West Coast Federal Fixed Gear eLogbook

E-signature Evaluation

Business Context, Transaction Types and Volume

Ending overfishing and preventing it from occurring was the highest priority of the reauthorized Magnuson-Stevens Act of 2006 (MSRA), signed by President Bush in January 2007. In the MSRA Congress requires fishery managers to establish science-based, enforceable annual catch limits and accountability measures for all U.S. fisheries with a deadline for implementation of 2010 for all stocks currently subject to overfishing and 2011 for all others. The NMFS Northwest Region has seven or eight overfished stocks. Managment for protection of these overfished stocks is restricting the ability of the fleet to access full optimum yield sector allocations, and the ability to accurately track bycatch of overfished stocks is critical to allowing the fleet to maximize optimum yield.

The Pacific Fishery Management Council in the June 2008 meeting requested implementation of a logbook program for the 2009/10 groundfish fisheries. This logbook requirement would apply to fixed gear groundfish both limited and open access, in other words, all line boats and pot boats. Subsequent to this meeting the States involved declined to implement this logbook requirement, although they expressed support for the concept. As a result of the State's decisions NMFS will be implmenting a federal groundfish logbook. (All prior logbook programs on the West Coast were state programs.)

NMFS is not interested in developing a paper logbook program because the cycle time for getting data into play for management decisions is too long. (Current logbook data from other programs is available in fishery models approximately 1.5 years after the fishing events.)

There are approximately 500 vessels in the fisheries that will be covered by this program. The e-logbook conceptual design would have these vessels reporting daily when they fish. These vessels may fish for up to nine months per year, so transactions volumes could approach 500/day and 135,000/year.

Business Drivers

Near to real-time information on catch and bycatch is required as an element of National Standard 1 (NS1). In these groundfish fisheries an electronic logbook program provides the best mechanism for acquiring near real-time catch and bycatch information. Logbook record-keeping and reporting regulations require vessel operator signatures for accountability. An e-signature feature is required to make e-logbook reporting feasible.

By near real-time we mean an elapsed time of less than 48 hours from the completion of the vessel fishing activity (retrieving the fishing gear) to data analysis in the agencies catch and bycatch monitoring systems.

Business Risk in the Permit Context

Considerations of business risk may benefit from categorization according to FIPS 199 which provides a common framework for expressing information security concerns throughout the federal government. This system has a FIPS 199 security categorization as follows:

Low confidentiality requirements -- loss of confidentiality would be expected to have a limited adverse effect on organizational operations, assets, or individuals. A breach of confidentiality would damage our relationship with our constituency and could impact our ability to collect accurate data with which to manage fisheries. This could cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced. It could also expose us to litigation and professional disrepute.
Moderate integrity requirements -- among other things data from this system could be used to establish individual fishing quotas based on historical participation in a fishery. Individual fishing quotas have value, and it is critical to maintain access controls, change tracking, and auditability. The moderate level is specified to recognize that loss of integrity could result in significant financial harm to individuals.
Low availability requirements -- a temporary loss of availability would be expected to have a limited adverse effect. Transactions dependent on this data are not particularly time-sensitive, and business requirements could be met via manual methods during a temporary system outage.

NIST 800-30: Risk Management Guide for Information Technology Systems defines risk as a function of the likelihood of a given threat-source's exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization. The threat and vulnerability identification process that follows is based on NIST 800-30.

Users and functionality

The longline fleet has some technologically advanced vessels in the 65-70 foot range, but also some small vessels, perhaps as small as sixteen feet, fishing with rod and reel and potentially no technology aboard. The current conceptual design anticipates vessels hosting e-logbook software on a PC onboard the vessel and reporting as required (at the end of a day or trip) via email from the vessel, or alternatively, reporting by email from home after completion of a day-trip. (Combinations might be accommodated; perhaps capturing the data on a PC, saving it to portable media such as a memory stick, taking the memory stick home after the day-trip, and transmitting the file from home via email.)

Data sensitivity and security

Information collected pursuant to requirements of the MSA, including permit application information, is protected by its confidentiality provisions at § 402 and under its implementing regulations at 50 CFR Part 600 Subpart E, including NOAA Administrative Order (NAO) 216-100. Additional protections of the Privacy Act and FOIA apply to such data as well as those collected under the Halibut Act.

