the first year a facility installs a TWIC reader. Therefore, the total initial operational cost to industry is $4.206 million ($4.39 million−$0.187 million = $4.206 million). We then multiplied the total cost by the percentage of new facilities complying in a given year. We also accounted for ongoing costs to industry, which we calculated by multiplying the total ongoing operational costs of $1.416 million per year (see year 3 of table 3) by the percentage of facilities incurring ongoing costs. For example, in year 2, we calculated the total initial costs to be $1.61 million ($4.206 million × (201 facilities/525 facilities)), and we calculated the total ongoing costs to be $0.545 million ($1.416 million × (202 facilities/525 facilities)), for a total cost of $2.16 million ($1.610 million + $0.545 million). The $1.416 million ongoing cost includes not only the $0.187 million in ongoing training and recordkeeping costs, but also the cost to update the canceled card list annually.

54.  Because the Coast Guard is not delaying the implementation schedule for vessels, the proposed rule would have no impact on the costs associated with vessel security plans, and, therefore, we did not include them in this Regulatory Analysis.

55.  We calculated the total cost in year 1 as 4 hours × $51 × 202 FSPs; the total cost in year 2 as 4 hours × $51 × 201 FSP; and the total cost in years 3 and 4 as 4 hours × $51 × 61 FSPs.