PORT SECURITY : A REVIEW POST ISPS IMPLEMENTATION

The International Ship and Port Facility Code (ISPS) has been implemented with surprisingly few difficulties. It is worth recalling that IMO intended the development of ISPS to ensure the security of ships and port facilities as part of the risk management activity process. This would determine the appropriate security measures to be put in place to protect the maritime industry. The ISPS Code would provide a standardized, consistent framework for evaluating risk, enabling governments to offset changes in threat levels with changes in vulnerability for ships and port facilities.

An accurate evaluation of the success so far of the Code needs to take account of geographic areas, comparative data on incidents (including theft) and the changes in threat that continually occur. An overview suggests that progress is being made in security awareness worldwide and in the implementation of security measures in Africa, the Americas, Europe, the Far East and the Middle East. There are incidents involving potential threats to the industry occurring in all of these areas. Indeed piracy is likely to continue in South East Asia despite the decrease in numbers of incidents - perhaps as it always has over the centuries. The old trade routes like the Silk Route have become, and remain, routes for criminal activity. Terrorists and criminals still perceive transport as a soft target. Yet in reviewing port security in the light of implementation of the ISPS Code a benchmark might be to take the US Coast Guard overview that “substantial compliance” is in process. There are countries black listed as non compliant but this is a matter for governmental action and the necessary political and economic pressures to be put into effect.

Changes have occurred in the climate of risk. The continuing pattern of terrorist activity itself is demanding greater cooperation between governments. Security measures will always be reliant on a requirement for both intelligence and information. Much needs to be done in achieving greater cooperation in exchanging information in this area. As other industry comparisons show there is a direct correlation between the terrorist and criminal type activity. Against a background of global activity it appears there is little by way of isolated terrorist occurrences. Local groups may carry out the attacks but the initiative and planning in carrying out these activities is derived from linkages and knowledge sharing within an international network with a global agenda.

This is not a new phenomen. Using the British experiences of terrorism in the seventies and eighties the IRA, for example, helped nurture and develop the network that is extant now.

Basic security depends upon the effective use of people, equipment and procedures. Security is not practiced by specialists and responsibility for security rests jointly with management and employees. The introduction of the ISPS has been the trigger for greater awareness but it needs to be regarded as merely the first step in the creation of a security culture throughout the maritime industry. The code needs to foster a combined approach from both sides of the industry.

There have been anecdotal reports of ships and ports not acting together. Rightly seafarers expect to be treated with respect and there should be effective identity systems in place so that they may be allowed access and egress in foreign ports. In seeking to achieve the effective mix both sides need to reflect on the need for establishing the security requirements for the identification of people.

In Europe particularly the terrorist threat has raised the profile of immigration as an issue. For ports, to follow the lead set by airports this means a rigorous examination of the vetting procedure for individuals and then identity cards as well as a realization that there can be harmonization in procedures for allowing seafarers to step ashore. Sharing of best practice between countries is necessary to eradicate problem areas. A visit to Israel would demonstrate how the process of entry and exit affects all in the same manner and is detailed in it approach. The success of both the Code and any security enhancements will depend upon relationships – particularly the interface between ships and the port. This is at best a cooperative exchange between equal partners focusing on reducing risk. Thus it is essential the port does not treat those on board ship as suspects themselves. In return the identity and vetting of those concerned must be thorough as well as being a jointly agreed procedure.

Whilst it is the interface between ship and port facility that is covered by the requirements of the ISPS Code the reality is that the security of the port, its surrounding environment and its security compliance depend on a more holistic approach. The bigger, organized ports already have many of the security systems in place to prevent theft and these are transferable for anti-terrorist use. With the smaller ports and docking areas this is not often the case.

