Homeland Security Bulletin

Homeland Security Bulletin SEPTEMBER 2003 Homeland Security Spurs New Regulatory Requirements for Over 5000 Businesses with Facilities Near Ports, Rivers, Lakes, Streams and Wetlands 1 In an effort to improve homeland security, on November 25, 2002, President Bush signed the Maritime Transportation Security Act of 2002 ( MTSA ). Pub. L. 107-295 (November 25, 2002). The purpose of MTSA is to provide for efficient, coordinated, and effective action to deter and minimize damage associated with marine transportation security incidents 2 terrorist attacks in the nation s ports and waterways. See 46 U.S.C. 70103(a)(2). The Coast Guard promulgated MTSA s implementing regulations through an interim final rule on July 1, 2003. Implementation of National Maritime Security Initiatives, 68 Fed. Reg. 39,240 (2003). 3 MTSA subjects owners and operators of certain facilities and vessels to an additional layer of regulations, additional inspections, and possible penalties. MTSA requires owners and operators of certain facilities to, among other things, perform security assessments, implement or amend security plans, and conduct regular training and drills at the facility. Further, facilities may be subject to a number of unknown area-specific requirements under this new law. This Bulletin provides a brief overview of the core requirements of MTSA and its regulations. The reach of MTSA appears broad, reaching any facility that is near a water of the United States, regardless of its relationship to ships and other vessels. Although the security requirements are by regulation limited to facilities that interface with vessels, the area maritime security plan may impose obligations with a broader effect. BACKGROUND In December 2002, a month following the enactment of MTSA, the International Maritime Organization ( IMO ), which includes the United States, adopted new security amendments to the Convention for the Safety of Life at Sea ( SOLAS ) and a new International Ship and Port Facility Security ( ISPS ) Code. See 67 Fed. Reg. 79,742 (2002). The requirements of MTSA parallel the 1 This is the fourth in a series of articles discussing new federal environmental regulatory requirements arising in connection with Homeland Security. Background information can be found in the Homeland Security page of kl.com 2 A transportation security incident is a security incident resulting in a significant loss of life, environmental damage, transportation system disruption, or economic disruption in a particular area. 46 U.S.C. 70101(6). 3 MTSA required the Coast Guard to issue an interim final rule as a temporary implementing regulation and expressly waived the requirements of the Administrative Procedure Act ( APA ). See 46 U.S.C. 70117(d). The Coast Guard plans on issuing the final rule in on or about October 25, 2003. MTSA mandates that the final rule be issued within one year of its passage. Regardless of congressional limits on APA review, the rules are subject to challenge to the extent they exceed the statutory authority granted the agency. Leedom v. Kyne, 358 U.S. 184 (1953); Aid Ass n for Lutherans v. United States Postal Service, 321 F.3d 1166 (D.C. Cir. 2003).

Homeland Security Bulletin security requirements set forth in the SOLAS amendments and the ISPS Code, but MTSA goes one step further it applies to domestic vessels and facilities. Id. The Coast Guard, which is now part of the Department of Homeland Security, is responsible for implementing and enforcing MTSA. On December 30, 2002, the Coast Guard issued a notice in the Federal Register seeking comments in connection with its effort to establish requirements for security assessments, plans, and specific security measures for ports, vessels, and facilities as required by MTSA. See 67 Fed. Reg. 79,742. Following that comment period, on July 1, 2003, the Department of Homeland Security adopted an interim final rule, which became effective immediately. See 68 Fed. Reg. 39,240. MTSA S BROAD REACH Unlike the SOLAS amendments and the ISPS Code, which apply only to port or waterfront facilities, MTSA applies to all facilities. See 46 U.S.C. 70101 et seq. Congress defines facility as any structure or facility of any kind located in, on, under or adjacent to any waters subject to the jurisdiction of the United States. 