The Aviation and Transportation Security Act designated TSA as the primary federal agency responsible for security in all modes of transportation, which includes physical security and cybersecurity. Passenger rail operators, however, have the day to day responsibility for carrying out safety and security measures for their systems. Unlike the aviation environment, where TSA has operational responsibility for screening passengers and baggage for prohibited items prior to boarding a commercial aircraft, the agency has a limited operational role for securing mass transit (including rail). To secure passenger rail, TSA primarily partners with public and private transportation operators to address their security needs by conducting vulnerability assessments and sharing intelligence information and key practices, among other measures. The agency also engages with the passenger rail industry through associations, such as APTA and Association of American Railroads. Additionally, TSA is responsible for assessing the risk from terrorism and cyber threats to passenger rail, as well as other transportation modes. In addition to engaging with domestic passenger rail stakeholders, TSA’s Office of Policy, Plans, and Engagement is responsible for coordinating domestic and international multimodal transportation security polices, programs, directives, strategies, and initiatives, including conducting outreach to foreign stakeholders. TSA also engages with foreign stakeholders through TSARs. TSARs are primarily located in posts overseas and communicate with foreign government officials to address transportation security matters involving all modes of transportation, including aviation, rail, mass transit, highways, and pipelines. The TSAR role was originally created in response to the 1988 bombing of Pan Am Flight 103 over Lockerbie, Scotland, when the Aviation Security Improvement Act of 1990 was enacted, which provided that foreign security liaison officers were to serve as liaisons to foreign governments in carrying out U.S. government security requirements at specific airports. TSARs are responsible for ensuring the implementation of TSA’s requirements primarily as they relate to passenger and cargo air transportation departing the specific country en route to the United States. The primary focus of the role remains on aviation; however it has evolved over time to include maritime and land transportation. According to TSA, recent attacks overseas and online terrorist messaging point to public transportation systems, which include passenger rail systems, as continued high-value targets for terrorists. In general, passenger rail systems are open and designed to expedite the free flowing movement of large numbers of passengers through multiple stations. As such, these systems are inherently vulnerable to physical attacks (such as improvised explosive devices, active shooters, and chemical or biological attacks) due in part to factors such as high ridership, open access points, limited exit lanes, and fixed, publically available schedules. In addition, TSA has reported that risks increase in urban areas where multiple transportation systems and high volumes of travelers merge at intermodal stations. Transportation systems, including passenger rail systems, rely on technology and internet-connected devices to manage and secure certain business/enterprise functions, such as the operation’s website, communications, and reservations and ticketing mechanisms. They also increasingly rely on computer-networked systems for tracking, signals, and operational controls of transportation equipment and services. As dependence on these systems increases, so does risk to the system. Cyberattacks have the potential to significantly affect both business/enterprise systems and operational control systems. Business/Enterprise systems. Cybersecurity threats include ransomware, malware, phishing, and website attacks that may compromise sensitive information and affect an operator’s ability to communicate with passengers or engage in day-to-day business functions. Operational control systems. Cybersecurity threats, which may include malware or physical manipulation of a system, such as jamming signals or damaging equipment, include threats to the systems that control signaling and train speed. For example, attackers could attempt to access positive train control systems, a computer-based system designed to automatically slow or stop a train that is not being operated safely, to disrupt services. Unintentional cybersecurity threat sources may include failures in equipment or software due to aging or user errors, such as unintentionally inserting a flash drive infected with malware or clicking on a phishing email. Intentional cybersecurity threats may include corrupt employees, criminal groups, terrorists, and nations and may be used, for example, to achieve monetary gain, or for political or military purposes. Figure 1 shows examples of the types of physical and cyber threats passenger rail systems face. The NIPP outlines a risk management framework for critical infrastructure protection. In accordance with the Homeland Security Act of 2002, as amended, DHS created the NIPP in 2006 to guide the national effort to manage security risk to the nation’s critical infrastructure, including through coordination of agencies and 16 various critical infrastructure sectors, including transportation