Civil Aviation (Security) Regulations 2019

03 April 2019

The Civil Aviation (Security) Regulations 2019 (‘Security Regulations’), Civil Aviation (Amendment) Regulations 2019 (‘Amendment Regulations’) and Civil Aviation (Fees and Charges) (Amendment) Regulations 2019 (‘the Fees Amendment Regulations’) were gazetted on 29 March 2019.  All three pieces of subsidiary legislation came into operation on 30 March 2019.
 
The Security Regulations are to give effect to various recommendations contained in Annex 17 of the Convention on International Civil Aviation concluded at Chicago on 7 December 1944 (‘Chicago Convention’) which, amongst others, require each Contracting State (of which Malaysia is one) to –

• establish and implement a written national civil aviation security programme to safeguard civil aviation operations against acts of unlawful interference;
• designate an appropriate authority to be responsible to be responsible for the development, implementation and maintenance  of the national civil aviation security programme; and
• establish a national civil aviation security committee to coordinate security services between agencies of the State, airport and aircraft operators, air traffic service providers and other entities concerned with or responsible for the implementation of various aspects of the national civil aviation security programme. 

A.    The Security Regulations  

1. The Security Regulations establishes a National Civil Aviation Security Authority (‘the Security Authority’) which is to be responsible for safeguarding the civil aviation against any act of unlawful interference and for regulating the security of civil aviation in compliance with the provisions of Annex 17 to the Chicago Convention.

• unlawful seizure of aircraft; 
• destruction of aircraft in service;
• hostage taking on an aircraft or in aerodromes;
• forcible intrusion on board an aircraft, at an airport or on the premises of an aeronautical facility;
• introduction on board an aircraft or at an airport of a weapon or hazardous device or material for criminal purposes;
• use of an aircraft in service for the purpose of causing death, serious bodily injury, or serious damage to property or the environment; and
• communication of false information to jeopardise the safety of an aircraft, of a passenger crew, ground personnel or the general public, at an airport or in a civil aviation facility. 

2. The functions of the Security Authority include –

• establishing and reviewing civil aviation security policies; 
• monitoring the implementation of the Security Regulations;
• conducting a review of the National Security Programmes;
• approving a security programme and reviewing the same;
• defining and allocating tasks and co-ordinating civil aviation security activities between various entities;
• conducting a review on the level of threat to civil aviation;
• conducting regular security risk assessments for civil aviation security;
• re-evaluating security control and procedures on civil aviation security; and
• responding to meet any increased threat to civil aviation security.

3. The Security Regulations also establishes a National Civil Aviation Security Committee (‘the Committee’) whose functions include –

• advising the Security Authority on matters relating to the implementation of the Security Regulations; 
• facilitating the co-ordination of civil aviation security activities between various entities responsible for implementing the NCASP, as described in paragraph (4) below; and
• considering the recommendations made by the airport security committees in relation to the civil aviation security and, where appropriate, recommending to the Security Authority any change to the civil aviation security policies.

4. The Chief Executive Officer of the Civil Aviation Authority of Malaysia (‘CEO’) is charged with the responsibility for establishing and implementing the National Security Programmes, which shall include the following –

• the National Civil Aviation Security Programme (‘NCASP’) to safeguard the civil aviation operation against any act of unlawful interference; 
• the National Civil Aviation Security Training Programme (‘NCASTP’) to ensure that security awareness and function specific trainings are provided to all persons involved in or responsible for the implementation of the NCASP; and
• the National Civil Aviation Security Quality Control Programme (‘NQCP’) to determine the compliance with and validate the effectiveness of the NCASP. 

• impose an obligation on all operators, aerodrome operators, groundhandlers and other persons as may be determined by the CEO to comply with the National Security Programmes; and 
• require all Government Entities responsible for implementing the National Security Programmes to cooperate with and assist one another to ensure the proper implementation of the said programmes. 

5. The Security Regulations require an operator, aerodrome operator, a groundhandler or any other persons as determined by the CEO to establish a civil aviation security programme, a civil aviation security training programme and a civil aviation security quality control programme in accordance with the requirements of the NCASP, NCASTP and NQCP respectively, which is to be approved by the Security Authority. Such approval is to be renewed within such period as may be determined by the CEO. 

