TWIC Affects Ports

Security act regulates who has access to maritime industries

• By Kim Rahfaldt
• Sep 01, 2011

The Maritime Transportation Security Act of 2002 required the Department of Homeland Security to secure America’s ports by implementing regulations that prevents most individuals from having unescorted access to secure facilities and vessels. The law mandates that all individuals who qualify for unescorted access receive a biometric credential to show proof of identification. Born from this directive was the Transportation Workers Identity Credential (TWIC), issued to individuals who meet the eligibility requirements.

TWIC holders present their cards to a port’s security staff member, who performs a visual inspection to ensure the person is the same one pictured on the card. If a person passes this step, he is allowed unescorted access into a port’s secure areas. TWIC is administered by the Transportation Security Administration (TSA) and the U.S. Coast Guard.

TWIC Pilot Program
The SAFE Port Act of 2006 created a TWIC pilot program to test the business processes, technology implemented and operational impact entailed in the deployment of TWIC readers. The ports and operators selected to participate in the program, which began in August 2008, received security grants to fund reader planning, installation, infrastructure and administration.

The program was implemented in a three-phase approach. First, initial technical testing determined whether selected biometric readers met TWIC specifications. Second, an early operational assessment evaluated readers at test sites. Pilot participants chose, installed and implemented readers as part of normal business practices. Finally, tests and evaluations were performed to determine the operational and technical effect of deploying TWIC readers.

Some of the program’s early challenges included the difficulty of integrating TWIC readers with physical access control systems (PACS), shorter contactless card read ranges than expected, inconsistent LCD messages among different readers, integrating facility operator requirements with PACS, slow-running PACS and failed cards. The Coast Guard has said that the final ruling on the success of the TWIC Pilot Program will come in late 2012.

One of the pilot participants chose AMAG Technology’s Symmetry Security Management System. L-1 Identity Solutions’ 4G PIV-TWIC extreme biometric readers housed in an enclosure are installed at the port’s main entrance. Truck drivers present their cards to the reader, which verifies and allows access if all other business purposes are met.

If a driver’s card does not meet all the requirements, he is denied access. The port found that Symmetry met its operational needs flexibly in the pilot and would be a good partner to provide a future solution when the final rule is established.

How TWIC Has Affected Ports
TWIC has significantly affected all ports regardless of whether they were selected to participate in the pilot program. Whether it’s following government mandates to meet anticipated TWIC requirements, working closely with labor, choosing security products to best meet those needs or finding the funding to comply, ports and their operators have had their hands full in the past several years trying to get the most bang for their buck while providing the tightest security.

Port security departments are figuring out how to move forward to implement TWIC in the most efficient, secure and cost-effective way. Some ports think they can accomplish this by waiting for the final rule on the program before investing time and money in a security infrastructure.

Others are taking action now, applying for grant money to start purchasing security products now so that when the final rule is made, they will already have preparations underway. Ports operators following this line of thinking reason that taking action now will put them ahead of the game, rather than waiting until the last minute to scramble for grant money when the final rule comes out, if any is available.

They can start researching products and considering which security solutions best meet their needs.

“Ports can use grant money for many things, including upgrading camera systems, purchasing biometric handheld readers and PIVCheck Plus software so they can authenticate and register TWIC cards into their access control system,” said Geri Castaldo, CEO of Codebench. “In some cases, they are purchasing brandnew access control systems.”

To meet TWIC requirements, ports must choose security products from the TSA Initial Capability Evaluation (ICE) list to install. Manufacturers have developed products specifically to meet this demand, so ports have several choices.

TWIC Challenges
Ports have always needed tight security to prevent unauthorized access and security. When ports add the TWIC component to their security programs, they are restricted to choosing fixed or handheld readers from the TSA ICE list. While these products are all approved to work with the TWIC, the products sometimes do not integrate with existing security systems. As a result, some ports have to remove perfectly functional security management systems and purchase new systems that integrate with selected readers.

While some costs may be offset by grant money, replacing existing security infrastructure is still expensive and time-consuming. Ports must research which access control, video surveillance and intrusion detection systems integrate with which readers. Installation and training on the final system also takes time. In the absence of a final rule from TSA and the Coast Guard, ports are left to determine for themselves how they should budget for security upgrades. Grant funding is beginning to dry up and was significantly slashed in the latest federal budget. From understanding what the government will enforce to selecting the right products, ports have come to rely on their systems integration partners more than ever to help them navigate through this process.

In the early days, when ports began to install systems to comply with MTSA requirements, they were looking to purchase specialized systems that relied on a single vendor and integrator. Unfortunately, those businesses may not be around these many years later to service the system. In 2004 and 2005, ports began to adopt a more integrated approach once they realized systems were more complex and required more integration, long-term operations and specialized upkeep to maintain.

They also recognized that technology changes rapidly and that they would need a partner to help them keep abreast of technology that will affect their facility.

