Miami International Airport UNIVERSAL ACCESS SYSTEM (UAS) PILOT PROGRAM UPDATE BASIC CALL - JULY 09 th , 2009

1. Miami International AirportUNIVERSAL ACCESS SYSTEM (UAS)PILOT PROGRAM UPDATEBASIC CALL - JULY 09th, 2009

2. MIA – Basic Team Members Lauren Stover – Assistant Director/Security Rick Fernandez - Division Director/Security Maurice Jenkins – Manager/Information Systems Maria Pereiras – Supervisor/Security Operations MIA UAS - PRESENTERS: Carlos J. Garcia – Information Systems Ray Davalos – Maintenance / Building Controls Rita Raghunandan – Information Systems

3. UAS Project History • Origination • Participants • Scope • Guiding Principals • Testing • Process Flow Diagram • Data Retrieval & Upload to Access Control • Sample Screens • Challenges

4. Project Origination Tasked in 1993 by Congress and the Aviation Security Advisory Board to have a Universal Access System or somewhat of a Transportation Worker Identification Card (TWIC) system in place for flight crews accessing multiple airports with only one access media. An initial appropriation of $2M was given to FAA by Congress for this project. The mandate was to have a production system in place by year 2000 which integrates or interfaces with the airports / airlines existing access control system. FAA retained Volpe Center to develop the standards and conduct tests of UAS.

5. PARTICIPANTS Project Origin 1989-1993: Congress and ASAC (Aviation Security Advisory Committee), FAA (Linda Bruce – UAS Program Manager), DOT (Karl Shrum Chair of UAS Working Group) UAS Program Manager/Sponsor 1993: John Wojtowicz, Volpe National Transportation Center Testing & Integration: Thomas B. Smerczynski, MEI Technology Program Manager Airports: Miami International (MIA-Matrix) – John Hamill, Maurice Jenkins, Ray Davalos, Jorge Peña, Rita Raghunandan, Larry Niven Detroit (DTW - Thorn) – Jerry L. Clark Charlotte Douglas (CLT) Air Carriers: Delta Airlines (Ken Pope) NorthWest ( John Merrill) USAir (Roland Hepburn) Centralized Database: Atlanta Hartsfield, Delta Technology John Head, Martin Fisher

6. UAS Scope Flight crews from participating airlines would use their airline issued credential. Each airline would send their airlines badges to a centralized airport database (Atlanta Hartsfield, Delta) and data would be shared with participating airports. Goal was to send daily flight crew access information for only flight crews actually using destination airports. This was not achieved due to the volume and manual interventions required. Wound up sending entire credentials to airports (Approx: 50,000). Airports would integrate these “UAS” badges with their local access control systems. Badges flagged as “UAS” would gain access via pre-programmed selected doors. Process would require exchange of files from the Central Database to the participating airports with a predetermined set of frequencies: Monthly, Weekly, Daily & Exceptions. Establish Airline and Airport Standards, Guidelines, & Test Plans.

7. Guiding Principles - UAS Security is First: Ensure no unauthorized persons are in UAS database. Error on the side of denying access if there is any question. Provide consistent levels of automation to ease requirements for manual intervention. Be prepared to leverage TWIC when it becomes available.

8. TESTING • Original testing location was Atlanta with Delta Technology and a centralized Database managed by Delta security. Site acceptance testing was originally scheduled for Atlanta, but was conducted at MIA. • Testing at MIA started on 11/95 and completed on 9/3/1996. The test comprised of 3 phases. The layout of the card, the card readers, controllers and the interface with the existing ACS (Matrix). Each airline was assigned card reader doors next to their corresponding in-flight office location. These readers were coded to allow local as well as the UAS cards. • Environment: The type of card: ISO Banking standard track 2 magnetic high coercivity cards. • The reader firmware used the employer number (6,12,37) bits as an authorized facility code for the assigned card readers at MIA. This change allowed access using an employer# and employee ID number combination. • The employee vetting security check was done by each airline • SIDA Training was done by each airport

9. Process Flow Diagram

10. DATA Retrieval (PIR - Personal Identification Record) and Upload to Access Control Retrieval of data morphed from its inception in 1996. Starting with a modem and a VT220 emulation connection to Delta Atlanta UAS NCR386 UNIX server, to email attachments and overnight CD to direct SFTP in final form. Data Format: ASCII comma delimited . Each record consists of : Trans (A - Add; C – Change; D – Delete), employer# (6- Delta; 12- NW; 37-USAir), employee #, issue code, LastName, FirstName, Middle init, title, pin, expiration. “A”, 00006 0000375197 00 Rag RR J 000 0000 yymmdd

11. Sample UAS Records • Sample of a UAS record from the FTP file. • “A”, 00006, 0000339523, 00,”SAUNDERS”,”SHELLY”,”L”, 000,0000,091231 • (record is move to NFS share on the UNIX server with a file name uas.exp , the matrix customise script then grabs the record and update the database and the appropiate fields(see below). Please note that UAS PIR does not include the image of the badge holder. • MATRIX SCREENS:

12. MDAD/UAS ACS no/ Picture

13. MDAD UAS/ACS Sample Screen - General

14. MDAD UAS/ACS Sample Screen - Employment

15. MDAD UAS/ACS Sample Screen - Access

16. LOCAL MDAD/ACS w/ Picture

17. Retrieval of data due to volume and technology available at the time. Too much manual intervention and exceptions: lost badges; fired employees; 120 day inactive limit; extended leave (Medical, Maternity…) Constant validation of data. Manpower requirements were significant – required monthly reconciliation and validation between UAS file and MIA ACS. Significant coordination with local airline flight management. Concerns with updated information due to update delays often requiring special handling. Trust of security credential which would allow access to each airport, especially since each may have different criteria for vetting. Responsibility & liability of Central Database Management. Who is responsible for breach, Central Database or Airport using their data? Challenges

18. BASIC Comments or Questions Only! Thank you for your attention!