systems. Most recently updated in 2013, the NIPP uses a risk management framework as a planning methodology intended to inform how decision makers take actions to manage risk. The framework calls for public and private partners to conduct risk assessments. The NIPP defines risk as a function of three elements: threat, vulnerability, and consequence, as shown in Figure 2. Threat is an indication of the likelihood that a specific type of attack will be initiated against a specific target or class of targets. Vulnerability is the probability that a particular attempted attack will succeed against a particular target or class of targets. Consequence is the effect of a successful attack. In 2010, DHS, through TSA and the U.S. Coast Guard, developed the Transportation Systems Sector-Specific Plan to conform to requirements in the NIPP. Most recently updated in 2015, this plan describes shared goals, priorities, and activities to mitigate critical infrastructure risks, and acknowledges the increasing dependence of transportation companies on cyber systems for business, security, and operational functions. Regarding cybersecurity risks, DHS produced the Cybersecurity Strategy in 2018 to help execute its cybersecurity responsibilities during the next 5 years. In order to meet one of its objectives, DHS is to encourage the adoption of applicable cybersecurity best practices, including the NIST Framework for Improving Critical Infrastructure Cybersecurity (referred to as the NIST Cybersecurity Framework). The framework is a set of voluntary industry standards and best practices to help organizations manage security risks specific to cybersecurity. The framework consists of five functions: Identify, Protect, Detect, Respond, and Recover. When considered together, these functions provide a high-level view of an organization’s management of cybersecurity risk. NIST issued the framework in 2014 and updated it in April 2018. CISA, formerly DHS’s National Protection and Programs Directorate, manages the national effort to secure and protect against critical infrastructure risks, including cybersecurity risk, for all 16 critical infrastructure sectors, including transportation. CISA’s responsibilities include coordinating with sector-specific agencies to carry out its cybersecurity and critical infrastructure activities. According to TSA officials, TSA uses the TSSRA, the BASE, and threat assessments to assess risk elements for physical and cyber security in passenger rail. Such assessments may address different elements of risk—threat, vulnerability, or consequence—or the total risk for specific assets, such as airport perimeters and pipeline critical facilities. Table 1 below shows the type of risk element each assessment addresses, and whether the assessment addresses risks to intermodal stations or cybersecurity risk. TSSRA. TSA uses the TSSRA, a periodic risk assessment, to assess threat, vulnerability, and consequence for various attack scenarios across the five transportation modes for which TSA is responsible. The scenarios define a type of threat actor—including homegrown violent extremists and transnational extremists, such as Al Qaeda and its affiliates—a target, and an attack mode. For example, a scenario might assess the risk of attacks using varying types of weapons on passenger rail system assets. As part of the assessment process, TSA engages with subject matter experts from TSA and industry stakeholder representatives to compile vulnerabilities for each mode, and TSA analyzes both direct and indirect consequences of the various attack scenarios. According to TSA, the agency uses the TSSRA to provide strategic insights to inform the administration’s risk mitigation strategies, policy considerations, security countermeasures and programs, and resource allocation decisions. Our analysis of the TSSRAs issued during calendar years 2015 through 2017 indicates that TSA included intermodal station attack scenarios, but did not include cybersecurity scenarios. Specifically, the assessments featured various scenarios that targeted intermodal stations, which could include rail systems. For example, a scenario might describe attacks using various numbers of improvised explosive devices on an intermodal station. TSA did not include cybersecurity attack scenarios in the calendar year 2015, 2016, or 2017 assessments. According to the 2016 assessment and TSA officials we interviewed, threat experts have indicated that cyber threats, due to their unique nature and other factors, do not lend themselves to traditional TSSRA attack scenarios. However, as discussed below, the agency does conduct cyber threat assessments. Further, TSA’s Cybersecurity Roadmap 2018, states that, as one objective, the agency will include cybersecurity in its risk assessments for all modes. According to TSA officials, the implementation plan for the Roadmap, which was approved in September 2019, provides guidance and direction for meeting this objective. TSA officials confirmed that they plan to include basic cybersecurity scenarios for all modes in the 2020 TSSRA, and that they plan to engage with TSA mass transit experts and consult with industry experts as needed to inform future cyberattack scenarios. BASE. The BASE is a voluntary security assessment of national mass transit, passenger rail, and highway systems conducted by TSA surface transportation inspectors that addresses