The Risk-Mitigation Value of the Transportation Worker Identification Credential: A Comprehensive Security Assessment of the TWIC Program

Williams, Heather J.; Abel, Kristin Van; Metz, David; Marrone, James V.; Chan, Edward W.; Costello, Katherine; Bauer, Ryan Michael; Hill, Devon; Véronneau, Simon; Chang, Jimmy; Mitch, Ian; Traub, Joshua Lawrence; Soliman, Sarah; Haldeman, Zachary; Klima, Kelly; Ligor, Douglas C.

doi:10.7249/rr3096

Cited by 1 publication

(21 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Presumably, this information must come from facilities themselves and would need to be updated at regular intervals (e.g., during review of each facility's security plan every five years) to determine how the regulated population changes. The Transportation Worker Identification Credential (TWIC) program was established in December 2001 as part of post-9/11 legislation designed to increase maritime security (Williams et al, 2020). The program, jointly administered by the U.S. Coast Guard (USCG) and the Transportation Security Administration (TSA), requires anyone accessing a secure area at a Maritime Transportation Security Act (MTSA)-regulated facility, vessel, or outer continental shelf facility either to have a TWIC or be escorted by someone with a TWIC.…”

Section: S4 Conclusionmentioning

confidence: 99%

“…The first TWIC rule in 2007 set forth a process for issuing TWICs (Williams et al, 2020). This rule required MTSA-regulated vessels and port facilities to "use .…”

Section: Overview Of Twic Rulemakingmentioning

confidence: 99%

“…The confusion over the terms "CDC facility" and "facilities that handle CDC in bulk" has implications for the final population of risk group A. In 2020, HSOAC researchers conducted a congressionally mandated assessment of the TWIC program's risk-mitigation value, finding that the lack of clarity in the definition of CDC could mean that close to 1,000 more facilities could fall under the broad definition of CDC facility and be subject to the requirements of the final reader rule than the USCG originally estimated (Williams et al, 2020). The same HSOAC researchers found that the previous USCG report likely underestimated the costs of the rule and overstated the potential benefits.…”

Section: Determining Which Facilities Belonged In Risk Group Amentioning

confidence: 99%

“…The survey did not yield enough responses to analyze the resulting patterns. To supplement the survey responses, we turned to interviews conducted for the prior HSOAC study (Williams et al, 2020). For that study, the research team had conducted roughly 200 interviews with representatives from 164 facilities of all types and sizes across the United States, covering some of the same topics as our online survey.…”

Section: Epa's Trimentioning

confidence: 99%

“…Refer to the results of our online survey and the interviews from the previous HSOAC study (Williams et al, 2020).…”

Section: Survey and Interviews 30mentioning

confidence: 99%

See 4 more Smart Citations

Risk-Informed Analysis of Transportation Worker Identification Credential Reader Requirements

2022

View full text Add to dashboard Cite

To help it implement the final reader rule entitled "Transportation Worker Identification Credential (TWIC)-Reader Requirements," the U.S. Coast Guard (USCG) asked the Homeland Security Operational Analysis Center (HSOAC) to estimate the population of the Maritime Transportation Security Act-regulated facilities that the rule might affect; develop a transparent, objective risk assessment model for these facilities; and conduct a cost-benefit analysis of the regulation.This report describes our analytical efforts to address the three research areas mentioned above. Because there is no database of Maritime Transportation Security Act-regulated facilities with all the requisite information about certain dangerous cargoes that facilities handle in bulk, we resorted to other data sources, such as the U.S. Environmental Protection Agency's databases, an online survey, and interviews, to estimate the facility population. For the facility risk model, we used the modeling approach for assessing potential consequence included in the risk engine of the Cybersecurity and Infrastructure Security Agency's Chemical Facility Anti-Terrorism Standards (CFATS) program, harmonizing the TWIC and CFATS programs in consequence assessment. Because there was no credible estimate for the probability of a transportation security incident, we used a break-even analysis to assess whether the final reader rule is cost-effective.This research was sponsored by the USCG Office of Standards Evaluation and Development and conducted within the Strategy, Policy, and Operations Program of the HSOAC federally funded research and development center (FFRDC).Risk-Informed Analysis of Transportation Worker Identification Credential Reader Requirements vi S.2. Our ApproachThe overarching principle of our study is transparency and defensibility in support of rulemaking and implementation. To that end, we • used only unclassified and nonproprietary data • applied consistent, reproducible approaches • clearly documented the formulations, assumptions, and limitations of our approaches.For example, because a single comprehensive data source with the requisite information does not exist, we collected and collated facility-level information from multiple unclassified data sources to estimate the population of facilities subject to the reader rule delay. We decided to conduct a consequence-based risk assessment for this study because threat and vulnerability information is typically restricted.Our facility risk model is based on the Cybersecurity and Infrastructure Security Agency's well-known and well-documented Chemical Facility Anti-Terrorism Standards risk engine (Cybersecurity and Infrastructure Security Agency, 2021), whose consequence (in terms of the number of fatalities resulting from a potential CDC release) assessment methodologies are objective (i.e., physics-based and reproducible) and transparent (i.e., with ample documentation). We further developed a facility typology to practically group facilities based on observable attributes, such as CDC quant...

show abstract

Section: S4 Conclusionmentioning

confidence: 99%

“…The first TWIC rule in 2007 set forth a process for issuing TWICs (Williams et al, 2020). This rule required MTSA-regulated vessels and port facilities to "use .…”

Section: Overview Of Twic Rulemakingmentioning

confidence: 99%

Section: Determining Which Facilities Belonged In Risk Group Amentioning

confidence: 99%

Section: Epa's Trimentioning

confidence: 99%

“…Refer to the results of our online survey and the interviews from the previous HSOAC study (Williams et al, 2020).…”

Section: Survey and Interviews 30mentioning

confidence: 99%

See 3 more Smart Citations

Risk-Informed Analysis of Transportation Worker Identification Credential Reader Requirements

2022

View full text Add to dashboard Cite

show abstract

The Risk-Mitigation Value of the Transportation Worker Identification Credential: A Comprehensive Security Assessment of the TWIC Program

Abstract: iv into a facility's secure area. Rather than attempting to isolate the risk-mitigation value of TWIC, taking a system approach could determine how to best mitigate security vulnerabilities and where security benefits will have the best return on investment.

Cited by 1 publication

References 6 publications

Risk-Informed Analysis of Transportation Worker Identification Credential Reader Requirements

Risk-Informed Analysis of Transportation Worker Identification Credential Reader Requirements

Contact Info

Product

Resources

About