NVIC 10-04: Handling sensitive security information guidance

NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 10 04 Commandant United States Coast Guard 2100 Second St. S.W. Washington, DC 20593 Staff Symbol: G-MPS-2 Phone: (202) 267-1448 COMDTPUB 16700.4 NVIC 10 04 AUG 20 2004 NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 10 04 Subj: GUIDELINES FOR HANDLING OF SENSITIVE SECURITY INFORMATION (SSI) Ref: (a) 46 USC 701 (b) 49 USC 114 (c) 49 CFR Part 1520 (d) Security Classification and Designation Policy for Port Security Assessments, Critical Infrastructure Listings, and Port Security Assessment Tools, Enclosure (2), COMDTINST 5510.5 (series) (NOTAL)

Guidelines for Handling of Sensitive Security Information (SSI), parts 1 and 2. — PURPOSE.

a. The purpose of this Circular is to provide guidance to field commanders and the maritime industry on the access, safeguarding, and disclosure of information, designated as Sensitive Security Information (SSI), as defined in 49 CFR Part 1520 (as amended). SSI is information that the Transportation Security Administration (TSA) has determined must be protected from improper disclosure in order to ensure transportation security. TSA has amended its SSI regulations to cover the security measures required by the Maritime Transportation Security Act (MTSA) of 2002 and exempts information related to maritime security from public disclosure under the Freedom of Information Act (FOIA). (See 69 Federal Register 28066, May 18, 2004 on the Worldwide Web at http://www.gpoaccess.gov/index.html). b. This circular does not apply to the access, maintenance, safeguarding, or disclosure of national security information, as defined by Executive Orders 12968 and 12958 (as amended). The examples of SSI in this guidance are not all-inclusive and may, in some instances, also contain classified information. The Classified Information Management Program, COMDTINST 5510.23 (series) should be referenced.

Guidelines for Handling of Sensitive Security Information (SSI), parts 1 and 2. — ACTION. Commanding Officers of Marine Safety Offices, Sector Commanders,

Captains of the Port (COTP), Commanding Officer Marine Safety Center, and maritime DISTRIBUTION -SDL No. 141 a b c d e f g h i j k l m n o p q r s t u v w x y z A B 2 10 1 1 132 1 1 30 C 1 D 1 1 1 1 E 1 F G H NON-STANDARD DISTRIBUTION stakeholders should utilize the guidelines in this circular when examining security programs required by 33 CFR, Subchapter H and whenever reviewing other records and information subject to 49 CFR Part 1520. The term Federal Maritime Security Coordinator (FMSC) is used to designate the COTP when implementing the provisions of 33 CFR Subchapter H. The Coast Guard will distribute this circular by electronic means only. It is available on the Worldwide Web at http://www.uscg.mil/hq/g- m/nvic/index.htm.

Guidelines for Handling of Sensitive Security Information (SSI), parts 1 and 2. — DIRECTIVES AFFECTED. None.

DIRECTIVES AFFECTED. None.

Guidelines for Handling of Sensitive Security Information (SSI), parts 1 and 2. — BACKGROUND.

a. SSI is a specific category of information that requires protection against disclosure. 49 U.S.C. 114(s) limits the disclosure of information obtained or developed in carrying out certain security or research and development activities to the extent that TSA and the Coast Guard have determined that disclosure of the information would: (1). be an unwarranted invasion of personal privacy; (2). reveal a trade secret, privileged, confidential commercial or financial information; (3). be a detriment to the safety and security of the Marine Transportation System (MTS). b. The information that falls within the scope of the statute is prescribed by TSA regulations in 49 CFR Part 1520. The purpose of the provision is to prevent unauthorized disclosure of information while being mindful of the legitimate interest and right to know transportation security information among certain segments of the public. Limiting access to this information is necessary to guard against disclosure to those who pose a threat to transportation security and lessen their ability to develop techniques to subvert security measures. c. Although subject to certain legal disclosure limitations, SSI is not classified national security information subject to the handling requirements for classified information. SSI handling procedures are laid out in enclosure (2).

Guidelines for Handling of Sensitive Security Information (SSI), parts 1 and 2. — DISCUSSION.

a. This circular provides guidance to field commanders and the maritime industry on how to control access to, maintain, and safeguard SSI information while implementing and enforcing the provisions of CFR Title 33, Subchapter H, pertaining to the establishment and implementation of Facility Security Plans (FSPs), Vessel Security Plans (VSPs), Alternative Security Plans (ASPs), Area Maritime Security (AMS) Plans, Security Incident Response Plans, and the National Maritime Transportation Security Plan. It applies to SSI information encountered in the implementation and enforcement of security programs including the International Port Security Program, High Interest Vessel Program, and the Positive Control Boarding Program. Additional SSI guidance may be found in reference (d). Based on the promulgation of the new TSA SSI regulation, a new SSI COMDINST will be forthcoming. b. Plans and programs that contain SSI necessitate the protection of the information. Guidance for handling security plans and programs, dissemination, and protection of SSI is provided in enclosures (1) through (3) of this circular. Enclosure (4) provides pertinent definitions relating to key terms. Enclosure (5) are sample non-disclosure statements. c. While the guidance contained in this document may assist the maritime industry, public, the Coast Guard, other Federal and state regulators in applying statutory and regulatory requirements, the guidance is not a substitute for applicable legal requirements, nor is it a regulation in itself; thus, it is not intended to, nor does it, impose legal requirements.

Guidelines for Handling of Sensitive Security Information (SSI), parts 1 and 2. — IMPLEMENTATION. Coast Guard field commanders and maritime stakeholders shall use

the guidance in this circular to assist them in the implementation and enforcement of the various maritime security regulations and programs.

Guidelines for Handling of Sensitive Security Information (SSI), parts 1 and 2. — ENFORCEMENT.

a. The goal of enforcement of SSI requirements is to ensure safeguarding of SSI. Educating Federal, State, local, and industry partners about the importance of compliance with the requirements is a necessary condition of any successful enforcement regime. Deterrence also plays an important part. Therefore, the Coast Guard should consider the entire scale of enforcement tools available when issuing enforcement measures, such as documenting an initial minor violation in a letter of warning, with subsequent violations documented in NOVs, or civil penalties. Action may include issuance of an order requiring retrieval of SSI. See 49 CFR §1520.17 b. An unauthorized disclosure of maritime sensitive security information and a failure to report an unauthorized disclosure to the cognizant COTP pursuant to 49 CFR §1520.9 by a covered person may jeopardize the security of the marine transportation system and result in a civil penalty up to $25,000 per violation. See 46 USC 70117.

Guidelines for Handling of Sensitive Security Information (SSI), parts 1 and 2. — FORMS/REPORTS. None.

T. H. GILMOUR Assistant Commandant for Marine Safety, Security and Environmental Protection Enclosures: (1) Examples of Sensitive Security Information (SSI) (2) Access to Sensitive Security Information (SSI) (3) Handling Sensitive Security Information (SSI) (4) Definitions (5) Non-disclosure Statement(s)