Transportation Worker Identification Credential (TWIC) Implementation in the Maritime Sector; Hazardous Materials Endorsement for a Commercial Driver's License, 29396-29462 [06-4508]

Agencies

• Coast Guard
• DEPARTMENT OF HOMELAND SECURITY
• Transportation Security Administration

[Federal Register Volume 71, Number 98 (Monday, May 22, 2006)]
[Proposed Rules]
[Pages 29396-29462]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 06-4508]



[[Page 29395]]

-----------------------------------------------------------------------

Part II





Department of Homeland Security





-----------------------------------------------------------------------



Coast Guard



-----------------------------------------------------------------------



Transportation Security Administration



-----------------------------------------------------------------------



33 CFR Parts 1, 20 et al.; 46 CFR Parts 10, 12, and 15

49 CFR Parts 1515, 1570, and 1572



Transportation Worker Identification Credential (TWIC) Implementation 
in the Maritime Sector; Proposed Rules

Federal Register / Vol. 71, No. 98 / Monday, May 22, 2006 / Proposed 
Rules

[[Page 29396]]


-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

Transportation Security Administration

49 CFR Parts 1515, 1570, 1572

Coast Guard

33 CFR Parts 101, 103, 104, 105, 106, 125; 46 CFR Parts 10, 12, 15

[Docket Nos. TSA-2006-24191; USCG-2006-24196]
RIN 1652-AA41


Transportation Worker Identification Credential (TWIC) 
Implementation in the Maritime Sector; Hazardous Materials Endorsement 
for a Commercial Driver's License

AGENCY: Transportation Security Administration; United States Coast 
Guard, DHS.

ACTION: Notice of proposed rulemaking (NPRM).

-----------------------------------------------------------------------

SUMMARY: This is a notice of proposed rulemaking by the Department of 
Homeland Security, specifically by the Transportation Security 
Administration and the United States Coast Guard. If promulgated, this 
rule would implement the Transportation Worker Identification 
Credential program in the maritime sector. Under this program, merchant 
mariners holding an active License, Merchant Mariner Document, or 
Certificate of Registry and workers who require unescorted access to 
secure areas at maritime facilities or on vessels must undergo a 
security threat assessment, and, if found to not pose a security 
threat, obtain a Transportation Worker Identification Credential. 
Persons without Transportation Worker Identification Credentials will 
not be granted unescorted access to secure areas at affected maritime 
facilities or on vessels.
    Under this proposed rule, the Coast Guard seeks to amend its 
regulations on vessel and facility security to require the use of the 
Transportation Worker Identification Credential as an access control 
measure. It is also proposing to amend its regulations covering 
merchant mariners to incorporate the requirement to obtain a 
Transportation Worker Identification Credential. In a separate 
rulemaking action published elsewhere in this edition of the Federal 
Register, the Coast Guard also is proposing to consolidate existing 
licensing and documentation regulations to minimize duplicative or 
redundant identification or background check requirements.
    The Transportation Security Administration proposes amending its 
security threat assessment standards that currently apply to commercial 
drivers authorized to transport hazardous materials in commerce to also 
apply to merchant mariners and workers who require unescorted access to 
secure areas on vessels and at port facilities. These proposed 
amendments also relate to the notification an employer receives when an 
employee who holds a hazardous materials endorsement or a 
Transportation Worker Identification Credential is determined to pose a 
security threat. The Transportation Security Administration also is 
proposing regulations dealing with the enrollment of port workers into 
the Transportation Worker Identification Credential program.
    In addition, the Transportation Security Administration is 
proposing a fee, as authorized under the Department of Homeland 
Security Appropriations Act of 2004, to pay for the costs related to 
the issuance of the Transportation Worker Identification Credentials 
under this rule.
    This rulemaking would enhance the security of ports by requiring 
background checks on persons and establishing a biometric access 
control system to prevent those who pose a security threat from gaining 
unescorted access to secure areas of ports. This rulemaking implements 
the Maritime Transportation Security Act of 2002, which requires that 
credentialed merchant mariners and workers with unescorted access to 
secured areas of vessels and facilities be subject to a security threat 
assessment and receive a biometric credential needed to access secured 
areas.

DATES: Comments and related material must reach the Docket Management 
Facility on or before July 6, 2006. Comments sent to the Office of 
Management and Budget (OMB) on collection of information must reach OMB 
on or before July 6, 2006.
    Public Meetings: TSA and the Coast Guard will hold four public 
meetings as follows: Wednesday, May 31, 2006 in Newark, NJ; Thursday, 
June 1 in Tampa, FL; Wednesday, June 6 in St. Louis, MO; and Thursday, 
June 7 in Long Beach, CA. Interested individuals are invited to attend, 
provide comments and ask questions about the proposed rule. TSA and 
Coast Guard will provide exact locations and other additional 
information about the meetings in another document to be published in 
the Federal Register.

ADDRESSES: You may submit comments identified by TSA docket number TSA-
2006-24191 or Coast Guard docket number USCG-2006-24196 to the Docket 
Management Facility at the U.S. Department of Transportation. To avoid 
duplication, please use only one of the following methods:
    (1) Web site: https://dms.dot.gov.
    (2) Mail: Docket Management Facility, U.S. Department of 
Transportation, Room Plaza 401, 400 Seventh Street SW., Washington, DC 
20590-0001.
    (3) Fax: 202-493-2251.
    (4) Delivery: Room PL-401 on the Plaza level of the Nassif 
Building, 400 Seventh Street SW., Washington, DC, between 9 a.m. and 5 
p.m., Monday through Friday, except Federal holidays. The telephone 
number is 202-366-9329.
    (5) Federal eRulemaking Portal: https://www.regulations.gov.
    You must mail comments on collection of information to the Office 
of Information and Regulatory Affairs, Office of Management and Budget, 
725 17th Street NW, Washington, DC 20503, ATTN: Desk Officer, United 
States Coast Guard.
    See SUPPLEMENTARY INFORMATION for format and other information 
about comment submissions.

FOR FURTHER INFORMATION CONTACT: For questions related to TSA's 
proposed standards: Rick Collins, Transportation Security 
Administration, 601 South 12th Street, Arlington, VA 22202-4220, TWIC 
Program, 571-227-3515; e-mail: credentialing@dhs.gov.
    For legal questions: Christine Beyer, TSA-2, Transportation 
Security Administration, 601 South 12th Street, Arlington, VA 22202-
4220; telephone (571) 227-2657; facsimile (571) 571 1380; e-mail 
Christine.Beyer@dhs.gov.
    For questions concerning the Coast Guard provisions of this 
proposed rule: LCDR Jonathan Maiorine, Commandant (G-PCP-2), United 
States Coast Guard, 2100 Second Street, SW., Washington, DC 20593; 
telephone 1-877-687-2243.
    For questions concerning viewing or submitting material to the 
docket: Renee V. Wright, Program Manager, Docket Management System, 
U.S. Department of Transportation, Room Plaza 401, 400 Seventh Street, 
SW., Washington, DC 20590-0001; telephone (202) 493-0402.