46 U.S.C. 70101(2) (emphasis added). Notably, this definition does not limit application to ports, wharves, docks, piers, and the like. Within the interim final rule, the Coast Guard attempted to clarify the definition by stating that facilities include those that are used, operated, or maintained by a public or private entity, including any contiguous or adjoining property under common ownership or operation. 68 Fed. Reg. at 39,280 (to be codified at 33 C.F.R. 101.105). With this definition, it appears that the Coast Guard is seeking to interpret MTSA expansively, just as other agencies have attempted to do when defining waters of the United States under legislation such as the Clean Water Act. 4 This application also is consistent with the Coast Guard s expanded jurisdiction under the Ports and Waterways Safety Act. See 33 U.S.C. 1221 et seq. (where Congress defined marine environment as navigable waters. ). Accordingly, it appears that the Coast Guard is asserting jurisdiction over any facility adjacent to any body of water that affects interstate commerce or body of water that is hydrologically connected to water that affects interstate commerce. This would include the Great Lakes and many rivers within the United States. A recent guidance document issued by the Coast Guard is consistent with this broad approach: [Congress] indicates the clear intent that the Coast Guard maritime security regulations should be aligned with our broader authority under the Ports and Waterways Security Act (33 U.S.C. 1221 et seq.) related to any public or commercial structure located on or adjacent to the marine environment, rather than our traditional approach of focusing on installations and terminals that have accommodations for vessels. 4 The United States has asserted Clean Water Act jurisdiction over isolated wetlands and other areas not apparently connected to interstate waters, such as rivers. This extensive jurisdictional reach was recently limited by the United States in Solid Waste Agency of Northern Cook County v. U.S. Army Corps of Engineers, 531 U.S. 159 (2001). 2 KIRKPATRICK & LOCKHART LLP HOMELAND SECURITY BULLETIN

See Navigation and Vessel Inspection Circular ( NVIC ) entitled Recommended Security Guidelines for Facilities, NVIC No. 11-02 (Jan. 13, 2002) at p. 2 (www.uscg.mil/hq/g-m/nvic/ 11-02.pdf). APPLICABILITY The Department of Homeland Security has estimated that MTSA s facility security requirements will affect the method by which over 5,000 facilities conduct business in the United States. See U.S. Department of Homeland Security Press Secretary Fact Sheet (July 2003). Under the interim final rule, and effective immediately, the Facility Security requirements apply to: 1. Facilities that interface with vessels and that handle: (i) Class 1 (explosive) materials or other dangerous cargoes regulated under 33 C.F.R. 126; (ii) liquefied natural gas and liquefied hazardous gas regulated under 33 C.F.R. 127; and (iii) oil and hazardous materials in bulk regulated under 33 C.F.R. 154; 5 2. Facilities that receive vessels that are certified to carry more than 150 passengers; 3. Facilities that receive vessels subject to SOLAS, or certain commercial vessels subject to 46 C.F.R. 90 (cargo and miscellaneous vessels), that are greater than 100 tons on international voyages, including vessels solely navigating the Great Lakes; or 4. Fleeting facilities that receive barges carrying, in bulk, cargoes regulated by 46 C.F.R. 30 (tank vessels) and 46 C.F.R. 150 (certain bulk dangerous cargoes), or Certain Dangerous Cargoes as defined by 33 C.F.R. 160.230 (certain explosive, oxidizing, radioactive, or hazardous materials). See 33 C.F.R. 105.105. As discussed below, these regulated facilities must prepare Facility Security Plans ( FSPs ) and submit the plans to the Coast Guard for review and approval. The Facility Security regulations do not apply to: 1. Certain facilities that are owned and operated by the United States; 2. Any oil and natural gas production, exploration, or development facility regulated by 33 C.F.R. 126 or 154 if the facility is engaged solely in the exploration, development, or production of oil or natural gas and if it does not meet or exceed the following operating conditions: (i) hosts more than 150 persons for 12 hours or more in each 24- hour period continuously for 30 days or more; (ii) produces greater than 100,000 barrels of oil per day; or (iii) produces greater than 200 million cubic feet of natural gas per day; 3. Any facility that supports the production, exploration or development of oil and natural gas regulated by 33 C.F.R. 126 or 154 if the facility is engaged solely in the exploration, development, or production of oil or natural gas and (i) the facility transports or stores quantities of hazardous materials that do not meet or exceed those specified in 49 C.F.R. 172.800(b)(1)-(6) or (ii) the facility stores less than 42,000 gallons of cargo regulated by 33 C.F.R. 154; 5 This is a clear deviation from the Coast Guard s plans several months ago when it was considering a much more broad implementation of its regulatory powers and application of MTSA regulatory requirements. See 67 Fed. Reg. 79742 (2002) and NVIC No. 11-02, supra, at p. 2. SEPTEMBER 2003