6. In addition, an aerodrome operator is required to establish a contingency plan (i.e. a proactive plan which includes measures and procedures to address various threat levels, risk assessments and associated security measures to be implemented and designed to anticipate, mitigate events and prepare all parties who have roles and responsibilities in the event of an actual act of unlawful interference) in accordance with the requirements of the NCASP which is to be approved by the Security Authority. 

7. An operator, aerodrome operator, a groundhandler or any other persons as determined by the CEO is required to comply with the approved security programmes. In addition, an aerodrome operator is also required to comply with its’ approved contingency plans. 

8. The CEO may, if he thinks necessary, vary any of the National Security Programmes and direct any person to vary any approved security programmes established by such person to be in accordance with the variations made to the National Security Programmes. 

9. The Security Authority may, if it thinks necessary, conduct a review of any approved security programme and direct the person who established the programme to vary the same. The Security Authority may also require a person who establishes any approved security programme to conduct a review of its programme.  

10. The Security Regulations require –

• an operator, aerodrome operator, groundhandler or any other person to use security equipment that is approved by the Security Authority; 
• a person who acts as a security screener to hold a certificate issued by the Security Authority;
• an operator, aerodrome operator, groundhandler or any other person responsible to provide a screening process to permit only a person holding a security screener certificate to act as a security screener;
• a security screener to conduct the relevant screening processes in accordance with the screening method and manner as may be determined by the CEO;
• an operator, aerodrome operator, groundhandler or any other person responsible to provide a screening process to ensure that a security screener complies with the method and manner of screening determined by the CEO;
• an aerodrome operator, with the approval of the CEO, to designate an area on the airside of an aerodrome to be a security restricted area (‘security restricted area’), that is a priority risk area where in addition to access control, other security controls are applied;

11. The Security Regulations –

• prohibit any person from entering a security restricted area or an aircraft in a security restricted area unless that person undergoes a screening process by a security screener; and 
• require an operator, aerodrome operator, groundhandler or any other person responsible to provide a screening process to ensure that the foregoing is complied with. 

12. The requirements in paragraph (11) above do not apply to –

• a transit passenger who remains on board an aircraft; 
• a transit passenger or transfer passenger who does not mix with an unscreened person from the transiting or transferring airport, as the case may be; and
• a transit passenger or transfer passenger who arrives from a Contracting State to the Chicago Convention where the security standards are recognised as being equivalent to the requirements as determined by the CEO;

13. The Security Regulations –

• prohibit a person from taking or causing to be taken on board an aircraft, or delivering or causing to be delivered for loading or carriage on an aircraft any baggage unless it undergoes a screening process by a security screener; and 
• require an aerodrome operator to ensure that the foregoing is complied with. 

14. The requirements in paragraph (13) above do not apply to any cabin baggage carried by a transit passenger or transfer passenger who satisfies the criteria set out in paragraph (12) above.

15. The Security Regulations –

• prohibit a person from taking or causing to be taken on board an aircraft, or delivering or causing to be delivered for loading or carriage on an aircraft any cargo or mail unless the cargo or mail undergoes a screening process by a security screener; and 
• prohibit a person from carrying or causing to be carried in a security restricted area or on board an aircraft within a security restricted area, any stores unless the stores undergo a screening process by a security screener.

16. The Security Regulations –

• prohibit a person from using or operating, or causing to be used or operated, a vehicle in a security restricted area unless the vehicle undergoes a screening process by a security screener; and 
• require an aerodrome operator to ensure that the foregoing is complied with.

17. The Security Regulations require an operator, aerodrome operator, groundhandler or any other person as may be determined by the CEO to appoint, with the prior approval of the Security Authority, a chief of security who is to perform the duties and responsibilities specified in the National Security Programmes.

18. The Security Regulations prohibit an operator from permitting, or causing to be permitted, any of its aircraft to fly for the purpose of commercial air transport unless the operator conducts a security search and checks on the aircraft in accordance with the NCASP. 