SUPPLEMENTARY INFORMATION:

Public Participation and Request for Comments

    We encourage you to participate in this rulemaking by submitting 
comments and related materials. All comments received will be posted, 
without change, to https://dms.dot.gov

[[Page 29397]]

and will include any personal information you have provided. We have an 
agreement with the Department of Transportation (DOT) to use the Docket 
Management Facility. Please see DOT's ``Privacy Act'' paragraph below.
    Submitting comments: If you submit a comment, please include your 
name and address, identify the docket number for this rulemaking (TSA-
2006-24191 or USCG-2006-24196), indicate the specific section of this 
document to which each comment applies, and give the reason for each 
comment. Please send comments on the TSA portions of the proposed rule 
to the TSA docket (TSA-2006-24191), and send comments on the Coast 
Guard portions of the proposed rule to the Coast Guard docket (USCG-
2006-24196). You may submit your comments and material by electronic 
means, mail, fax, or delivery to the Docket Management Facility at the 
address under ADDRESSES; but please submit your comments and material 
by only one means. If you submit them by mail or delivery, submit them 
in an unbound format, no larger than 8\1/2\ by 11 inches, suitable for 
copying and electronic filing. If you submit them by mail and would 
like us to acknowledge receipt, please enclose a stamped, self-
addressed postcard or envelope. We will consider all comments and 
material received during the comment period. We may change this 
proposed rule in view of them.
    Handling of Confidential or Proprietary Information and Sensitive 
Security Information (SSI) Submitted in Public Comments: Do not submit 
comments that include trade secrets, confidential commercial or 
financial information, or sensitive security information (SSI) \1\ to 
the public regulatory docket. Please submit such comments separately 
from other comments on the rulemaking. Comments containing this type of 
information should be appropriately marked as containing such 
information and submitted by mail to the TSA legal point of contact 
listed in the FOR FURTHER INFORMATION CONTACT section.
---------------------------------------------------------------------------

    \1\ ``Sensitive Security Information'' or ``SSI'' is informaton 
obtained or developed int he conduct of security activities, the 
disclosure of which would constitute an unwarranted invasion of 
privacy, reveal trade secrets or privileged or confidential 
information, or be detrimental tot he security of transportation. 
The protection of SSI is governed by 49 CFR part 1520.
---------------------------------------------------------------------------

    Upon receipt of such comments, TSA will not place the comments in 
the public docket and will handle them in accordance with applicable 
safeguards and restrictions on access. TSA will hold them in a separate 
file to which the public does not have access, and place a note in the 
public docket that TSA has received such materials from the commenter. 
If TSA receives a request to examine or copy this information, TSA will 
treat it as any other request under the Freedom of Information Act 
(FOIA) (5 U.S.C. 552) and the Department of Homeland Security's FOIA 
regulation found in 6 CFR part 5.
    Viewing comments and documents: To view comments, as well as 
documents mentioned in this preamble as being available in the docket, 
go to https://dms.dot.gov at any time, click on ``Simple Search,'' enter 
the last five digits of the docket number for this rulemaking, and 
click on ``Search.'' You may also visit the Docket Management Facility 
in Room PL-401 on the Plaza level of the Nassif Building, 400 Seventh 
Street, SW., Washington, DC, between 9 a.m. and 5 p.m., Monday through 
Friday, except Federal holidays.
    Privacy Act: Anyone can search the electronic form of all comments 
received into any of our dockets by the name of the individual 
submitting the comment (or signing the comment, if submitted on behalf 
of an association, business, labor union, etc.). You may review the 
Department of Transportation's Privacy Act Statement in the Federal 
Register published on April 11, 2000 (65 FR 19477), or you may visit 
https://dms.dot.gov.

Abbreviations and Terms Used in This Document

AMS--Area Maritime Security
ASP--Alternative Security Program
ATSA--Aviation and Transportation Security Act
ATF--Bureau of Alcohol, Tobacco, Firearms, and Explosives
CDC--Certain Dangerous Cargo
CDL--Commercial drivers license
CDLIS--Commercial drivers license information system
CHRC--Criminal history records check
CJIS--Criminal Justice Information Services Division
COR--Certificate of Registry
COTP--Captain of the Port
DHS--Department of Homeland Security
DOJ--Department of Justice
DMV--Department of Motor Vehicles
DOT--Department of Transportation
FBI--Federal Bureau of Investigation
FIPS 201--Federal Information Processing Standards Publication 201
FMCSA--Federal Motor Carrier Safety Administration
FMSC--Federal Maritime Security Coordinator
FSP--Facility Security Plan
HME--Hazardous materials endorsement
HSA--Homeland Security Act
HSPD 12--Homeland Security Presidential Directive 12
ICC--Integrated Circuit Chip
MARSEC--Maritime Security
MMD--Merchant Mariner Document
MSC--Marine Safety Center
MTSA--Maritime Transportation Security Act
OCS--Outer Continental Shelf
REC--Regional Exam Center
SAFETEA-LU--Safe, Accountable, Flexible, Efficient Transportation 
Equity Act--A Legacy for Users
STCW--International Convention on Standards of Training, Certification, 
and Watchkeeping for Seafarers, 1978, as amended
TSA--Transportation Security Administration
TWIC--Transportation Worker Identification Credential
USA PATRIOT Act--Uniting and Strengthening America by Providing 
AppropriateTools Required to Intercept and Obstruct Terrorism Act
VSP--Vessel Security Plan

Table of Contents

I. Background and Purpose
II. Development of TWIC Process
III. Proposed Rule
    A. Coast Guard
    B. TSA
    1. TWIC Process
    a. Pre-Enrollment and Enrollment
    b. Adjudication of Security Threat Assessment
    c. Credential Production
    d. Credential Activation
    e. Using TWIC in an Access Control System
    f. Lost, Damaged or Stolen TWICs
    g. Renewal
    h. Call Center
    i. Notifying Employers of Threat Determination
    2. Fee
    3. TWIC in Other Modes of Transportation
IV. Advisory Committee Participation
V. Section-by-Section Analysis of United States Coast Guard Proposed 
Rule

General Introduction

33 CFR Part 101
    33 CFR 101.105 Definitions.
    33 CFR 101.121 Alternative Security Programs--TWIC Addendum.
    33 CFR 101.514 TWIC Requirement.
    33 CFR 101.515 Personal identification.
33 CFR Part 103
    33 CFR 103.305 Composition of an Area Maritime Security (AMS) 
Committee.
    33 CFR 103.505 Elements of the Area Maritime Security (AMS) Plan 
and 103.510 Area Maritime Security (AMS) Plan review and approval.
33 CFR Part 104
    33 CFR 104.105 Applicability.
    33 CFR 104.106 Passenger Access Area.
    33 CFR 104.115 Compliance dates.
    33 CFR 104.120 Compliance documentation.
    33 CFR 104.200 Owner or Operator/104.210 Company Security 
Officer