Homeland Security Bulletin 4. Mobile facilities regulated by 33 C.F.R. 154; or 5. Isolated facilities that receive materials regulated by 33 C.F.R. 126 or 154 by vessel due to lack of road access to the facility and do not distribute the material through secondary marine transfers. See 33 C.F.R. 105.105. Non-regulated facilities i.e., facilities not specifically subject to the Facility Security regulations are not exempt from MTSA s reach. Non-regulated facilities must comply with Area Maritime Security requirements, as well as the general provisions of the MTSA regulations. See id. Further, as discussed below, a non-regulated facility may be subjected to requirements outlined in the Area Maritime Security Plan if the Area Maritime Security Committee identifies the facility as a risk and the Captain of the Port ( COTP ) issues an order to take certain security actions to ensure port security. Area Maritime Security, 68 Fed. Reg. 39,284, 39,291 (2003) (to be codified at 33 C.F.R. 103.310). 6 MTSA REQUIREMENTS MTSA sets forth numerous requirements of owners and operators of facilities. To provide some context to the new facility security requirements, we will first provide a brief review of the national and area maritime security requirements. National Maritime Security The Coast Guard is required to develop a National Maritime Transportation Security Plan ( National Plan ) for deterring and responding to a transportation security incident. The plan will identify areas that will be covered by each COTP acting as the Federal Maritime Security Coordinator for each area. Notably, the National Plan must include a system of surveillance and notice designed to safeguard against as well as ensure the earliest possible notice of a transportation security incident and imminent threats of such a security incident to the appropriate State and Federal agencies. 46 U.S.C. 70103(a)(2)(E). 7 Additionally, the National Plan will identify areas for which Area Maritime Security Plans must be prepared. See 46 U.S.C. 70103(a)(2)(G). The Coast Guard has declined to publish rules in connection with the National Plan at this time, claiming that it is not necessary to implement the facility security rule requirements. See 68 Fed. Reg. 39,240, 39,270 (2003). Area Maritime Security Area Plan The COTP of each area assumes ultimate responsibility for creating and implementing the Area Maritime Transportation Security Plan ( Area Plan ) within his or her designated area for each of the 361 ports in the United States. See 33 C.F.R. 6 The general and area maritime security provisions do not define risk ; although, parenthetically, the Coast Guard indicates that the Area Maritime Security Committee should focus on threats, vulnerabilities, and consequences when developing an Area Security Plan. 33 C.F.R. 103.310(a)(2). The preamble to the general provisions defines threat as a measure of the likelihood of an attack, vulnerability as the conditional probability of success given that a threat scenario occurs, and consequence as the estimation of adverse effect from the target/attack scenario. 68 Fed. Reg. 39,244 (2003). 7 To the extent information collected by the Coast Guard implicates other statutes, there appears to be nothing to preclude the Coast Guard from sharing such information with agencies charged with administering these other statutes. 4 KIRKPATRICK & LOCKHART LLP HOMELAND SECURITY BULLETIN