potential vulnerabilities, among other things. It consists of an assessment template with 17 security action items developed by TSA and the Federal Transit Administration that address, among other best practices, security training programs, risk information sharing, and cybersecurity. TSA developed this assessment in 2006 to increase domain awareness, enhance prevention and protection capabilities, and further response preparedness of passenger transit systems nationwide. The agency uses the BASE assessments to track progress in implementing specific security measures over time, offer technical assistance and share best practices to help improve the overall security posture of agencies, and inform transportation security grant funding by, among other things, identifying actions agencies have taken to reduce vulnerability. TSA officials stated that the most recent formal update to the assessment template began in 2014 and was fully implemented in 2015. The update included, among other changes, revised guidance for TSA surface inspectors and the addition of questions concerning active shooter events. In fiscal year 2016, the agency also developed a more targeted BASE assessment that focuses the assessment on an entity’s areas of concern as identified by surface inspectors in a previous BASE review of that operator. As of 2017, TSA had completed initial and follow-up assessments for the top 100 mass transit agencies in the country, which comprise approximately 80 percent of the ridership in the United States. TSA officials told us that their goal is to conduct follow-up assessments every one to three years. As previously shown in table 1, our analysis of the BASE template for mass transit and passenger rail indicates that it includes questions that address selected rail agency concerns about intermodal station security, and questions related to cybersecurity issues. Specifically, we found that while the template does not contain security action items or questions that directly refer to intermodal stations, questions in the template do correspond to topics that domestic rail agencies we interviewed identified as significant to intermodal station security, such as coordination among security forces, visible security measures, and establishing roles and responsibilities. For example, one BASE question asks if the agency’s system security plan has procedures or protocols for responding to security events with external agencies such as law enforcement or fire departments. This question corresponds to the challenge of coordination among security forces in intermodal stations identified by six of the seven agencies we interviewed. Cybersecurity is the focus of one of the security action items, which includes a series of general questions related to whether the transit agency has developed a comprehensive cybersecurity strategy. According to TSA officials, the agency added cybersecurity questions to the BASE in 2013 and the questions are intended to be a high level review. For example, the BASE addresses whether the transit agency has conducted a cybersecurity risk assessment, ensured employee training covers cybersecurity roles and threats, and established a protocol for reporting cyber incidents. It also provides a list of available cybersecurity resources for agencies to consult. Threat Assessments. TSA’s Intelligence and Analysis Office identifies security threats to mass transit and passenger rail systems through various threat assessments, including annual and semiannual Mass Transit and Passenger Rail Terrorism Threat Assessments and annual Cyber Modal Threat Assessments. TSA’s Mass Transit and Passenger Rail Terrorism Threat Assessment is produced annually and establishes the current mass transit passenger rail threat level and reviews terrorist threats against mass transit passenger rail for the past year. Threat information includes terrorist attacks on passenger rail trains, train tracks, buses, bus stops, and various stations. Additionally, the threat assessment analyzes intelligence gaps for the mass transit mode. TSA supplements the annual assessment with a semiannual threat assessment that reviews terrorist threats against mass transit and passenger rail for a 6-month period. Our analysis of threat assessments TSA issued for calendar years 2015 through 2019 indicates that they addressed stations, in general, and intermodal stations specifically, when they are the subject of an attack. For example, an attack on Manchester, England’s Victoria station, an intermodal station, was included in the 2018 Mass Transit and Passenger Rail Terrorism Threat Assessment. TSA’s Cyber Modal Threat Assessment reviews cyber threats to transportation over the course of the previous year, establishes cyber threat levels for the transportation modes for which TSA is responsible, and evaluates the threat through the next year or two. This annual assessment examines cyber threats to business and industrial control systems from state and non-state actors, including terrorist groups, pro-terrorist hacker groups, and hacktivists. Moreover, it analyzes incidents of cyberattacks and cyber espionage against U.S. and foreign transportation. Both assessments analyze threat actors and their capabilities, intent, and activities—including attacks occurring internationally—as well as tactics, techniques, and procedures that could be employed in future attacks. TSA calculates