[[Page 29398]]

(CSO)/104.215 Vessel Security Officer (VSO)/104.220 Company or 
vessel personnel with security duties/104.225 Security training for 
all other personnel.
    33 CFR 104.235 Vessel recordkeeping requirements.
    33 CFR 104.265 Security measures for access control.
    33 CFR 104.290 Security incident procedures.
    33 CFR 104.295 Additional requirements--cruise ships.
    33 CFR 104.405 Format of the Vessel Security Plan (VSP).
    New Subpart E (33 CFR 104.500-104.510).
33 CFR Part 105
    33 CFR 105.115 Compliance dates.
    33 CFR 105.120 Compliance documentation.
    33 CFR 105.200 Owner or operator/105.205 Facility Security 
Officer (FSO)/105.210 Facility personnel with security duties/
105.215 Security training for all other facility personnel.
    33 CFR 105.225 Facility recordkeeping requirements.
    33 CFR 105.255 Security measures for access control.
    33 CFR 105.280 Security incident procedures.
    33 CFR 105.285 Additional requirements-passenger and ferry 
facilities.
    33 CFR 105.290 Additional requirements-cruise ship terminals.
    33 CFR 105.295 Additional requirements-Certain Dangerous Cargo 
(CDC) facilities.
    33 CFR 105.296 Additional requirements-barge fleeting 
facilities.
    33 CFR 105.405 Format and content of the Facility Security Plan 
(FSP).
    New Subpart E (33 CFR 105.500-105.510).
33 CFR Part 106
    33 CFR 106.110 Compliance dates.
    33 CFR 106.115 Compliance documentation.
    33 CFR 106.200 Owner or operator/106.205 Company Security 
Officer (CSO)/106.210 OCS Facility Security Officer (FSO)/106.215 
Company or OCS Facility personnel with security duties/106.220 
Security training for all other OCS facility personnel.
    33 CFR 106.230 OCS facility recordkeeping requirements.
    33 CFR 106.260 Security measures for access control.
    33 CFR 106.280 Security incident procedures.
    33 CFR 106.405 Format and content of the Facility Security Plan 
(FSP).
    New Subpart E (33 CFR 106.500-106.510).

Miscellaneous Items

    33 CFR 101.305 (Reporting requirements).
    33 CFR 101.400 (Enforcement)
    33 CFR 104.130, 105.130, and 106.125 (Waivers).
    33 CFR Subpart C Parts 104, 105, and 106 (Security Assessments).
46 CFR Parts 10, 12, and 15.
VI. Section-by-Section Analysis of TSA Proposed Rule
    49 CFR Part 1515 Appeal and Waiver Procedures for Security 
Threat Assessments for Individuals.
    49 CFR 1515.1 Scope.
    49 CFR 1515.3 Terms used in this part.
    49 CFR 1515.5 Appeal procedures.
    49 CFR 1515.7 Waiver Procedures.
    49 CFR Part 1570 Land Transportation Security: General Rules.
    49 CFR 1570.3 Terms used in this part.
    49 CFR Part 1572 Credentialing and Background Checks for Land 
Transportation Security.
    49 CFR 1572.5 Scope and standards for hazardous materials.
    49 CFR 1572.7 Waivers of security threat assessment standards.
    49 CFR 1572.9 Applicant information required for security threat 
assessment for a hazardous materials endorsement.
    49 CFR 1572.11 Applicant responsibilities for a security threat 
assessment for a hazardous materials endorsement.
    49 CFR 1572.13 State responsibilities for issuance of hazardous 
materials endorsement.
    49 CFR 1572.15 Procedures for security threat assessment for an 
HME.
    49 CFR 1572.17 Applicant information required for the security 
threat assessment for TWIC.
    49 CFR 1572.19 Applicant responsibilities for a security threat 
assessment for TWIC.
    49 CFR 1572.21 Procedures for security threat assessment for a 
TWIC.
    49 CFR 1572.23 Conforming Equipment; Incorporation by reference.
    49 CFR 1572.24-40 [Reserved]
    49 CFR 1572.41 Compliance, inspection and enforcement.
    49 CFR 1572.101 Scope.
    49 CFR 1572.103 Disqualifying Criminal Offenses.
    49 CFR 1572.105 Immigration status.
    49 CFR 1572.107 Other analyses.
    49 CFR 1572.109 Mental capacity.

Subpart E--Fees for Transportation Worker Identification Credential

    A. TWIC Maritime Population Estimation Methodology
    1. Recurring population
    2. Five-year population
    B. Proposed Fee
    1. Information Collection/Credential Issuance
    2. Threat Assessment/Credential Production
    3. FBI Fee
    4. Total Fees
    C. Section 1572.501 Fee Collection
VII. Rulemaking Analyses and Notices
    A. Executive Order 12866 (Regulatory Planning and Review)
    B. Small Entities
    C. Assistance for Small Entities
    D. Collection of Information
    E. Federalism
    F. Unfunded Mandates Reform Act
    G. Taking of Private Property
    H. Civil Justice Reform
    I. Protection of Children
    J. Indian Tribal Governments
    K. Energy Effects
    L. Technical Standards
    M. Environment

I. Background and Purpose

    Under this rule, the Department of Homeland Security (DHS), through 
the United States Coast Guard (Coast Guard) and the Transportation 
Security Administration (TSA), proposes to require that all merchant 
mariners holding an active License, Mechant Mariner Document, or 
Certificate of Registry and all persons who need unescorted access to 
secure areas of a regulated facility or vessel must obtain a 
Transportation Worker Identification Credential (TWIC). In order to 
obtain a TWIC, individuals will be required to undergo a security 
threat assessment conducted by TSA. TSA, in conducting those security 
threat assessments, will use the procedures and standards established 
by TSA for commercial motor vehicle drivers licensed to transport 
hazardous materials within the United States.
    The implementation of the TWIC program in the maritime sector 
builds upon existing Coast Guard credentialing requirements and 
security programs for port facilities and vessels. In a separate 
rulemaking action published in this issue of the Federal Register, 
Coast Guard also proposes consolidating existing merchant mariner 
licensing and documentation requirements to avoid duplicative 
credentials and background checks and to avoid interruption in commerce 
and reduce the burden on mariners.
    The TWIC program is a DHS initiative, with joint participation of 
the Coast Guard and TSA. The program is supported by several statutory 
and regulatory authorities and presidential directives. The principal 
statutory authority is the Maritime Transportation Security Act (MTSA), 
Pub. L. 107-295, 116 Stat. 2064 (November 25, 2002) (46 U.S.C. 70105). 
Section 102 of MTSA requires the Secretary of Homeland Security to 
issue a biometric transportation security credential to merchant 
mariners ``issued a license, certificate of registry, or merchant 
mariners document'' and individuals who require unescorted access to 
secure areas of vessels and facilities.\2\ These individuals also must 
undergo a security threat assessment to determine that they do not pose 
a security threat prior to receiving the biometric credential and 
authority to access the secure areas without escort. Id. The security 
threat assessment must include a review of criminal, immigration, and