103.300; see also U.S. Department of Homeland Security Press Secretary Fact Sheet (July 2003). Area Plans must describe the area and infrastructure covered by the Area Plan, and how it meshes with other Area Plans, and vessel and facility plans. See 46 U.S.C. 70103(b)(2). The Area Plan must be adequate to deter a transportation security incident in or near the area to the maximum extent practicable, and be updated every 5 years. See id. The AMS Plan is primarily a communication and coordination document that includes: 1. Details of operational and physical measures that must be in place at all MARSEC 8 levels; 2. Communications procedures; 3. Measures to ensure the security of non-regulated vessels, facilities, and operations; 4. Periodic review, audit and updating procedures; 5. Measures to ensure the security of AMS Plan information; and 6. Procedures for reporting security incidents. See 33 C.F.R. 103.505. Area Maritime Security Committee and Assessments The COTP works closely with the local Area Maritime Security ( AMS ) Committee 9 to prepare the Area Plan. The first step in developing an AMS Plan involves an AMS Assessment, which is performed by the AMS Committee or its designee. See 33 C.F.R. 103.300 103.400. Responsibilities of the AMS Committee include: 1. Identifying critical port infrastructure and operations; 2. Identifying risks; 3. Determining mitigation strategies and implementation methods; 4. Developing and describing the process to continually evaluate overall port security; and 5. Advising and assisting the COTP in developing the Area Plan. See 33 C.F.R. 103.310(a). During preparation of the AMS Assessment, the AMS Committee must consider any areas that may, if damaged, pose a risk to people, infrastructure or operations within the port, including: 1. Physical security of the infrastructure and operations at the port; 2. Structures considered critical for the continued operation of the port; 3. Existing security systems and equipment available to protect maritime personnel; 4. Procedural policies; 8 The Coast Guard will communicate heightened levels of alert using MARSEC levels 1, 2, and 3 that align with the now all-toofamiliar graduated color-coded threat condition levels defined by the Homeland Security Advisory System ( HSAS ). MARSEC is the maritime sector s tool for communicating risk and in most cases will be linked to the HSAS. See 68 Fed. Reg. 39,240 (2003). 9 Each AMS Committee must have at least 7 members, each having at least 5 years of experience related to port or maritime security operations. See 33 C.F.R. 103.305. Members may be selected from Federal, State, or local government and stakeholders. See id. SEPTEMBER 2003

Homeland Security Bulletin 5. Radio and telecommunication systems, including computer systems and networks; 6. Relevant transportation infrastructure; 7. Utilities; and 8. Security resources and capabilities. See 33 C.F.R. 103.405(b). AMS Assessments may be performed by a third party approved by the AMS Committee. See 33 C.F.R. 103.400(b). The information gathered during the AMS Assessment will be used by the COTP to develop the AMS Plan. See 33 C.F.R. 103.500(a). The AMS Committee must prepare a written report of its findings upon completion of the Assessment. The report must detail (1) how the AMS Assessment was conducted, (2) all vulnerabilities and consequences found during the AMS Assessment, and 3) riskreducing strategies that could be used to ensure continued operation at an acceptable risk level. See 33 C.F.R. 103.400(c). Exercises and Recordkeeping The COTP and AMS Committee will conduct periodic exercises to test the effectiveness of the Area Plan. See 33 C.F.R. 103.515. Exercise documentation will be kept for 2 years. All records relating to the AMS Assessment or Area Plan will be kept for 5 years. See 33 C.F.R. 103.520. Penalties No specific civil and criminal penalties are identified in the interim rule in connection with noncompliance with the AMS Plan, although the Coast Guard may have the authority to order the performance of a specific action required by an AMS Plan to ensure port, harbor and coastal facility security. See generally the Magnuson Act, 50 U.S.C. 191 et seq.; the Ports and Waterways Safety Act, 33 U.S.C. 1221 et seq. 10 Should the Coast Guard attempt to use the Ports and Waterways Safety Act for enforcement, violations may result in civil penalties of up to $25,000 per violation and criminal penalties. See 33 U.S.C. 1232. In light of this possibility, it would behoove non-regulated facilities, such as port stakeholders, to participate actively in AMS Committee activities. Facility Security Facility Security Plan Before December 30, 2003, owners or operators of regulated facilities must complete and submit FSPs to the Coast Guard for review and approval. See Facility Security, 68 Fed. Reg. 39,315, 39,323 (2003) (to be codified at 33 C.F.R. 105.115). The FSP is the plan developed to ensure the application of security measures designed to protect the facility and its servicing vessels or those vessels interfacing with the facility, their cargoes, and persons on board at the respective MARSEC levels. 