threat levels for transportation and cyber modes based on assessments of threat actor intent and capability. It may also issue additional situation-based products on emerging threats. TSA routinely shares these threat assessments with rail agencies and other stakeholders, such as industry security professionals. In addition to TSA’s risk assessment efforts, the agency coordinates with CISA, which conducts voluntary cybersecurity assessments as needed and requested by TSA and industry stakeholders. Specifically, CISA offers eight different voluntary cyber assessment options for public and private sector stakeholders, including mass transit and passenger rail agencies. Because CISA provides services to all 16 critical infrastructure sectors, including the transportation systems sector, officials noted that it must balance the resources it devotes to each sector. For example, CISA officials stated that they have conducted six Validated Architecture Design Review assessments on rail agencies since 2015, and currently have four pending requests from transportation agencies. The Validated Architecture Design Review evaluates systems, networks, and security services to determine if they are designed, built, and operated in a reliable and resilient manner. CISA officials also stated that they have conducted weekly vulnerability scans for one rail agency since 2015. While CISA coordinates with federal and private sector stakeholders to identify and address significant risks to critical infrastructure through its assessments, agency officials stated that they defer to TSA (as the co- sector specific agency for transportation) to take the lead in broader cyber initiatives and outreach to the transportation sector. For example, TSA officials stated that the agency included CISA in planning its cybersecurity workshops, a series of half-day workshops for surface transportation agencies to learn about cybersecurity resources from DHS and discuss nontechnical cybersecurity actions to improve their cybersecurity posture. According to TSA’s Cybersecurity Roadmap 2018, the agency plans to assess the resilience of the transportation modes to malicious cyber activity in conjunction with CISA, among other things. According to officials, TSA and CISA are collaborating or planning to collaborate on several cybersecurity assessments for passenger rail systems, including a cyber risk assessment for passenger rail cars and a cyber assessment of the mass transit and passenger rail mode. CISA officials told us that TSA, DHS’s Science and Technology Directorate, and CISA’s National Risk Management Center are in early phases of developing a cyber risk assessment for select passenger rail cars that they plan to produce in fiscal year 2020. CISA officials stated that they intend to address cyber vulnerability in the rail car assessments and plan to reach out to operators to discuss results. TSA officials told us that TSA and CISA also are considering a mass transit and passenger rail cyber assessment similar to one being developed for the pipeline mode. CISA officials stated that the planned pipeline assessment effort will include a total of 10 Validated Architecture Design Review assessments, in which TSA will help make arrangements with industry and will observe the process. TSA officials explained that expanding this effort to include passenger rail would depend on CISA’s availability to conduct assessments and balance demands in other sectors. CISA officials noted that they currently do not have the resources to support a similar plan for rail. TSA participates in APTA working groups that review and develop standards and recommended practices for passenger rail security, including those that apply to intermodal station security and cybersecurity. Specifically, from 2009 through 2019, APTA produced 45 documents related to security and emergency management standards and recommended practices, among other things. TSA is listed as a participant in 37 of the 45 documents. TSA officials noted that APTA working groups regularly review documents and issues related to security topics, including through monthly phone calls in some cases, and update them as needed. According to APTA’s Manual for the Standards Development Program, standards address safety-critical subjects and establish requirements that must be met by industry; recommended practices describe an established or generally recommended approach that does not rise to the level of a standard; and white papers are intended to provide information about complex issues that present the industry’s prevailing philosophy on the subject matter. For example: APTA offers a series of general standards, recommended practices, and white papers targeted at physical infrastructure protection at passenger facilities. These documents are not specifically directed at intermodal stations, but, according to our analysis and APTA officials, apply to such facilities as well as others. The documents address factors such as exterior door and window security, as well as securing mailrooms and utility openings, among other issues. Another APTA standard addresses security and emergency management considerations during planned special events, such as identifying transit hubs that are likely to be inundated with passengers going to and from the event. APTA offers cybersecurity recommended practices that are targeted at transit agencies in the early stages