[[Page 29399]]

pertinent intelligence records in determining whether the individual 
poses a threat, and individuals must have the opportunity to appeal an 
adverse determination or apply for a waiver of the standards. 
Specifically, an individual cannot be denied the transportation 
security credential required under MTSA unless the individual--
---------------------------------------------------------------------------

    \2\ 46 U.S.C. 70105. Section 102 of MTSA defines ``Secretary'' 
to mean ``the Secretary of the department in which the Coast Guard 
is operating.'' Under the Homeland Security Act of 2002, the Coast 
Guard became part of DHS, thus the Secretary of Homeland Security is 
authorized to implement the credential requirements for mariners and 
persons seeking access to secure port facilities under MTSA.
---------------------------------------------------------------------------

    (A) Has been convicted within the preceding 7-year period of a 
felony or found not guilty by reason of insanity of a felony--
    (i) that the Secretary believes could cause the individual to be a 
terrorism security risk to the United States; or
    (ii) for causing a severe transportation security incident;
    (B) Has been released from incarceration within the preceding 5-
year period for committing a felony described in subparagraph (A);
    (C) May be denied admission to the United States or removed from 
the United States under the Immigration and Nationality Act (8 U.S.C. 
1101 et seq.); or
    (D) Otherwise poses a terrorism security risk to the United 
States.46 U.S.C. 70105(c).
    Following the enactment of MTSA in November 2002, the Coast Guard 
issued a series of general regulations for maritime security. See, 33 
CFR parts 101-106. The MTSA regulations set out specific requirements 
for owners and operators (henceforth ``owners/operators'') of vessels, 
facilities, and Outer Continental Shelf (OCS) facilities that had been 
identified by the Secretary of Homeland Security as posing a high risk 
of being involved in a transportation security incident.
    Under MTSA and the Coast Guard's MTSA regulations, owners/operators 
of these vessels and facilities were required to conduct security 
assessments of their respective vessels and facilities, create security 
plans specific to their needs, and submit the plans for approval to the 
Coast Guard by December 31, 2003. All affected vessels and facilities 
are required to have been operating in accordance with their respective 
plans since July 1, 2004, and are required to resubmit plans every 5 
years.
    Each plan requires owners/operators to address specific 
vulnerabilities identified pursuant to their individual security 
assessments, including controlling access to their respective vessels 
and facilities. The MTSA regulations require owners/operators to 
implement security measures to ensure that an identification system was 
established for checking the identification of vessel and facility 
personnel or other persons seeking access to the vessel or facility.
    In establishing the system, owners/operators were directed to 
accept identification only if it: (1) Was laminated or otherwise secure 
against tampering; (2) contained the individual's full name; (3) 
contained a photo that accurately depicted that individual's current 
facial appearance; and (4) bore the name of the issuing authority. See, 
33 CFR 101.515. The issuing authority must be a government authority or 
organization authorized to act on behalf of the government authority, 
or the individual's employer, union, or trade association. There was no 
requirement that the identification be issued pursuant to a security 
threat assessment because there was no existing credential and 
supporting structure that could fulfill the needs specific to the 
maritime environment.
    In addition to the regulation of ports and facilities, the Coast 
Guard has a long history of regulating the merchant marine. Under the 
current Coast Guard regulatory scheme, the Coast Guard may issue a 
mariner any combination of 4 credentials: (1) Merchant Mariner Document 
(MMD); (2) License; (3) Certificate of Registry (COR); or (4) 
International Convention on Standards of Training, Certification, and 
Watchkeeping (STCW) Endorsement. An MMD serves as a mariner's 
identification credential and is issued to mariners who are employed on 
merchant vessels of 100 gross register tons or more, except for those 
vessels employed exclusively in trade on the navigable waters of the 
U.S. Licenses are qualification certificates that are issued to 
officers. CORs are qualification certificates that are issued to 
medical personnel and pursers. STCW Endorsements are qualification 
certificates issued to mariners who meet international standards and 
serve aboard vessels to which STCW applies. The License, COR, and STCW 
Endorsement are qualification credentials only. Only the MMD is an 
identity document, and none of the current mariner credentials contain 
the biometric information required under MTSA.
    TSA currently administers several programs involving security 
threat assessments of individuals engaged in the transportation 
industry, including certain airport and aircraft operator employees, 
and alien flight school students. Section 1012 of the Uniting and 
Strengthening America by Providing Appropriate Tools Required to 
Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act) Pub. L. 
107-56, 115 Stat. 272 (October 25, 2001) provides that a State cannot 
issue a hazardous materials endorsement (HME) to a commercial driver 
who poses a security threat. TSA implemented its security threat 
assessment processes under this provision.
    TSA first issued regulations to implement security threat 
assessment standards for HME applicants (TSA's hazmat rule) in May 2003 
and subsequently amended those regulations based on comments received 
from the States, employers and affected drivers. (A more detailed 
discussion and regulatory history of the hazmat regulations can be 
found at 68 FR 23852 (May 5, 2003); 68 FR 63033 (November 7, 2003); 69 
FR 17696 (April 6, 2004); and 69 FR 68720 (November 24, 2004). These 
standards are codified at 49 CFR part 1572, where many of the standards 
we propose for TWIC under this rule also will reside.
    TSA's hazmat regulations establish standards concerning criminal 
history, immigration status, mental capacity, and terrorist activity to 
determine whether a driver poses a security threat and is qualified to 
hold an HME.\3\ Drivers who have been convicted or found not guilty by 
reason of insanity for certain crimes in the preceding 7 years, or have 
been released from incarceration for those crimes in the preceding 5 
years, are deemed to pose a security threat and are not authorized to 
hold an HME. 49 CFR 1572.103. Drivers convicted of certain particularly 
heinous crimes, such as espionage, treason, terrorist-related offenses, 
or severe transportation security incidents, are permanently banned 
from holding an HME. Id. In addition, drivers who have been 
involuntarily committed to a mental institution or adjudicated as 
mentally incapacitated are considered to pose a security threat that 
warrants disqualification from holding an HME. 49 CFR 1572.109.
---------------------------------------------------------------------------

    \3\ In developing the hazmat regulations, TSA sought to 
harmonize, to the extent possible, the background check and 
eligibility criteria requirements of both MTSA and the USA PATRIOT 
Act and thus adopts privisions from both statutes where appropriate. 
See 68 FR at 23853.
---------------------------------------------------------------------------

    Aliens are not prohibited from obtaining an HME. The hazmat rule 
permits individuals who are in the United States lawfully and are 
authorized under applicable immigration laws to work in the United 
States to hold an HME upon completion of a satisfactory TSA security 
threat assessment. 49 CFR 1572.105. TSA reviews a driver's immigration 
status to determine if the applicant for an HME is authorized to be 
present and work in the United States under applicable

[[Page 29400]]

immigration laws. In addition, as set forth in the hazmat rules, TSA 
conducts a security check of international databases through Interpol 
or other appropriate means. 49 CFR 1572.107.
    TSA's hazmat regulations also include appeal and waiver procedures 
to ensure that no driver is wrongfully determined to pose a threat, to 
provide individuals who are disqualified from holding an HME the 
opportunity to show rehabilitation, where applicable, and to maintain 
consistency with other credentialing or background check requirements 
among transportation workers, such as those in the maritime industry 
covered by MTSA and this TWIC rulemaking. See e.g., 49 CFR parts 
1572.141 and 143.