The holistic review is not merely about people and equipment but should include a thorough review of practical procedures. As indicated above this will depend upon the treatment of people, vehicles and cargo, through the implementation of access control and checking of identity. Not all countries have the resources of the US and it is refreshing to see the lead given by the US Coastguard in recognizing this state of affairs. The US has put in place procedures for biometric identification for those involved in commercial transport. In turn this is likely to become the standard for the Maritime industry. The US has recognized that, at this stage of implementation in countries, in the developing world have to find other ways around the problem if they do not have the financial resources or trading partners be they government or commercial.

Thus the checking of dockers, agents, drivers and visitors passing through a port in a developing country be more a time consuming labour intensive affair. But if the correct procedures are in place this will be no less effective.

But for the smaller ports, and certain ports in developed countries, in considering the risk, the start point is often the facility boundaries. The boundaries to the installation usually present a major cost issue. The size of a port estate is often such that fences need additional forms of supporting security systems provided by the use of lighting and regular patrolling. Yet the identification of risk, the adoption of simple security principles and the acceptance of the need to seek pragmatic solutions will usually overcome any problems to minimize such risk even in the developing world. In dealing with the security problems of the real estate a major multinational we had to tailor the security solution peculiar to the country. In the developing world this is usually a people and practical procedures based solution. In the developed world this will be probably be an equipment based solution. Nevertheless even here this will depend on the unit cost of equipment and, importantly, the after sales service of the suppliers of that equipment. It is a fact that a solution that works in Romania may not work in the Ukraine: similarly in South East Asia. What works in Singapore will not necessarily be the effective solution for the same problem in Indonesia.

The implementation of ISPS has highlighted the problem of the cost of putting into effect practical security measures. The introduction of new equipment takes time and new systems are being introduced all the time. Often there is a lack of security experience in countries to be able to offer sound advice. The introduction of activity sensors, ID cards, emergency alert systems, TV surveillance and scanning systems requires the involvement of the users in an effective training processes. To further assist managers the requirements for lighting, fences, signs and the writing of policy and procedures usually require the advice and assistance of those experienced in security. Within the maritime sector we have observed a shortage of personnel with security expertise and training. Albeit those involved in pursuing solutions have undoubted energy and enthusiasm to have their systems implemented effectively.

In any implementation program there is inevitably a requirement for an audit process. If not as the result of an incident, then an audit process needs to be put in place by all governments to ensure that the necessary requirements are being met. Insofar as security training is concerned, both for awareness and specific courses, this should flush out any poor standards that have been adopted. To write an effective security plan, based upon a realistic security assessment there needs to be a greater security industry involvement with the maritime industry. Neither industry possesses sufficient experience and expertise in the other’s field. To resolve the terrorist problem there needs to be full and effective cooperation within both industries.

Within the security planning process after a certificate of compliance has been issued, as with any plan, there needs to be a program of testing and adjustment of the plan which takes place at least on an annual basis. In a similar way the assessment needs to be reviewed and revised at least on an annual basis. Internal as well as external audits are an necessary evil particularly in view of terrorist incidents involving transport. Should the terrorist decide that the internal transport of a country are hardened and therefore less attractive targets it is easy to see the target profile of the maritime industry being raised.

Best practice organizations demonstrate that security is everybody’s responsibility. It can only be this way given that effective analysis it is the putting together of the pieces of the information jigsaw which lead to the prevention of terrorist acts. But individuals only contribute to this observation process if they have been trained and made aware that they have an effective role to play. For the organization this is also beneficial since besides equipping members with the appropriate knowledge it can build up loyalty for that organization. Putting in place the basic training for the nominated person responsible for security will at least start the process. The organization should be prompted to review the risk in terms of people, procedures and equipment and as a result provide a more effective process and effective security program.

Maritime organisations need to review their proposals for dealing with the threats posed against a background of what advice, assistance and physical help that is available. Many public services, particularly the police, give their advice and time freely. The Internet enables the individual to track down web sites that can provide and generate information to support that already given out by government.. It is also possible to establish a network of individuals/organizations who have similar problems and who may have resolved a such problems before.

This building up of a security culture is an ongoing process but it certainly has it’s rewards. To effect full implementation it is equally a part of the ISPS requirement.