of starting a cybersecurity program, including how to obtain executive-level awareness and support and how to develop a cybersecurity awareness and training program. APTA also offers recommended practices for securing control and communications systems in transit environments, such as train control systems and fare collection systems. Table 2 provides additional examples of industry standards and key practice documents, as they relate to threats identified by domestic passenger rail stakeholders we interviewed. In addition to working with industry through APTA to develop standards and practices, TSA officials stated that the Surface Transportation Security Advisory Committee, which was established in 2019 to provide advice and recommendations to the TSA Administrator on transportation security matters, may serve as a mechanism for discussing or recommending key practices as the Committee develops. Officials noted that the Committee, which includes industry and community groups, could serve as a source for identifying forward looking best practices for rail security. The Committee held initial meetings in July 2019, October 2019, and January 2020, and proposed establishing subcommittees on topics such as cybersecurity and insider threats. None of the seven domestic rail agencies we contacted identified any security areas in which they felt recommended practices were missing. Officials from five agencies specifically commented on the usefulness of APTA publications. Officials from three agencies however, noted that many transit and rail agencies are still in the early stages of starting a cybersecurity program and that cybersecurity recommended practices are generally targeted at those agencies, as compared to agencies that already have a more sophisticated approach to cybersecurity. Officials from one agency further noted that publications related to the more technical aspects of cybersecurity (such as industrial control systems) can become outdated quickly as industry outpaces the development of security standards. TSA, CISA, and passenger rail agency officials we interviewed identified the NIST Cybersecurity Framework as the primary key practices document they reference for cybersecurity. Domestic and foreign rail agency, and industry association officials, as well as academic experts we interviewed noted that the possibility or likelihood of a cyberattack causing physical damage or harm to rail passengers or infrastructure is unlikely and largely hypothetical at this time. Academic experts we interviewed pointed to an incident in Poland in 2008 as one of the few, if only, known incidents in which a cyber-related attack on rail resulted in physical harm. In this incident, according to news reports, a Polish teenager modified a television remote control so that it could be used to control signals and switch points in a local tram system. Four vehicles derailed and 12 people were injured in the incident. Several rail agency officials and stakeholders we spoke with noted that successfully hacking into train control systems would require a highly sophisticated knowledge of the system. Officials further noted that train systems are designed to fail to safe mode and stop a train in the event of an abnormal signal, and that train operators have the ability to take over controls and manually stop trains if necessary. Officials from three rail agencies, however, stated that as agencies continue to adopt new technologies and systems become more interconnected, the potential for a cyberattack increases. Additionally, CISA officials and officials from one rail agency stated that, despite the lack of many incidents to date, protecting control systems is critical given the potential catastrophic impact of a successful attack. According to TSA officials, TSA identifies foreign passenger rail security standards and key practices through engagement in multilateral groups and by leveraging bilateral relationships. Examples of multilateral groups include the International Working Group on Land Transport Security and the European Association of Railway Police Forces (RAILPOL). The working group, established in 2006, consists of 19 member states, including the United States. It is intended as a framework for members to openly share best practices, exchange information, and contribute to the development of surface transportation security initiatives. For example, TSA and members of the working group developed a searchable database of international surface transportation security measures (known as the SMARTbox) as a resource for surface transportation professionals to gain insights into security practices used by their peers. RAILPOL, founded in 2004, is an international association of government railway police organizations. It has 22 members, including TSA and the Amtrak Police Department. Information about intermodal stations and cybersecurity can be identified and exchanged through both of these mechanisms. For example, representatives from the United Kingdom delivered a presentation on securing intermodal stations at a 2016 working group meeting, and both working group and RAILPOL meetings have included cybersecurity discussions. Figure 3 provides an image of St. Pancras International Station in London, an intermodal station where international, local, and long distance trains converge with the London Underground. Regarding bilateral engagement, TSA identifies