Port Security: Regulation or Reformation?

What measures are being taken by the world’s ports and terminals to improve security?

Ever since the events of 9/11, supply chain security in general has been a hot topic, given the vulnerability of international trade to threats such as economic and political terrorism, not to mention smuggling and organised crime which is targeting logistics operators in ever more sophisticated ways.

Ports and terminals are perhaps the most vulnerable link in the supply chain from the security point of view. Making a site the size of a port totally secure is a challenging task, and there are many commercial pressures – such as the need for fast turnround of cargoes and to drive down costs – which conflict with the time-consuming checks and inspections required by security.

The commercial pressures under which ports and terminals operate used to mean that security was seen as an ‘optional extra’ – nice if you could afford it. But the seismic change that took place after 9/11 has pushed security very much to the fore, and ports and terminals today are under serious pressure from governments and other regulatory authorities to tighten security in all areas.

International Standard

One problem with ports and terminals is that they are all very different, with standards that vary considerably from one part of the world to another: what might be regarded as best security practice in China, might not be thought so in the USA; and establishing a common, recognised international standard for security is perhaps the greatest challenge.

Several countries and regions have developed initiatives on supply chain security, including ISPS (International Ship and Port Facility Security Code), C-TPAT (Customs-Trade Partnership Against Terrorism), TAPA (Transported Asset Protection Association) and EU AEO (Authorised Economic Operator). These have gone some way to improve security – and indeed the TT Club has noted a fall of around 30% in the number of incidents of pilferage and theft at ports since 2002 when ISPS was implemented. But there are still numerous examples of non-compliance, with many government-inspired regulations which port and terminal operators see as at best irrelevant, or at worst an onerous expense on their business. Operators are often unsure what they should choose to do and what benefits such regulations will bring, and become frustrated at the red tape involved.

Some regulations do indeed seem to be ill thought out. For example, the US Government’s ’24 hour rule’ – requiring Carriers and NVOCCs to submit a cargo declaration to the U.S. Customs 24 hours before cargo is loaded onto vessels with a port of call in the United States –  does not prevent cargo being misdeclared or tampered with once in transit for criminal or terrorist purposes.

Fundamental Reformation

There is a strong argument that regulation by itself is not the way forward, since this will only create a plethora of rules and regulations which will vary from region to region and which may or may not be complied with.  To achieve a truly secure environment, there needs to be a more fundamental reformation of the systems ports and terminals use, and in the mind-set of the people who operate those systems.

The new ISO standard 28000 - ‘Specification for Security Management Systems for the Supply Chain’ – which was released in September last year, sets out to provide what ISO terms a ‘high level management standard that enables an organisation to establish an overall supply chain security management system.’ In other words, it aims to provide a means of analysing the security implications of systems and practices currently in use, so that the operator can adapt the way things are done to meet security requirements. ISO 28000 has been developed along the same lines as ISO 9001 and ISO 14001 with the same ‘Plan-Do-Check-Act’ methodology, and is designed to be applicable to all operators in the supply chain, large or small.

The TT Club is actively encouraging its members to adopt ISO 28000. “ISO 28000 offers a systematic approach to security management that can both improve operational capabilities and increase confidence on the part of customers and regulators” says the TT Club in its booklet on the standard. “All businesses that are reliant on the supply chain for business continuity will benefit by adopting the sound management principles in ISO 28000.”

Practical Benefits

Peregrine Storrs-Fox, Risk Management Director at TT Club, believes there are practical benefits to be gained from adopting ISO 28000. “The standard has been designed to incorporate most of the requirements of the various security regulations and initiatives now in force, so by adopting ISO 28000, operators will automatically be complying with these regulations – it’s a sort of security one-stop-shop.” Indeed, a major port operator has already been able to satisfy the US Customs & Border Protection that it meets the requirements of C-TPAT through its ISO 28000 certification. The European Union’s AEO initiative also recognises the ISO standard as providing the requirements for the Safety & Security certificate.

Another point made by Storrs-Fox is that, in the longer term, being certified to ISO 28000 will give port operators a competitive advantage. “Customers will be far more inclined to use a port which they know is following best practice in security matters. It demonstrates to customers, business partners and employees a company’s commitment to effective security practices and the protection of their personnel, goods and assets”.

Justifying the Cost

But can ports justify the cost of implementing ISO 28000? One port operator that has already adopted the standard is DP World. Working with Hart Security, who were involved in the development of the standard, DP World last year became the first port operator to gain accreditation for the standard, at three of its terminals. The effort has been thoroughly worthwhile, according to DP World’s David Fairnie, and has even started to bring commercial benefits: “While we incurred costs to reach the certification, we have also realised savings. In our pilot project, the new security management practices encouraged more efficient use of resources to ensure security priorities were met. Savings could also extend to insurance premiums: the certification follows the same risk mitigation principles that the insurance industry use to calculate premiums.”

There can be no doubt that there will be an ever sharper focus on security issues in ports and terminals – and in the wider supply chain – in the next few years. TT Club believe it is both prudent and beneficial for operators to put their own houses in order before governments or regulators do – and before there is a major security incident at a port which could result in the imposition of even more restrictive security requirements by the authorities.  The adoption of ISO 28000 seems a relatively painless way of achieving this, and one which, on the evidence so far, makes commercial sense.