33 C.F.R. 101.105. 10 Port and Waterways Safety Act regulations state that the Coast Guard, to prevent damage or destruction of any bridge or other structure on or in the navigable waters of the United States, or any land structure or shore area immediately adjacent to such waters, and to protect the navigable waters and the resources therein from harm resulting from vessel or structural damage, destruction, or loss, may [d]irect the handling, loading, unloading, storage, and movement (including the emergency removal, control and disposition) of explosives or other dangerous articles or substances, including oil or hazardous material as those terms are defined in 46 U.S.C. 2101 on any structure or shore area immediately adjacent to those waters.... 33 C.F.R. 160.109. 6 KIRKPATRICK & LOCKHART LLP HOMELAND SECURITY BULLETIN

FSPs must be consistent with the requirements of the National and Area Maritime Transportation Security Plans. See 46 U.S.C. 70103(c)(3)(A). FSPs may be submitted and approved to cover more than one facility where they share similarities in design and operations, and if authorized by the COTP. 33 C.F.R. 105.410. FSPs should align security measures with a national system of threat or MARSEC levels. 33 C.F.R. 101.200. Generally, FSPs must also: 1. Identify the qualified individuals charged with the responsibility of implementing the FSP; 2. Include provisions for (i) establishing and maintaining physical security, passenger cargo security, and personnel security, (ii) establishing and controlling access to secure areas of the vessel facility, (iii) procedural security policies, and (iv) communications and other systems; 3. Identify, and ensure by other means approved by the Coast Guard, the availability of security measures necessary to deter, to the maximum extent practicable, a transportation security incident or a substantial threat of such a security incident; 4. Describe training, periodic unannounced drills, and security actions to be effectuated under the FSP; 5. Be resubmitted for approval for each change to the vessel or facility that may substantially affect the security of the vessel or facility; and 6. Be updated at least every 5 years. 46 U.S.C. 70103(c)(3). Approved FSPs are valid for 5 years from the date of approval. See id. FSPs must be amended: (1) upon request by the COTP, (2) when changes in operations or procedures at the facility necessitate an amendment, or (3) upon a change in owner or operator. See 33 C.F.R. 105.415. FSPs must be audited annually by the anniversary of approval, and when there has been a change in ownership or operations or modifications to the facility involving emergency response procedures, physical structure changes, security measures or operations. See id. Audits completed as a result of modifications to the facility need only be limited to affected sections. See id. If an audit results in a conclusion that an amendment is necessary, the FSO must submit to the COTP appropriate amendments for review and approval with a certification that the amendments satisfy the facility security rules. See id. Facility Security Officer ( FSO ) One of the first steps owners and operators must do to achieve compliance with MTSA is to designate an FSO. See 33 C.F.R. 105.200. The FSO is the person designated as responsible for the development, implementation, revision and maintenance of the facility security plan and for liaison with the COTP and other security officers. 33 C.F.R. 101.105. Facility owner or operators must designate, in writing, an FSO for each facility to assume compliance responsibility. See 33 C.F.R. 105.200. FSOs must have general knowledge, through training or equivalent job experience, on a range of issues such as security administration, relevant international laws, domestic regulations, current security threats and patterns, risk assessment methodology, inspections, control procedures and conducting audits. See 33 C.F.R. 105.205. The FSO is responsible for implementing the FSP, periodically auditing and updating the FSA and FSP, ensuring that adequate training is provided to facility personnel, and ensuring that the facility is operating SEPTEMBER 2003