foreign rail security standards and practices through one-on-one relationships with other countries. TSA officials noted that their level of engagement with other countries can depend on a variety of factors, including how much the countries have in common regarding transportation systems and threats, and whether or not there are formal agreements in place that allow for regular, detailed information sharing. While some relationships are ongoing, officials stated that TSA interactions with other countries are often situational or transactional—countries may reach out either directly to TSA or through the TSAR for information about a specific issue, such as perimeter protection for surface transportation. For example: TSA holds biannual meetings with Transport Canada, the Canadian government department responsible for transportation policies and programs. Discussion topics from the meetings in 2017 and 2018 included Canadian efforts to develop passenger rail regulations, results from TSA derailment device testing, and opportunities for collaboration. According to TSA officials, TSARs in several countries have facilitated engagement with foreign surface transportation officials, including passenger rail officials. For example, officials stated that one TSAR facilitated the use of TSA’s Exercise Information System for an exercise on the metro system in a foreign city, as well as joint rail security training at TSA facilities in the United States. Officials further noted that another TSAR has taken initiative to facilitate quarterly meetings between foreign government and TSA surface transportation officials, including research and development and passenger rail officials. In addition to quarterly meetings facilitated by the TSAR, TSA officials stated that they are in regular contact with research and development officials in one country to share testing information, such as the results of derailment device testing and explosives testing on railcars, and to discuss security issues related to unmanned aircraft systems. TSA officials also reported that representatives attended an APTA- sponsored study trip to Brussels and London after the 2016 and 2017 rail attacks in those cities, in part, to observe lessons learned from the attacks. Foreign governments and international rail associations also produce a variety of passenger rail security standards and key practice documents. Table 3 below provides examples of these documents and the types of threats they address. TSA officials noted that while multilateral forums provide valuable opportunities to communicate with other countries about evolving threats, emerging security technologies, and potential key practices, interest in forums such as the International Working Group on Land Transport Security has been in decline. For example, while the working group charter calls for annual meetings and quarterly conference calls, the full group has not met since 2016. TSA and foreign government officials we spoke with stated that interest in the working group may be in decline due to factors such as retirements of key officials and lack of engagement from certain countries. These officials also noted that, as leaders in rail security, they typically provide more information about key practices to other countries in large forums than they receive. Additionally, TSA officials noted that other countries frequently used the working group- developed SMARTbox initially, but that use declined in recent years in part due to its location on the Homeland Security Information Network because users may find it difficult to navigate. Further, eight of the 10 domestic and foreign rail agencies we interviewed said they were either unfamiliar with the application or did not use it. For example, officials from one domestic agency said that there was little incentive to contribute and that they found informal networks to be more useful for sharing information. In contrast, TSA and other officials we spoke to stated that bilateral relationships with trusted partners with similar sophisticated rail operations may allow for more detailed exchanges of current and emerging key security practices. TSA has provided limited guidance to TSARs on engagement with foreign passenger rail stakeholders through the TSAR Toolkit (or handbook), which states that TSARs should engage with officials involved in multiple modes of transit, including rail; however, the primary focus of the document is engagement with aviation stakeholders. TSA further provides comprehensive and specific guidance for TSAR aviation engagement as part of its foreign airport assessments and air carrier inspections, but does not do so for surface transportation. As discussed above, according to TSA officials, some TSARs have taken the initiative to facilitate meetings and share testing and training information related to surface transportation, including passenger rail. Passenger rail officials we talked to in one country stated that these TSAR-led initiatives served as a valuable source of information and communication with TSA. In addition, one TSA official cited the value of discussing preliminary testing findings, as well as new guidelines on topics such as security in station designs, which address concerns about security in public spaces. These efforts, however, are dependent on the individual initiative of each TSAR and are not universal. For example, one TSAR we