II. Development of TWIC Process

    In 2002, TSA established the TWIC program in response to identity 
management shortcomings and vulnerabilities identified in the 
transportation system. In some segments of the transportation system, 
it is not possible to positively identify individuals entering secure 
areas or assess the threat they may pose due to a lack of pertinent 
background information. Also, existing identity credentials are often 
vulnerable to fraud. To mitigate these weaknesses, TSA determined that 
an integrated, credential-based, identity management system for all 
transportation workers who need unescorted access to secure areas of 
the nation's transportation system would be necessary.
    Homeland Security Presidential Directive 12 (HSPD 12) requires 
Federal agencies to improve secure identification processes for Federal 
employees and contractors. The objectives of the directive are to 
ensure that the credentialing processes are administered by accredited 
providers; are based on sound criteria for verifying an individual's 
identity; include a credential that is resistant to fraud, tampering, 
counterfeiting and terrorist exploitation, and can be authenticated 
quickly and electronically. As designed and proposed in this rule, TWIC 
does not contradict the control objectives of HSPD 12.
    The U.S. Department of Commerce published guidance on the standards 
and methods by which Agencies could reach compliance with HSPD 12. In 
February 2005, the Department of Commerce issued the Federal 
Information Processing Standards Publication 201 (FIPS 201), Personal 
Identification Verification of Federal Employees and Contractors in 
response to HSPD 12. FIPS 201 is divided into Personal Identification 
Verification (PIV) Parts I and II. Part I addresses the control and 
security objectives, particularly the personal identity proofing 
process. Part II provides detailed technical specifications that must 
be met to ensure interoperability of PIV-compliant credentials in 
personal authentication, access control, and credential management 
systems throughout the Federal government.
    The development of FIPS 201 occurred concurrently with the design 
of TWIC. TSA and its contractors closely monitored the development of 
FIPS 201 and individuals working on FIPS 201 followed the design of 
TWIC. TSA recognized that there are many benefits to designing TWIC in 
alignment with FIPS 201: Leveraging the TWIC infrastructure to support 
other DHS or government credentialing programs; avoiding obsolescence 
by using the latest technology; securing critical facilities with the 
same process used by Federal agencies; having interoperability during 
an emergency; and demonstrating the functionality of FIPS 201. All of 
the significant components of the TWIC system align with FIPS 201.
    As tested in the maritime environment and planned in this NPRM, 
TWIC is an identification credential containing numerous technologies 
to make it secure and tamper-proof. TWIC is a ``smart'' credential 
containing two electronic chips on which encoded data is stored to 
allow all subsequent TWIC functions to be performed. TWIC is designed 
to ensure that the identity of each TWIC holder has been verified; that 
a threat assessment has been completed on that identity; and that each 
credential issued is positively linked to the rightful holder through 
the use of biometric technology. Facility and vessel owners/operators 
subject to this rule will then determine which TWIC holders will be 
granted unescorted access to secure areas of their facility.

Prototype

    The TWIC program has been developed in three phases. Phases I, 
Planning, and II, Technology Evaluation, were completed in 2003, and 
Phase III, Prototype, was completed in 2005. In the technology 
evaluation, TSA tested and evaluated a range of credential-based 
systems in use at transportation facilities. In Prototype, TSA tested a 
comprehensive credentialing system, which included enrollment, threat 
assessments, biometric security, credential production, and credential 
issuance.
    Prototype was conducted at twenty-eight facilities beginning 
November 4, 2004 in various modes of the transportation system, 
including air, rail, and maritime. The Prototype Phase came to an end 
in the summer of 2005. During Prototype, the participating facilities 
and associated transportation workers voluntarily provided biographical 
and biometric identifiers. Participants provided appropriate identity 
verification documentation, such as a birth certificate, driver's 
license, government photo identification, or similar document. TSA 
conducted a name-based threat assessment using the biographic 
information provided, and utilized the biometric information to verify 
identity and determine whether an applicant had previously enrolled in 
the program. TSA did not use biometric information to complete a 
security threat assessment.\4\ TSA will be using both biographic and 
biometric information to conduct the security threat assessment once 
TSA implements the full program. To verify an individual's identity 
during Prototype, TSA followed the U.S. Citizenship and Immigration 
Services Employment Eligibility Verification (Form I-9) process, 
commonly used by the federal government and industry in the hiring 
process. TSA tested the TWIC as positive identification for access to 
secure areas of participating transportation facilities.
---------------------------------------------------------------------------

    \4\ Florida law requires persons seeking access to certain port 
facilities within that State to submit fingerprints and other 
information to obtain a State-issued credential. During Prototype 
conducted in Florida, therefore, participants submitted fingerprints 
as required under State law and the State completed a fingerprint-
based criminal history records check. TSA did not use biometric 
information collected from Florida participants to conduct a 
security threat assessment.
---------------------------------------------------------------------------

    By testing the integration of these components, TSA was able to 
assess the system's performance prior to deciding how the program 
should be implemented. Consequently, some processes that were tested in 
Prototype, such as ``employer sponsorship,'' are not being proposed in 
this rule based on TSA's determination that the process did not add 
sufficient value or created operational difficulties that could not be 
resolved.

III. Proposed Rule

A. Coast Guard

    In order to integrate TWIC into already existing security programs 
in the maritime environment, the Coast Guard must amend its maritime 
security regulations, found in 33 CFR Subchapter H. These changes will 
set performance standards for owners/operators of vessels, facilities, 
and Outer Continental Shelf facilities to meet

[[Page 29401]]

when incorporating TWIC into their existing security programs.
    The Coast Guard also must amend its regulations governing merchant 
mariners, found in 46 CFR parts 10, 12, and 15, in order to add the 
statutory mandate that they hold a TWIC. In a separate rulemaking, 
published in today's Federal Register, the Coast Guard is proposing to 
consolidate qualifications credentials and streamline its mariner 
regulations, which would ensure that no mariner is required to undergo 
(or pay for) more than one security threat assessment and identity 
verification.
    Coast Guard emphasizes that possession of the TWIC credential is 
not intended to constitute an automatic access right to any facility. 
The owner/operator continues to have the ultimate authority as to 
access control decisions, and although holding a duly-issued TWIC is 
required before an individual is eligible to be granted unescorted 
access, the individual must also have a need for access in accordance 
with the approved security plan. The owner/operator's right to refuse 
admittance to any individual, regardless of whether he or she holds an 
authenticated TWIC, remains unchanged.