Homeland Security Bulletin in accordance with the FSP and in continuous compliance with MTSA and its regulations. See id. The FSO may perform other duties within the organization, provided he or she is able to perform the function of an FSO. See 33 C.F.R. 105.205. FSOs may also serve more than one facility. However, the facilities must be in the same COTP zone and not more than 50 miles apart. See id. All other employees responsible for security duties must possess the requisite knowledge, through training or equivalent job experience, as appropriate, to implement the FSP. See 33 C.F.R. 105.210. Facility Security Assessment Production of an FSP begins with a Facility Security Assessment ( FSA ). The FSA is a written document that is based on the collection of background information, the completion of an onsite survey and analysis of that information. See 33 C.F.R. 105.300. Owners and operators of facilities are required to complete FSAs, but third-party assistance is acceptable with the FSO s blessing. See id. A common FSA may be conducted for more than one similar facility provided the FSA reflects any facility-specific requirements that are unique. See id. An on-scene survey must be conducted during the FSA process. See id. The FSA must consider and evaluate all vulnerabilities of the facility, such as access, existing facility procedures and policies, structural integrity of the facility, deficiencies, possible security threats, likely consequences of an attack, and access-restricted areas based on each MARSEC level. See id. A written report must be prepared upon completion of an FSA and must be made part of the written FSP. 11 See id. Facility Personnel Training All non-security employees or contractors including part-time, full-time, temporary, or permanent must have knowledge, through training or equivalent job experience, of the relevant provisions of the facility s FSP, MARSEC level requirements, recognition and detection of dangerous substances and devices, recognition of characteristics and behavioral patterns of persons who are likely to threaten security, and techniques used to circumvent security measures. See 33 C.F.R. 105.215. Exercises and Drills Regulated facilities are required to conduct training exercises at least once per calendar year, with no more than 18 months between exercises. See 33 C.F.R. 105.220. Exercises are a full test of the security program and must involve substantial and active participation by FSOs. Id. Exercises may include government authorities and vessels, and may be facility-specific, or part of a cooperative exercise program with applicable FSPs. See id. Drills, which are similar in scope to exercises, must be conducted at least every three months and test individual elements of the FSP. See id. 11 MTSA requires that documents related to security, especially security assessments and plans, be kept in a manner that is protected from unauthorized access or disclosure. See 46 U.S.C. 70103(d). The Coast Guard has designated security-related material in this interim rule as Sensitive Security Information ( SSI ) in accordance with 49 C.F.R. 1520. See 68 Fed. Reg. at 392,81. Information designated as SSI is generally exempt under the Freedom of Information Act. See 49 C.F.R. 1520. Although the statute does not expressly preempt State disclosure laws in direct conflict with 49 C.F.R. 1520, the Coast Guard believes that any such laws are preempted by 49 C.F.R. 1520. See 68 Fed. Reg. at 39,256. 8 KIRKPATRICK & LOCKHART LLP HOMELAND SECURITY BULLETIN

Waivers, Equivalents, and Alternative Security Programs Facility owners and operators may request the Coast Guard, in writing, for a waiver of any facility security requirement that is considered unnecessary in light of the nature or operating conditions of the facility, prior to operating. 33 C.F.R. 105.130. In addition, when seeking approval of its FSP, facility owners and operators may seek approval of an equivalent security measure to substitute for any specific facility security requirement. See 33 C.F.R. 105.135. Finally, an approved Alternative Security Program ( ASP ) may be used if the ASP is appropriate for the facility, implemented in its entirety, and a Facility Vulnerability and Security Measures Summary form is completed and submitted to the Coast Guard. See 33 C.F.R. 105.140. If an ASP is used, it must be comprehensive and based on a security assessment to demonstrate that it meets the intent of [the rule]. 