“Our maritime customers are more aware of the technology available and how critical a strong partnership with their systems integrator is,” said G4S Technology’s vice president of business development, Misty Stine. “They are relying on their systems integrators to help them find a TWIC-compliant security solution.” Systems integrators, in turn, need to find security management systems that work cooperatively to meet a port’s security objectives. These security management manufacturers must deliver flexible products that can meet the different operational requirements on sites. They look for companies that have forward and backward compatibility, professional services departments and relationships with TSA ICE list partners.

Beneficial Products
With all the products and integration options available on the market, port security managers must choose the best solutions to meet their complex needs.

In addition to implementing TWICs and smart card readers, installing integrated video is important to a port’s security management system. Not only do ports obtain information from the readers themselves via the FIPS 201-compliant access control system, but they also have a video management system with cameras that support the reader visually. Local cameras record transactions and tie them to the access control database. The TWIC is designed to keep the wrong people out of the port terminals, and video records every transaction. “I found that when ports first started looking at security systems, they were only looking at systems that support TWIC,” said LVS Consulting President TJ Hicks. “Once we started discussing other components, they became much more motivated to implement alarm management, video, intrusion, analytics, etc.”

Ports also need to capture forensic information. For example, if a truck driver presents his card to the reader and there is a failure, an integrated system identifies the person, and the video visually captures what went wrong. Maybe there was a biometric failure or another reason why access was denied. Video will help security staff manage discrepancies.

Introducing one security management system that can satisfy all requirements became very attractive to port facility operations staff. They said they would rather manage one system from one company than manage three or four separate security systems -- separate access control, video and intrusion-detection systems -- and the three or four contractors that accompany that type of setup.

“These facility security officers don’t have a technical security group working for them,” Hicks said. “Putting all security systems on one platform makes managing security much easier.”

In addition to truck drivers transporting containers in and out of terminals and a large perimeter to secure, ports also have administration buildings to protect. Seaports would benefit from installing an integrated access control and intrusion detection product. Again, they would monitor one system rather than two, and the administration building would be part of the same security management system as the perimeter and other areas of the port, simplifying security management. If port employees don’t require TWICs, local access cards can be encoded and issued to employees. If the system is designed properly, these local cards can work for access control and employee identification, but they can never substitute for TWICs in the eyes of TSA and the Coast Guard.

Since the implementation of TWIC, the use of handheld readers has increased. Rugged handheld readers offer flexibility and a secure, mobile option for access control. They offer the same functions as a standard smart card reader. They can validate that the cardholder is really the card owner, and they can check the TWIC card number against the TWIC Canceled Card List (formerly known as the TWIC Hot List) to ensure the card has not been revoked. Some handheld readers can download information from the PACS database so that the operator can see other information about the cardholder, such as a photo and access rights, when a TWIC is read. This capability offers many advantages to ports:

Perimeter protection. Security guards can use handheld readers on the perimeter where there is no fence. They can check TWICs as people enter to verify a person’s identity and the card’s authenticity. This is useful for cruise ship terminals where the interest of commerce typically prohibits the installation of tall fences; such facilities are reconfigured when people are embarking or disembarking from a ship as well as when there are no ships in the berth.

“Depending on what ship is docked, workers may come in at a certain time through one door. Yet at another time of day that same door is used as an exit for passengers,” said AMAG Technology Product Manager Adam Shane. “Ports need to be very nimble in how they configure and reconfigure their facility. Sometimes the best solution is handheld readers.”

Ports are often a few miles long. “Large terminals often don’t have a security infrastructure that reaches the back gate located a mile away,” said Hicks. “Maybe 50 trucks go through the back gate, versus the 3,500 that use the front gate. Handheld readers are perfect for that environment because they save money on infrastructure and wiring.”

Registration. Ports have found they can purchase more-advanced software, such as Codebench’s OMNICheck Plus mobile software, to increase security. The software will verify the person and synchronize the handheld reader’s database with the port’s access control database. By pulling the information from the access control system and loading it onto the handheld reader, the security guard will know much more about that person.

“Security guards will be able to view a photo of the person on the handheld reader and know whether or not that person is registered in the access control system, and if they are in the access control system, are they allowed access right now?” Castaldo said. “It’s not just a spot-check; it’s more than that.”

Spot-Checking. The Coast Guard is authorized to spot-check individuals, and using handheld readers is a great way to make sure someone is who he says he is. A person must be within 10 minutes of his TWIC at all times. If a guardsman requests to see a card, it must be produced within 10 minutes before the person questioned can move on. The card has to be validated visually to gain unescorted access to a secure area.

Expertise Required
The TWIC pilot program will demonstrate how the throughput of trucks and people change and affect commerce as workers must meet higher levels of authentication to gain access. Ports will need the expertise of systems integrators and security consultants to navigate through integration capabilities, the myriad products on TSA’s ICE list and government requirements so they can invest in robust, FIPS 201-approved security management systems to protect their operations, staff and assets.

“I encourage any manufacturer and systems integrator that wants to participate in the TWIC market to sit down with a port facility security officer and talk to them about their operations,” Hicks said. “Their operations are different than what is seen in any other vertical market, and manufacturers and systems integrators have to do their homework.”

This article originally appeared in the September 2011 issue of Security Today.