B. TSA

    TSA's role in implementing the TWIC program in the maritime sector 
will be to conduct security threat assessments of credentialed merchant 
mariners and individuals with unescorted access to secure areas, 
providing an appeal and waiver process for applicants who receive an 
adverse determination, and performing related functions in the 
enrollment and credential issuance process. In this rule, TSA proposes 
changes to its regulations to extend the current processes for 
conducting security threat assessments for HMEs to persons seeking to 
obtain TWICs.
    On August 10, 2005, the Safe, Accountable, Flexible, Efficient 
Transportation Equity Act--A Legacy for Users (SAFETEA-LU), Pub. L. 
109-59, 119 Stat. 1144 (August 10, 2005) was enacted. Section 7105 of 
SAFETEA-LU (49 U.S.C. 5103a(g)(1)(B)(i)) requires TSA to initiate a 
rulemaking to determine which background checks required by Federal law 
and applicable to transportation workers are equivalent to or less 
stringent than the security threat assessment TSA requires for HME 
drivers. In addition, SAFETEA-LU requires TSA to develop a process for 
notifying employers of the results of a threat assessment conducted on 
an HME applicant.
    Under this rule, TSA is proposing a fee to cover the cost of the 
TWIC threat assessment, appeals of TSA decisions during the process, 
and the issuance of the credential as required under Section 520 of the 
Homeland Security Appropriations Act of 2004 (2004 DHS Appropriations 
Act), Pub. L. 108-90 (October 2003). TSA also is inviting comments from 
the transportation industry at large on the processes proposed under 
this rule as TSA and DHS are considering extending the TWIC program to 
other areas in the transportation industry outside of the maritime 
sector.
1. TWIC Process
    As proposed in this rule, the purpose of the TWIC program is to 
ensure that only authorized personnel who have successfully completed a 
security threat assessment have unescorted access to secure areas of 
maritime facilities and vessels. The credential will include a 
reference biometric--fingerprints--that positively links the credential 
holder to the identity of the individual who was issued the credential. 
TWIC holders may be asked to confirm, by providing a fingerprint, that 
they are the rightful owner of the credential at any time. Access 
control procedures and systems at facilities and vessels will recognize 
the credential and the information encrypted on it, so that the overall 
maritime network will be interoperable. In addition, an individual's 
credential can be deactivated or revoked by TSA if disqualifying 
information is discovered by or presented to TSA or other DHS entity, 
or the credential is lost or stolen, so that the credential can no 
longer be used to obtain unescorted access to secure areas.
    TSA has designed the TWIC process to maintain strict privacy 
controls so that a holder's biographic and biometric information cannot 
be compromised. The TWIC process proposed in this rule is described 
below from the perspective of an applicant.
a. Pre-Enrollment and Enrollment
    TWIC enrollment will be conducted by TSA (or TSA's agent operating 
under TSA's direction). All enrollment personnel must successfully 
complete a TSA security threat assessment and receive a TWIC before 
they will be authorized to access documents, systems, or secure areas.
    Facility and vessel owners/operators must notify workers of their 
responsibility to enroll, as well as the deadline for doing so. (The 
proposed implementation plan for enrollment is discussed in greater 
detail below.) Owners/operators must provide applicants enough lead 
time to enroll so that TSA has sufficient time to complete the security 
threat assessment and issue the credential before the access control 
procedures go into effect. Generally, owners/operators should give 
individuals at least 60 days notice to begin the process. TSA cannot 
guarantee that any threat assessment can be completed in less than 30 
days, and therefore, owners/operators and applicants should make every 
effort to initiate enrollment in a timely fashion to prevent workers 
being denied access for non-compliance. TSA will provide owners/
operators with locations for enrollment that they can then pass on to 
the workers (hereinafter referred to as applicants). For purposes of 
the NPRM, a list of potential enrollment center locations is provided 
on the TSA Web site (www.tsa.gov) to provide prospective owner/
operators and applicants a general idea of the enrollment plan. This 
list is subject to change and TSA invites comment from affected parties 
on the potential enrollment locations.
    Applicants will be able to ``pre-enroll'' online to reduce the time 
needed to complete the entire enrollment process at an enrollment 
center. For pre-enrollment, applicants need a computer with internet 
access. The applicant can access the TWIC Web site to provide personal 
information required for enrollment and select an enrollment center at 
which to complete enrollment. Data submitted by applicants via the 
Internet will be sent using Internet security protocols (i.e., SSL). 
All information provided is then stored in the TSA system, which 
encrypts and protects the data from unauthorized access. Applicants may 
schedule an appointment while on-line to complete the enrollment 
process, although appointments are not required at enrollment centers. 
The Web site will list the documents the applicant must bring to the 
enrollment center to verify identity. The convenience of pre-enrollment 
is a significant benefit for applicants and reduces strain on the 
enrollment centers. Applicants who pre-enroll must appear at enrollment 
centers to verify their identity, confirm that the information provided 
during pre-enrollment is correct, provide biometrics, and sign the 
enrollment documents.
    At the enrollment center, applicants will receive a privacy notice 
and consent form, by which they agree to provide personal information 
for the security threat assessment and credential. (For applicants who 
pre-enroll, the privacy notice is provided with the application online, 
but the applicants must acknowledge receipt of the notice in writing at 
the enrollment

[[Page 29402]]