68 Fed. Reg. 39,315, 39,317 (2003). The denial of a waiver is likely to constitute final agency action that is reviewable in federal district court, once all administrative appeals through the Coast Guard are exhausted. The Coast Guard will accept self-assessments or demonstration using any acceptable risk management tool to evaluate waivers, equivalents, and ASPs to show that the alternative is at least as effective as the rule. See id. Compliance and Recordkeeping As mentioned, owners or operators of regulated facilities must complete and submit their FSPs to the Coast Guard for review and approval on or before December 30, 2003. See 33 C.F.R. 105.115. By July 1, 2004, each facility owner or operator must be operating in compliance with MTSA s implementing regulations. See id. According to MTSA, facilities that are required to prepare and submit FSPs are prohibited from operating after one year from issuance of the interim final regulations unless: (1) its FSP has been approved by the Coast Guard, and (2) the facility is operating in compliance with its FSP. 46 U.S.C. 70103(c)(5). Plans that are deemed insufficient will be required to be amended. By July 1, 2004, facility owner and operators must produce one of the following to the Coast Guard upon request: 1. The approved FSP, including any revisions or amendments and a letter from the COTP approving the FSP dated within the past 5 years; 2. The FSP submitted for approval and an acknowledgement letter from the COTP stating that the Coast Guard is currently reviewing the FSP for approval, and that the facility may continue to operate so long as the facility remains in compliance with the submitted FSP; or 3. A copy of a Coast Guard-approved ASP and a letter signed by the facility owner or operator certifying that the ASP is in full compliance with its ASP. See 33 C.F.R. 105.120. In addition to the above, the facility must keep records in connection with the following for 2 years: 1. Training; 2. Drills and exercises; 3. Incidents and breaches of security; 4. Changes in MARSEC levels; 5. Maintenance, calibration, and testing of security equipment; SEPTEMBER 2003

Homeland Security Bulletin 6. Security threats; 7. Declarations of Security 12 ; and 8. The annual audit of the FSP. See 33 C.F.R. 105.225. The rule does not specify format and storage requirements for such records. Penalties Facilities that do not comply with MTSA may be subject to criminal penalties and civil penalties up to $25,000 per violation. Civil and criminal penalties for violations of control and compliance measures, including COTP orders and security zones, may be punishable under the Ports and Waterways Safety Act and the Magnuson Act. See 33 C.F.R. 101.415(a). 13 Civil penalties of up to $25,000 may also be assessed for non-compliance with any other requirement of MTSA, including those contained in MARSEC Directives. See 33 C.F.R. 101.415(b). 14 Finally, non-compliance may also result in : 1. Restrictions on facility access; 2. Conditions on facility operations; 3. Suspension of facility operations; 4. Lesser administrative or corrective measures; or 5. Suspension or revocation of security plan approval. See 33 C.F.R. 101.410(c). Compliance Inspections The Coast Guard will verify facility compliance through established inspection procedures already associated with: (1) Class 1 (explosive) materials or other dangerous cargoes regulated under 33 C.F.R. 126, (2) liquefied natural gas and liquefied hazardous gas regulated under 33 C.F.R. 127, and 3) oil and hazardous materials in bulk regulated under 33 C.F.R. 154. See 68 Fed. Reg. 39315, 39316 (2003). Right to Appeal Any facility owner or operator directly affected by a decision or action taken by the Coast Guard pursuant to MTSA may appeal. See 33 C.F.R. 101.420. Decisions made by the COTP may be appealed to the District Commander. See id. Decisions made by the District Commander or the Commanding Officer of the Marine Safety Center may be appealed to the Commandant (G-MP). See id. Decisions made by the Commandant (G-MP) are considered final agency action. 