The long-awaited Repair Station Security rule is scheduled to be published in the Federal Register on Monday.
The rules are authorized under the repair station security statute (49 U.S.C. 44924). That statute barred the FAA from certifying any new foreign repair station until TSA security audits are completed for existing stations. Now that the rules are out, once TSA has audited all existing repair stations, the FAA may be able to once again start issuing foreign repair station certificates.
The final rule contains the following requirements:
- To Whom Does this Apply?: The regulations apply to repair stations certificated by the FAA under Part 145, except repair stations located on a U.S. or foreign government military base. All repair stations are subject to inspection as provided in the rule and to Security Directives should there be a security need. However, the rule text requires only certain repair stations, discussed below, to carry out security measures on a regular basis.
- TSA Inspection Authority. Repair stations must allow TSA and other authorized DHS officials to enter, conduct inspections, and view and copy records as needed to carry out TSA’s security-related statutory and regulatory responsibilities. For repair stations not required to carry out security measures on a regular basis (i.e., those repair stations not located on or adjacent to an airport), TSA does not intend to inspect such facilities, except (1) for compliance with security directives issued by TSA and with airport security programs required by TSA (for those repair stations that are included in an airport security program), and (2) to respond to security information provided to TSA by U.S. or foreign government entities.
- Implementation of Security Measures: The security measures in this rule cover repair stations that are on or adjacent to certain airports. TSA will consider a repair station to be “on airport” if it is on an air operations area (AOA) or security identification display area (SIDA) of an airport covered by an airport security program under 49 C.F.R. part 1542 in the United States, or on the security restricted area any commensurate airport outside the United States regulated by a government entity. TSA will consider a repair station to be adjacent to an airport if there is an access point between the repair station and the airport of sufficient size to allow the movement of large aircraft between the repair station and the area described as “on airport.”
- What are “Security Measures?”: Repair stations required to implement “security measures’ will be required to (1) designate a point of contact(s) to carry out specified responsibilities; (2) prevent the unauthorized operation of large aircraft capable of flight that are left unattended; (3) verify background information of those individuals who are designated as the TSA point(s) of contact; and (4) verify background information of those individuals who have access to any keys or other means used to prevent the unauthorized operation of large aircraft capable of flight that are left unattended.
- Security Directives: Repair stations are required to comply with Security Directives (SDs) issued by TSA. We had objected to Security Directives to the extent that they could represent rulemaking activities promulgated in the absence of notice and comment rulemaking procedures. TSA has added language to the final rule to clarify that repair stations may comment on SDs issued by TSA, but TSA has imposed on itself no obligation to respond to such comments. Thus, we remain concerned that Security Directives could be used to promulgate new rules in circumvention of the notice-and-comment requirements of the Administrative Procedures Act.
- Notification of Deficiencies; Suspension of Certificate and Review Process: The regulations describe the process whereby TSA will notify the repair station and the FAA of a security deficiency identified by TSA and provide an opportunity for the repair station to obtain review of a determination by TSA to suspend its operating certification. Such a suspension would be an immediately-effective suspension that would not be stayed through petition for review (note that 49 U.S.C. 44924(c) already requires the FAA to suspend or revoke a certificate upon the advice of TSA). This could give TSA tremendous power to impose interpretations of their standards that may be beyond the published scope of the rule, and the repair station may be largely powerless to seek review of those standards, because the only practical way to seek review is to be accept suspension during the entire period of the review process (TSA is allowed to grant itself an extension so the time limits on TSA action may be meaningless). TSA would perform an internal review of the petition for review and would create the record but then the matter would be subject to review by a Court of Appeals.
- Immediate Risk to Security; Revocation of Certificate and Review Process: The regulations specify that when TSA determines a repair station poses an immediate risk to security, TSA will notify the repair station and the FAA that the certificate must be revoked. The regulations also provide the process for the repair station to obtain review of such a determination. Many of the same concerns regarding suspension apply to the revocation process as well.
The new rule can be found online at http://origin.library.constantcontact.com/download/get/file/1102873717486-941/TSA+Security+Rule+Published.pdf.