center.) If an applicant fails to sign the consent form or does not 
have the required documents to authenticate identity, enrollment will 
not proceed. During Prototype, 96 percent of applicants appeared for 
enrollment with suitable identity verification documents. As TWIC is 
implemented, TSA and Coast Guard will make information available to 
affected workers in advance of enrollment so that all are aware of what 
to bring to the enrollment center. This information will also be posted 
on the TSA/TWIC Web site at www.tsa.gov. All information collected at 
the enrollment center or during the pre-enrollment process, including 
the signed privacy consent form and identity documents are scanned into 
the TSA system for storage. All information is encrypted or stored 
using methods that protect the information from unauthorized retrieval 
or use.
    At the enrollment centers, applicants must provide ten fingerprints 
and sit for a digital photograph. The fingerprints and photograph will 
be electronically captured at the enrollment center for use on the 
credential. Individuals must provide ten fingerprint images for use in 
completing the security threats assessment process. The credential 
itself will store two fingerprint templates, one of which is used as a 
reference biometric to verify identity. The entire enrollment record 
(including the 10 fingerprints) will be stored in the TSA system, 
encrypted and segmented to prevent unauthorized use. TSA will provide 
alternative procedures for enrollment centers to use for situations in 
which an applicant is unable to provide fingerprints.
    The TWIC fee, which covers the complete cost of enrollment, threat 
assessment, and credential production and delivery, must be collected 
from the applicant at the enrollment center prior to the enrollment 
record being transmitted to the TSA system. The TWIC enrollment fee 
will be non-refundable, even if the threat assessment results in a TWIC 
not being issued.
    Once all data and the fee are collected, the enrollment record is 
encrypted and electronically transmitted to the TSA system. The TSA 
system acknowledges receipt of the enrollment record, at which time all 
enrollment data is automatically deleted from the enrollment 
workstation. Once the enrollment record is transmitted to the TSA 
system, personal information is stored only in the TSA system, and 
personal data is encrypted to very high standards before it is 
transferred or stored. If an enrollment center temporarily loses its 
internet connection, the enrollment data is encrypted and stored on the 
enrollment workstation, but only until an internet connection is 
restored.
    During Prototype, the average time needed for an applicant who pre-
enrolled to complete enrollment was 10 minutes, 21 seconds. It is 
expected that it will take approximately fifteen minutes to complete 
enrollment of applicants who do not pre-enroll.
    TSA and Coast Guard currently envision a phased enrollment process 
based on risk assessment and cost/benefit analysis. Locations that are 
considered critical and provide the greatest number of individual 
applicants will be among the earliest enrollment sites. There are 
approximately 125 locations covering approximately 300 ports where TSA 
plans to enroll applicants, and we are in the process of rating each 
location against a variety of factors to assess criticality, 
population, and infrastructure. TSA and Coast Guard will work closely 
with the maritime industry to ensure that owners/operators and workers 
are given as much notice as is possible when a definitive enrollment 
schedule is selected. TSA and Coast Guard also are contemplating 
implementing a more flexible rollout, with anticipated dates to be 
announced by notices published in the Federal Register. (See the 
discussion of Sec.  1572.19 below for additional information on timing 
of enrollment.) TSA plans to use a combination of fixed and mobile 
enrollment stations to make the enrollment process as efficient as 
possible for applicants and owners/operators.
b. Adjudication of Security Threat Assessment
    Following enrollment, the TSA system sends pertinent parts of the 
record to various sources so that appropriate terrorist threat, 
criminal history, and immigration checks can be performed. When the 
checks are completed, TSA makes a determination on whether or not to 
issue a TWIC to the applicant and notifies the applicant.
    If disqualifying information is discovered, TSA issues an Initial 
Determination of Security Threat to the applicant with information on 
how the applicant can appeal an adverse decision or apply for a waiver 
of the standards. If the applicant does not respond to the Initial 
Determination within a specified period, it converts to a Final 
Determination of Security Threat and the applicant does not receive a 
TWIC. If the applicant proceeds with an appeal or application for 
waiver and is successful, the applicant is notified accordingly and the 
credential production process begins. (The appeal and waiver processes 
are discussed in greater detail below in the section-by-section 
analysis.)
    TSA may provide some of the notifications to applicants via email, 
if an applicant provides an email address on the application for the 
TWIC. We invite comment from prospective applicants about the 
substitution of email notification for a paper process.
c. Credential Production
    If the applicant is qualified to receive a TWIC, the TSA system 
generates an order to produce a credential. It is produced at a 
government credential production facility and securely shipped to the 
center at which the applicant enrolled. The applicant will be notified 
that the TWIC is ready to be retrieved and activated for use. The face 
of the TWIC credential contains the applicant's photograph, name, TWIC 
expiration date, and a unique credential number. In addition, the 
credential will store finger minutia templates of 2 fingers, finger 
pattern templates of 2 fingers, a personal identification number, and a 
Federal Agency Smart Credential number. The data is securely stored and 
protected in accordance with FIPS 201 in the various technologies used 
in the credential, such as magnetic stripe, contact chip, and 
contactless chip. The fingerprint data, the reference biometric, is 
used to match the credential to the person who enrolled.
    The TWIC system contains many feedback mechanisms to validate the 
transmission and receipt of data at key points in the process. The 
status of each transmission is recorded within the system.
    Credentials are electronically locked prior to shipment to the 
enrollment center so that the data cannot be accessed. Once the 
credentials are electronically locked, they cannot be used for access 
to any vessel or facility until they are activated by the TWIC 
enrollment station.
d. Credential Activation
    The applicant is notified when the enrollment center has received 
the credential. The applicant then returns to the enrollment site at 
his or her convenience to activate the credential.
    At the enrollment center, the applicant's credential is retrieved 
from secure storage and the photograph and name on it are compared to 
the applicant and the identity documents the applicant uses to 
authenticate identity. The applicant places a designated finger on a 
reader to generate a biometric match against the biometric stored on 
the credential and in the TSA

[[Page 29403]]