Mitigating controls

Perhaps the most significant mitigating control is that in commercial fisheries transactions, both parties to the transaction (typically the fisher and the fish processor) are permitted entities and each has some responsibility for accurate and complete record-keeping and reporting (for example, the fisher may be required to keep a logbook showing fishing efforts and catch, while the processor is required to report fish purchased). In these transactions it is typical for the parties to the transactions to have opposite and balancing interests (for example, when a fisher is selling fish to a processor, the fisher wants the amount paid to be high, while the processor wants the amount paid to be low). These multiple sources of information and counter-balanced incentives tend to make deception more difficult to initiate and sustain.

Another mitigating control is that under the authority of the Debt Collection Improvement Act (31 U.S.C. 7701), NMFS would collect Tax Identification Number information from individuals in order to issue, renew, or transfer fishing permits or to make nonpermit registrations.

These vessels are permitted to fish and therefore have a prior "trusted relationship" with NMFS. In many cases this prior relationship involves confirming vessel ownership with the US Coast Guard, verifying participation in prior fisheries through previously submitted state or federal fish tickets or logbooks, confirmation of business ownership, etc.

Threat and Vulnerability Identification

(see Categories of Harm and Impact Definitions)

Vulnerability	Threat-source	Threat Action	Category of Harm	Likelihood of Occurrence	Impact of Harm	E-signature Cost Benefit Assessment
System unavailability	Error, component failure, or act of God	Power failure, network failure, computer component failure, operator error, software failure, capacity constraint, etc.	Inconvenience, distress or damage to standing or reputation	Moderate: failures will happen, but competently managed systems typically have availability records of 99% or better	Low: for fishery management decision support typical availability is adequate. Even in the event of a systemic failure fishery management decision-making would continue and unavailability would be a short-term inconvenience. Smaller scale failures, for instance a failure that prevents reporting from one vessel, would be a minor inconvenience.	N.A. (E-signature has no effect, positive or negative, on this vulnerability)
System unavailability	Vandalism	Internet security exploit such as denial-of-service attack	Inconvenience, distress or damage to standing or reputation	Low: this is not an online Internet-exposed system and should have very low vulnerability to network-based exploits.	Low: even in the event of a systemic failure fishery management decision-making would continue and unavailability would be a short-term inconvenience	N.A.
System misuse	System administrator, operator, or N.A. other agency user	Abuse of insider knowledge and access for unauthorized use or release of information	Unauthorized release of sensitive information	Low: agency staff have significant incentives to behave appropriately and periodic training in ethics and computer security	Moderate: at worst, a release of personal or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with an expected serious adverse effect on organizational operations.	N.A.
"	"	"	Civil or criminal violations	Low: agency staff have significant incentives to behave appropriately and periodic training in ethics and computer security	Moderate: at worst, a risk of civil or criminal violations that may be subject to enforcement efforts	N.A.
Failure to report	Fisher	Fisher fails to report, either through negligence, or with intent to mislead fisheries managers and evade fisheries management control or enforcement actions	Harm to agency programs or public interests	Low: permitted fishers know the rules and understand the risks of non-compliance	Moderate: any individual trip report would be inconsequential in overall impact, but widespread and long-term failure to report may facilitate overfishing with significant damage to public interests	Benefit: failure to report would be detectable quickly, resulting in more responsive enforcement and potentially a higher rate of compliance. Also e-reporting and e-signature can be additional features of fishing activity management software, providing e-logbook reporting in a value-added context, potentially making compliance more attractive
"	"	"	Civil or criminal violations	Low: permitted fishers know the rules and understand the risks of non-compliance	Moderate: at worst, a risk of civil or criminal violations that may be subject to enforcement efforts	Benefit: failure to report would be detectable quickly, resulting in more responsive enforcement and potentially a higher rate of compliance. Also e-reporting and e-signature can be additional features of fishing activity management software, providing e-logbook reporting in a value-added context, potentially making compliance more attractive.
Under-reporting or misreporting catch	Fisher	Fisher under-reports or misreports, to mislead fisheries managers and evade fisheries management controls	Harm to agency programs or public interests	Low: permitted fishers know the rules and understand the risks of non-compliance	Low: any individual trip report with highly unlikely numbers would trigger data quality checks and would be corrected or disregarded. Credible individual trip reports, even if intentionally misreported, would be inconsequential in overall impact. Even a concerted long-term effort to misreport by any one fisher is likely to be either not creditable or inconsequential.	Benefit: e-reporting and e-signature can result in more immediate feedback for detectable errors, and more immediate feedback facilitates more accurate reporting
"	"	"	Civil or criminal violations	Low: permitted fishers know the rules and understand the risks of non-compliance	Moderate: at worst, a risk of civil or criminal violations that may be subject to enforcement efforts	Benefit: misreporting problems might be detected quickly, resulting in more responsive enforcement and potentially a higher rate of compliance.
Impersonation in e-logbook transactions	Common criminal/identity thief	Impersonation using stolen identity credentials, with fraudulent reporting of false data to incriminate or defame victim	Inconvenience, distress or damage to standing or reputation	Low: common criminals are unlikely to have subject-area expertise to discover an incrimination or defamation opportunity and there are probably easier attacks	Low: impersonated parties or agency staff would be likely to notice during dockside interview process and/or subsequent data review, and when detected, the impact could be effectively mitigated	No net cost or benefit: e-reporting and e-signature provide two layers of security controls (access controls on the vessel's computer, and access controls on the e-logbook software); the traditional paper logbook may have been laying about on the bridge with no security control. However, this may be balanced by the fact that it is easy to understand and mitigate the risk with the traditional paper logbook (the skipper will understand the risk and the potential solutions), while the risks associated with electronic solutions won't be well understood.