19. The Security Regulations prohibit a person from entering or being in a flight deck of any aircraft flying for the purposes of commercial air transport unless –

• that person is a crew on duty and authorised by the operator; 
• that person is, with the authority of the CEO, performing any regulatory functions under the Civil Aviation Act 1969 or for the purpose of the Civil Aviation Authority of Malaysia Act 2017; or
• that person is authorised by the CEO. 

20. An operator is required to ensure that –

• its aircraft is protected from any unauthorised interference from the time of the security search and checks referred to in paragraph (18) above is carried out until the departure of the aircraft; 
• its aircraft is kept under its supervision to prevent any unauthorised access of person or vehicle to or from the aircraft;
• no person other than the persons referred to in paragraph (19) above enters or be in a flight deck of any of its aircraft; and
• any item left behind in its aircraft by a passenger disembarking from any flight, including a transit flight, is removed from the aircraft. 

21. The Security Regulations require an operator to ensure that its civil aviation security programme contains measures and procedures for carrying of passengers in lawful custody of any law enforcement agency in accordance with the requirements in the NCASP.

22. The Security Regulations prohibit a person from conducting civil aviation security training as an instructor unless he holds a certificate issued by the Security Authority. 

23. The procedures for applying for any approval, certificate or authorisation required under the Security Regulations and any renewal, variation, suspension or revocation of any approval, certificate or authorisation are contained in regulations 29 to 32 of the Security Regulations. 
24. An approval, certificate or authorisation issued under the Security Regulations is non-transferable and non-assignable.

25. The Security Regulations –

• permit the Security Authority, the CEO and any authorised officer to give any direction to any person; and 
• require the person to whom any direction is given, to comply with the direction.

26. Parts A and B of the Schedule set out offences under the Security Regulations. 

27. A person who is convicted of an offence specified in Part A of the Schedule is liable –

1. if the person is an individual, to a fine not exceeding RM100,000 or to imprisonment for a term not exceeding three years or to both; or 
2. if the person is a company, limited liability partnership, firm, society or other body of persons, to a fine not exceeding RM200,000.

28. A person who is convicted of an offence specified in Part B of the Schedule is liable –

1. if the person is an individual, to a fine not exceeding RM200,000 or to imprisonment for a term not exceeding five years or to both; or 
2. if the person is a company, limited liability partnership, firm, society or other body of persons, to a fine not exceeding RM400,000.

B.    The Amendment Regulations

29. The Amendment Regulations deletes Part XXIV of the Civil Aviation Regulations 2016. Part XXIV comprises regulation 168 which charges the CEO with the responsibility for safeguarding civil aviation against acts of unlawful interference. In carrying out this responsibility, the CEO –

1. is required to comply with the provisions of Annex 17 of the Chicago Convention and the Security Manual for Safeguarding Civil Aviation against Acts of Unlawful Interference (a restricted document not accessible to the general public) issued by the International Civil Aviation Organisation (ICAO); 
2. is required to establish a National Civil Aviation Security Programme or any other security programme as the CEO thinks necessary, to be applied by an operator, aerodrome operator, air cargo agent or any other person; and
3. may from time to time issue a notice requiring any person to take the security measures specified in the notice for the purpose of safeguarding civil aviation against acts of unlawful interference.

30. The Amendment Regulations provides that -

1. the National Civil Aviation Security Programme or any other security programme established under Part XXIV before 30 March 2019 shall be deemed to have been established under the Security Regulations and continue to have effect until reviewed, varied or substituted under the Security Regulations; and 
2. any notice issued under Part XXIV before 30 March 2019 shall continue to have effect until amended or revoked.

31. In light of the saving provisions described in paragraph 29 above, all security programmes established and any directions issued under Part XXIV will remain in force until they are varied, amended or revoked, as the case may be.

C.    The Fees Amendment Regulations

32. The Fees Amendment Regulations sets out the fees payable in respect of the ten new categories of applications for approval, certificate and authorisation that are introduced under the Security Regulations.