interviewed stated that TSA’s expectations and priorities for surface transportation engagement were unclear and, as a result, he focused almost exclusively on aviation. TSA officials stated that they have focused TSAR guidance on aviation engagement because of the agency’s regulatory role in this area, which, as discussed above, includes foreign airport assessments and air carrier inspections. In lieu of detailed guidance on surface transportation, officials noted they defer to the individual TSARs on how or whether to engage foreign surface transportation stakeholders. Officials emphasized this individual approach and stated that in some countries, TSAR engagement on passenger rail security issues may be limited by legal or cultural barriers. Because rail (unlike aviation) does not directly connect to the United States in most cases, officials noted that there may be less incentive for some host countries to engage. Further, some countries may not have a rail system, or may not be as advanced in rail security policies and procedures, and therefore may be less able to offer key practices. In November 2019, TSA officials noted that they were considering adding guidance for engaging with surface transportation officials and addressing intermodal concerns to TSAR Regional Operational Implementation Plans. According to officials, these plans provide targeted guidance to TSARs for engagement within their specific regions. As of February 2020, officials stated that draft plans for two regions (Western Hemisphere and Africa/Middle East) were under review at TSA. Officials further stated that these drafts, and drafts for the remaining regions currently in development, would include surface transportation-related guidance. TSA officials stated that they hoped to complete all regions’ plans by the end of calendar year 2020, but they did not provide documentation for us to verify that the final plans would contain surface transportation guidance for TSARs. The 2018 TSA Administrator’s Intent document includes a goal to promote security partnerships across surface transportation systems by, in part, identifying and communicating best practices and lessons learned to stakeholders and international partners. In addition, the NIPP states that officials should share actionable and relevant information across the critical infrastructure community to build awareness and enable risk informed decision making. The TSAR Toolkit further states that, even in locations without modal connections to the United States, there is still great value in establishing key points of contact who can share best practices or facilitate the exchange of information in the event of an emergency in modes of transit outside of aviation. As the primary overseas point of contact for security matters involving all modes of transportation, TSARs are responsible for developing bilateral relationships and facilitating information sharing with foreign stakeholders, among other things. Further leveraging formal or informal bilateral relationships could allow TSA to obtain additional passenger rail security information. While several TSARs have individually taken initiative with regard to rail, without additional guidance from TSA, there is no assurance that they will engage in these exchanges with modes outside of aviation. As a result, TSA is less likely to be fully aware of key passenger rail security practices in other countries, such as those listed in table 3 above, among others. Moreover, specific guidance will also provide TSARs with clear expectations for engaging with stakeholders, and provide TSA with greater assurance that they are engaging in a consistent manner. TSA’s new Regional Operational Implementation Plans provide an opportunity for TSA to more clearly incorporate targeted guidance to encourage TSAR outreach and information sharing in specific areas. Recent efforts by TSARs in several countries demonstrate practices, such as opening lines of regular communication on surface transportation, including passenger rail, which could be replicated in other countries. According to TSA officials and domestic rail stakeholders we interviewed, TSA uses various mechanisms such as the Transit Policing and Security Peer Advisory Group, monthly conference calls with rail stakeholders, and the annual APTA roundtable meeting to share and discuss a range of security information with stakeholders, including information about standards and key practices. These mechanisms provide opportunities to discuss issues related to intermodal stations and cybersecurity key practices. TSA also shares information about key practices with domestic stakeholders through voluntary TSA programs such as BASE, the Intermodal Security Training and Exercise Program, and the Visible Intermodal Prevention and Response program. TSA officials provided information about how they incorporate information from foreign threats and attacks into these programs. Specifically: TSA officials noted that TSA initially developed the BASE program around standards that were produced by APTA and other industry partners following the 2004 terrorist attacks on commuter trains in Madrid and the 2005 terrorist attacks on the London subway system. According to TSA officials, the APTA standards and recommended practices, which evolve based on threats and lessons learned, form the basis for the BASE assessment template. One way in which TSA