15 See id. Final agency action by the Commandant is subject to review by a U.S. district court. In light of the apparent broad scope of this new law, and the additional regulatory requirements and potential penalties associated with non-compliance, it is advisable for companies that are in, on, under or adjacent to any waters subject to the jurisdiction 12 A Declaration of Security ( DoS ) is an agreement executed between a responsible vessel and FSO that provides a means for ensuring that all shared security concerns are properly addressed and security will remain in place during the time the vessel is moored to the facility. See 33 C.F.R. 101.105. Only certain passenger vessels and vessels carrying certain dangerous cargoes, in bulk, will complete a DoS for every evolution regardless of the MARSEC level. See 33 C.F.R. 105.245. At MARSEC Levels 2 and 3, all vessels and facilities would need to complete a DoS. See id. 13 Criminal penalties require knowledge that one is violating the order, etc. See 33 U.S.C. 1232(b). 14 MTSA is silent on whether civil penalty assessments require knowledge of the violation. See 46 U.S.C. 70117. It is likely that the Coast Guard will assert that strict liability applies. 15 Arguably, a third party may challenge the issuance of a waiver, equivalent or approval of an alternative security plan as a final agency action, if it has standing to do so. 10 KIRKPATRICK & LOCKHART LLP HOMELAND SECURITY BULLETIN

of the United States to review the forthcoming rule and, if necessary, take the appropriate steps to achieve full compliance with its requirements. K&L s Homeland Security Practice includes attorneys with the experience and resources to assist clients in understanding and complying with this developing body of regulatory requirements. We presently represent a number of clients in the chemical, academic, water utilities, research institutions, and oil and natural gas transportation industries and are sensitive to the potential impacts of these new requirements on our clients activities. We can assist clients in commenting on proposed rules, counsel them on compliance with new regulations, and represent them before the agencies and in court when necessary to ensure that their views are heard or their interests are defended. For more information, please visit the Homeland Security Practice, Environmental and Natural Resources, and White Collar Criminal Defense areas on our website at www.kl.com. BARRY M. HARTMAN 202.778.9338 bhartman@kl.com CRAIG P. WILSON 717.231.4509 cwilson@kl.com JOHN A. ORLOWSKI 973.848.4037 jorlowski@kl.com For further information regarding this Homeland Security Bulletin, or our law firm s Homeland Security practice, please contact: Boston Jeffrey S. King 617.261.3179 jking@kl.com Dallas Julie E. Lennon 214.939.4920 jlennon@kl.com Harrisburg Craig P. Wilson 717.231.4509 cwilson@kl.com Los Angeles David P. Schack 310.552.5061 dschack@kl.com Miami Daniel A. Casey 305.539.3324 dcasey@kl.com Troy J. Rillo 305.539.3355 trillo@kl.com Newark William H. Hyatt 973.848.4045 whyatt@kl.com Brian S. Montag 973.848.4044 bmontag@kl.com New York Eva M. Ciko 212.536.3905 eciko@kl.com Pittsburgh Thomas J. Smith 412.355.6758 tsmith@kl.com Mark A. Rush 412.355.8333 mrush@kl.com San Francisco Robert J. Sherry 415.249.1032 rsherry@kl.com Washington Barry M. Hartman 202.778.9338 bhartman@kl.com Dick Thornburgh 202.778.9080 dthornburgh@kl.com Challenge us. www.kl.com BOSTON n DALLAS n HARRISBURG n LOS ANGELES n MIAMI n NEWARK n NEW YORK n PITTSBURGH n SAN FRANCISCO n WASHINGTON... SEPTEMBER 2003 This bulletin is for informational purposes and does not contain or convey legal advice. The information herein should not be used or relied upon in regard to any particular facts or circumstances without first consulting a lawyer. 2003 KIRKPATRICK & LOCKHART LLP. ALL RIGHTS RESERVED.

Homeland Security Bulletin 75 State Street Boston, Massachusetts 02109 TEL 617.261.3100 FAX 617.261.3175 2828 North Harwood Street Suite 1800 Dallas, Texas 75201 TEL 214.939.4900 FAX 214.939.4949 Payne Shoemaker Building 240 North Third Street Harrisburg, Pennsylvania 17101 TEL 717.231.4500 FAX 717.231.4501 10100 Santa Monica Boulevard Seventh Floor Los Angeles, California 90067 TEL 310.552.5000 FAX 310.552.5001 Miami Center - 20th Floor 201 South Biscayne Boulevard Miami, Florida 33131 TEL 305.539.3300 FAX 305.358.7095 The Legal Center One Riverfront Plaza, Seventh Floor Newark, New Jersey 07102 TEL 973.848.4000 FAX 973.848.4001 599 Lexington Avenue New York, New York 10022 TEL 212.536.3900 FAX 212.536.3901 Henry W. Oliver Building 535 Smithfield Street Pittsburgh, Pennsylvania 15222 TEL 412.355.6500 FAX 412.355.6501 Four Embarcadero Center, 10th Floor San Francisco, California 94111 TEL 415.249.1000 FAX 415.249.1001 1800 Massachusetts Avenue, N.W. Suite 200 Washington, D.C. 20036 TEL 202.778.9000 FAX 202.778.9100 www.kl.com Challenge us. 12 KIRKPATRICK & LOCKHART LLP HOMELAND SECURITY BULLETIN