"	"	Impersonation using stolen identity credentials, for access to sensitive information	Unauthorized release of sensitive information	Low: successful identity theft could result in compromise of sensitive information from the victim's logbook records but an uninformed criminal would be unlikely to find or identify sensitive information	Low: probably the only information of value that is credibly at risk is catch location, timing, and gear, and the people with the means to take advantage of that unique information are already well placed to have that same knowledge or to acquire it by closely observing the victim's fishing activity. Also, the impact would be limited to the party whose identity has been stolen	No net cost or benefit: e-reporting and e-signature provide two layers of security controls (access controls on the vessel's computer, and access controls on the e-logbook software); the traditional paper logbook may have been laying about on the bridge with no security control. However, this may be balanced by the fact that it is easy to understand and mitigate the risk with the traditional paper logbook (the skipper will understand the risk and the potential solutions), while the risks associated with electronic solutions won't be well understood.
Impersonation in e-logbook transactions	Disgruntled industry employee	Impersonation using stolen identity credentials, with fraudulent reporting of false data to incriminate or defame victim	Inconvenience, distress or damage to standing or reputation	Low: opportunity will be limited because the e-logbook is onboard the vessel at sea and protected by two layers of security controls (access controls on the vessel's computer, and access controls on the e-logbook software); however, an employee might be more likely than others to have the means, motive, and opportunity	Low: impersonated parties or agency staff would be likely to notice during dockside interview process and/or subsequent data review, and when detected, the impact could be effectively mitigated	No net cost or benefit: vulnerability for an employee attack is not significantly different in electronic transactions than it is in paper transactions
"	"	Impersonation using stolen identity credentials, for access to sensitive information	Unauthorized release of sensitive information	Low: the employee who might possibly have the means and opportunity already has access to sensitive information and is unlikely to find anything more interesting in e-logbook data	Low: probably the only information of value that is credibly at risk is catch location, timing, and gear, and the disgruntled employee is likely to already have that information from personal observation. Also, the impact would be limited to the party whose identity has been stolen	No net cost or benefit: vulnerability for an employee attack is not significantly different in electronic transactions than it is in paper transactions
Impersonation in e-logbook transactions	Competitor	Impersonation using stolen identity credentials, with fraudulent reporting of false data to incriminate or defame victim	Inconvenience, distress or damage to standing or reputation	Low: a competitor might have a motive, but is unlikely to have means and opportunity	Low: impersonated parties or agency staff would be likely to notice during dockside interview No net cost or benefit: vulnerability for an employee attack is not significantly different in electronic transactions than it is in paper transactions process and subsequent data review, and when detected, the impact could be effectively mitigated	No net cost or benefit: e-reporting and e-signature provide two layers of security controls (access controls on the vessel's computer, and access controls on the e-logbook software); the traditional paper logbook may have been laying about on the bridge with no security control. However, this may be balanced by the fact that it is easy to understand and mitigate the risk with the traditional paper logbook (the skipper will understand the risk and the potential solutions), while the risks associated with electronic solutions won't be well understood.
"	"	Impersonation using stolen identity credentials, for access to sensitive information	Unauthorized release of sensitive information	Low: a competitor might have a motive, but is unlikely to have means and opportunity	Low: probably the only information of value that is credibly at risk is catch location, timing, and gear, and the people with the means to take advantage of that unique information are already well placed to have that same knowledge or to acquire it by closely observing the victim's fishing activity. Also, the impact would be limited to the party whose identity has been stolen	No net cost or benefit: e-reporting and e-signature provide two layers of security controls (access controls on the vessel's computer, and access controls on the e-logbook software); the traditional paper logbook may have been laying about on the bridge with no security control. However, this may be balanced by the fact that it is easy to understand and mitigate the risk with the traditional paper logbook (the skipper will understand the risk and the potential solutions), while the risks associated with electronic solutions won't be well understood.
"	Common criminal/identity thief or Disgruntled industry employee or Competitor	Impersonation using stolen identity credentials	Civil or criminal violations	Low: opportunity will be limited because the e-logbook is onboard the vessel at sea and protected by two layers of security controls (access controls on the vessel's computer, and access controls on the e-logbook software)	Moderate: at worst, a risk of civil or criminal violations that may be subject to enforcement efforts	Cost: criminal e-signature forgery, falsification or misrepresentation will provide new challenges for enforcement investigation and litigation
Repudiation to escape accountability	Customer (fisher)	Signer claims "I didn't sign that"	Inconvenience, distress or damage to standing or reputation	Low: in most cases a customer who repudiated an e-logbook document submission could then be prosecuted for fishing without following record-keeping and reporting requirements. There will generally be independent evidence of the fishing or processing activity (follow the fish.)	Low: agency might expend effort to resolve, but the distress would be limited and short-term	Cost: despite e-signature's legal standing and agency instructions, there is likely to be a tendency to regard a holographic signature as more significant or more binding. It is likely that the requirement to sign a filing with a holographic signature has more influence on the signer's behavior with respect to their consideration of what they are submitting, their commitment to reporting the truth, and their expectation of being held accountable. Persons signing with an e-signature are likely to understand that it would be difficult to prove what individual executed the e-signature (because credentials are transferable). This is likely to motivate some people to repudiate their e-signature if they are being held accountable for something signed with an e-signature.
"	"	"	Civil or criminal violations	Low: in most cases a customer who repudiated an e-logbook document submission could then be prosecuted for fishing without following record-keeping and reporting requirements. There will generally be independent evidence of the fishing or processing activity (follow the fish.)	Moderate: at worst, a risk of civil or criminal violations that may be subject to enforcement efforts	Cost: criminal e-signature forgery, falsification or misrepresentation will provide new challenges for enforcement investigation and litigation