system. Upon successful biometric match, the TWIC is activated and the 
applicant selects a Personal Identification Number (PIN) that also is 
stored on the credential. The PIN can subsequently be used as an 
additional factor in proving one's identity and authorized use of the 
credential, or as the primary verification tool if the biometric is 
inoperative for some reason. The TWIC security threat assessment and 
credential are valid for five years, unless derogatory information is 
discovered and TSA revokes the credential.
    The process outlined above for credential activation is the same 
process TSA tested in Prototype, which worked well for owner/operators 
and employees who enroll. However, implementation of the program 
nationwide involving employees that are not stationary at one facility 
or port may impact applicants and owner/operators differently. TSA is 
concerned that requiring an applicant to return to the enrollment 
center to activate the credential may be onerous for workers who travel 
a great deal and may not know where they will be when the credential is 
ready for pick-up. TSA is considering the security and operational 
impacts of alternative procedures, on which we invite comment.
    TSA is considering an amendment to the process that would allow a 
worker to designate a specific enrollment center for credential pick up 
and activation. The card production facility would send the credential 
to that location rather than the location where the applicant enrolled. 
This is a change that can be accomplished, but this was not tested in 
Prototype and a variety of software changes may be needed, which could 
increase costs and affect the timing of implementation. Moreover, 
applicants will not know the exact date on which their credential will 
be ready and so those who work at a variety of ports across the country 
may not be able to designate a specific activation location on the 
enrollment application.
    During Prototype, the entire process from enrollment to card 
production was complete in fewer than 10 days. However, that process 
differed from the full program we plan to implement with this rule in a 
few significant ways. First, nearly all of the employees who 
volunteered for Prototype worked at the same location every day and the 
enrollment center was located on that site. Second, TSA did not 
complete fingerprint-based criminal history records checks, and so 
there was no time needed to adjudicate and provide redress for criminal 
activity. For threat assessment programs that are currently in place 
nationally in which applicants are not stationary and TSA conducts a 
fingerprint-based CHRC, the threat assessment is generally completed in 
less than 30 days. The time needed to complete the threat assessment 
varies depending on whether the database searches produce adverse 
information that must be investigated, and whether the applicant files 
an appeal or requests a waiver. These conditions will exist for the 
TWIC program and therefore, TSA will not be able to predict or 
establish a specific date on which the threat assessment and card 
production process will be complete.
    DHS invites comment on this option, and any other proposals that 
would make it easier logistically, without sacrificing security, for 
the public to receive and activate TWIC cards.
e. Using TWIC in an Access Control System
    Once the enrollment process is complete and the credential is 
activated, the credential is ready to be used as an access control 
tool. Possession of a TWIC does not guarantee access to secure areas 
because the owner/operator controls the individuals who are given 
unescorted access to the facility or vessel. Rather, TWIC is a secure, 
verified credential that can be used in conjunction with the owner/
operator's risk-based security plan and as required by the Coast Guard 
security regulations.
    As envisioned in this NPRM, owners/operators will determine an 
individual's need for unescorted access to secure areas and then grant 
access using a TWIC program. The access control administrator of the 
vessel or facility verifies that the individual holding the TWIC 
matches the biometric stored on the TWIC by conducting a 1-to-1 match 
with the individual's finger and the fingerprint template stored on the 
chip in the TWIC.
    The owner/operator verifies that an individual's TWIC is valid, 
either by directly interfacing with the TSA system or by using a list 
of invalid credentials downloaded from TSA. Either method provides 
owners/operators pertinent information concerning the validity of the 
credential. TSA will invalidate credentials that are reported as lost, 
stolen, damaged, retired, or issued to an applicant that TSA 
subsequently determines may pose a security threat. When the 
invalidation is for cause, that is, due to a security threat, TSA will 
revoke the credential. Invalidated credentials cannot be used or 
honored for unescorted access to secure areas. Cardholders who report 
the credential as lost, stolen, or damaged must go to the enrollment 
center for resolution, and/or re-issuance of a new credential.
    After the individual has been granted access to the facility, the 
owner/operator may opt to notify the TSA system that access privileges 
have been granted to this worker at that facility. If the owner/
operator invokes this option, the owner/operator also assumes 
responsibility for informing the TSA system if the owner/operator 
subsequently denies the individual access privileges.
f. Lost, Damaged, or Stolen TWICs
    Replacement TWICs are available if a credential is lost, stolen, or 
damaged. As soon as the applicant is aware that the credential is 
missing or damaged, he or she calls the Call Center and the Center 
follows a standard process to invalidate the credential. The applicant 
then travels to an enrollment center to receive a new credential. 
During Prototype, the card production facility printed and shipped the 
new credentials within 24 hours of receiving the information. 
Applicants must pay a fee of $36 to cover the cost of lost/damage/
stolen credential invalidation, new credential production, reissuance, 
shipping, and other appropriate program costs. No new TSA threat 
assessment-specific or enrollment costs are factored into this 
replacement fee.
g. Renewal
    TWICs issued under this rule will expire after five years unless 
renewed. TSA does not plan to notify TWIC holders when their credential 
is about to expire because the expiration date will be displayed on the 
face of the credential. To renew a TWIC, the holder must appear at any 
enrollment center, starting up to 90 days before the expiration date of 
the credential, to initiate the renewal process. However, mariners are 
allowed and encouraged to initiate renewal 180 days prior to expiration 
to allow sufficient time for TSA to conduct the security threat 
assessment and the Coast Guard to complete any review necessary to 
renew any required mariner credentials. During renewal, applicants must 
provide the same biographic and biometric information required in the 
initial enrollment and pay the associated fees. A new credential is 
issued upon renewal.
h. Call Center
    Upon publication of the final rule, TSA will refer the public to a 
Call Center to assist with questions about the TWIC program. An 
automated telephone line, listing options for the caller to select, 
will direct the caller to the TWIC Help Desk or the TSA/TWIC Web site.

[[Page 29404]]

Callers will be able to discuss questions about the program and final 
standard, the status of their security threat assessment, the location 
and time of operation of enrollment centers, and online applications 
and educational materials. TSA has used the Call Center when 
implementing other new programs and believes it will be very useful to 
owners/operators and applicants.
i. Notifying Employers of Threat Determinations
    TSA is proposing to modify the rule text applicable to HME 
applicants concerning employer notification and apply the proposed 
changes to the TWIC applicants.
    As discussed above, SAFETEA-LU established several mandates 
concerning the threat assessment process. One of the provisions 
requires TSA to invite comment on and develop a process to notify 
employers of HME applicants of the results of the threat assessment. 
Specifically, section 7105 states that--

    Within 90 days of enactment, TSA, after receiving comments from 
interested parties, must develop and implement a process for 
notifying employers designated by applicants for a HAZMAT license of 
the results of the applicant's background check if (1) such 
notification is appropriate considering the potential security 
implications and (2) the Director determines in a final notification 
of threat assessment served on the applicant that he or she does not 
meet the standards for granting a license.

    In the November 24, 2004 hazmat rule, TSA discussed employer 
notification, noting that actual criminal history or other dispositive 
records must be maintained confidentially by TSA. See 69 FR at 68726. 
TSA may inform an employer that an employee is disqualified from 
holding an HME, or has had an HME revoked, so that the employer knows 
that the employee is not authorized to transport hazardous materials. 
TSA, however, generally cannot disclose the basis for the determination 
result of the threat assessment due to prohibitions on disclosure of 
such information under the Privacy Act, or other pertinent privacy laws 
or law enforcement or security regulations. See e.g., 5 U.S.C. 552a (as 
amended); 46 U.S.C. 70105(e); 28 CFR 50.12. In the hazmat rule, TSA 
noted that if it believes an immediate threat exists, TSA may provide 
additional information to the employer to help prevent a security 
incident.
    In the November hazmat rule, TSA requested comment on methods to 
notify an employer that a particular driver's HME is revoked or the 
application for an HME is denied. TSA anticipated that it would be 
difficult to locate a driver's employer because drivers tend to change 
employers frequently and may work for several employers at one time. 
Also, many drivers are self-employed as owners/operators and 
notification in these cases would be unnecessary. TSA proposed 
requiring each employer to maintain a current list of hazmat-endorsed 
driver employees on a secure Web site that TSA could access for 
notification purposes and employers could amend as employees change 
jobs. This list would minimize the chance that TSA would erroneously 
notify a previous employer of a disqualification. Also, the list would 
prevent the loss of time and resources needed to locate an employer for 
notification. Similar procedures are in place with respect to aviation 
workers who have airport security identification display area 
authority. 49 CFR 1542.211. TSA received no comments on this proposal 
or suggestions for an alternative plan, although some employers stated 
that they would like notification of all employee disqualifications.
    Currently, when TSA determines that a driver is not qualified to 
hold an HME, TSA applies the following policy:
    (1) TSA notifies the employer only in cases where TSA determines 
that an imminent security threat may exist.
    (2) TSA notifies the employer listed in the driver's HME 
application.
    (3) TSA limits the information provided to the employer to the fact 
that the driver's HME is being revoked or denied, but does not provide 
the reason for the action.
    TSA developed this process to address two primary concerns. First, 
TSA is concerned about sharing disqualification information with 
incorrect employers and that the likelihood of such notifications would 
rise if TSA made notifications in all disqualification cases. For the 
many drivers who change employers frequently or are self-employed, TSA 
would expend considerable resources trying to determine with certainty 
an applicant's current employer(s).
    Second, for actions in which there is not an imminent threat, 
employers of hazmat drivers have other procedures in place to verify 
whether a driver has an HME. Carriers currently are required to 
determine if a driver em