E-signature Risk Mitigation

Risk Mitigation Analysis Worksheet (per procedural directive page 9)

Impact Categories	Significant Probability of Occurrence?	Impact Category	Assurance Level From Table B
Inconvenience, distress or damage to standing or reputation	No	Low	1
Financial loss or agency liability	N/A	N/A
Agency liability	N/A	N/A
Harm to agency programs or public interests	No	Moderate	3
Unauthorized release of sensitive information	No	Low	2
Personal Safety	N/A	N/A
Civil or criminal violations	No	Moderate	3

Appropriate OMB Assurance Level to Mitigate Business Risk

Lowest Assurance Level that Mitigates All Impact Categories	Mitigating Controls	Appropriate Assurance Level with Consideration of Mitigating Controls	Proposed E-signature Alternative
Level 3---...appropriate for transactions needing high confidence in the asserted identity's accuracy. People may use Level 3 credentials to access restricted web services without the need for additional identity assertion controls.	Multiple sources of information, some with counter-balancing incentives. Vessels reporting are permitted and have an ongoing "trusted relationship" with NMFS. E-reporting systems will detect failure to report more quickly, resulting in more responsive enforcement and potentially a higher rate of compliance. E-reporting and e-signature can result in more immediate feedback for detectable errors, and more immediate feedback facilitates more accurate reporting.	Level 2---On balance, confidence exists that the asserted identity is accurate. Level 2 credentials are appropriate for a wide range of business with the public where agencies require an initial identity assertion (the details of which are verified independently prior to any Federal action).	NPS-like