helps communicates these standards and practices to agencies is through the questions in the template. Officials noted that lessons learned from foreign rail security incidents have been used to further support certain security concepts in the BASE, such as assessment questions related to whether agencies engage in public outreach for security awareness (e.g. “If You See Something, Say Something”) and report suspicious activity. TSA officials reported that they consider overseas and domestic attack methods and tactics when planning Intermodal Security Training and Exercise Program exercises to raise awareness of emerging tactics and threats. These exercises are intended to share best practices and lessons learned, among other things. Officials noted that they recently incorporated cyber, chemical, and vehicle- ramming attacks into the program’s objectives based on recent domestic and overseas incidents, and that they shared resources, information, and best practices for security solutions. For example, officials reported conducting two regional exercises that focused on chemical threat elements as the result of a 2017 plot in Australia. TSA further reported hosting a series of vehicle ramming program workshops in the wake of attacks in New York City and Europe. According to TSA officials, TSA has not made any recent changes to the Visible Intermodal Prevention and Response program directly as a result of lessons learned or key practices resulting from a foreign rail security incident; however, officials said they regularly integrate information about foreign incidents and threats when planning program deployments. Officials also noted that the majority of current deployments are for surface transportation, which includes rail. Regarding cybersecurity, TSA has shared information about cybersecurity key practices, including the NIST Cybersecurity Framework, through a series of regional cybersecurity Intermodal Security Training and Exercise Program workshops since 2017. These “5N5” workshops listed five nontechnical cybersecurity actions an agency could take in 5 days, including: (1) develop familiarity with the NIST Cybersecurity Framework; (2) implement a unique password change policy; (3) understand the latest phishing and spam trends and how to message awareness; (4) differentiate access control among staff; and (5) report cybersecurity incidents. Six of the seven domestic rail agencies we spoke with were generally satisfied with TSA’s efforts to share security and key practice information; however officials from two of these six agencies also expressed concerns about timeliness and quality of cybersecurity information provided by TSA. For example, officials from one agency stated that they received limited cybersecurity information from TSA and that the information they did receive was of limited use because it was targeted at agencies without a sophisticated cybersecurity program. An official from another agency noted that while there were opportunities to discuss cybersecurity, the information provided was often general in nature and there was limited time for discussion in certain mechanisms because of the large number of people involved. This official also noted that while the information TSA provides is valuable and there are mechanisms available to share information about a range topics, discussions are typically related to security incidents and threats, as opposed to key practices. TSA officials acknowledged that the agency’s cybersecurity efforts were still in the early stages. They further noted that the implementation plan for the 2018 Cybersecurity Roadmap, which, among things, calls for improving information sharing and partnering with stakeholders to promote the adoption of best practices and industry and/or international standards, was only recently signed in September 2019. In addition to TSA’s information sharing mechanisms, domestic rail agency officials we spoke to reported learning about foreign key practices through personal experience and direct engagement with foreign rail counterparts. For example, officials from two agencies we spoke to hosted visits from foreign rail officials to study security measures, among other things. Officials from one agency noted they provided information to Hong Kong through APTA on key practices for managing large protest crowds in an urban transit environment. Officials from another agency noted that they participate in international information sharing surveys and research to learn about cybersecurity practices by foreign rail operators, and sent representatives to an international mass transit training forum on the development of threat, vulnerability, and risk assessments. Domestic rail agencies also identified several changes they have made to their physical security systems as a result of key practices or lessons learned from foreign rail incidents. For example: increasing random patrols and high visibility deployments of security officers, changing security camera placement to better capture station exits, and increasing security awareness messaging to employees and passengers. Additionally, officials from one agency noted that they revised subway evacuation plans to direct people towards areas less vulnerable to an attack after reviewing lessons learned from recent vehicle-based attacks in Europe. With regard to cybersecurity, one domestic agency we spoke to noted that recent wide-spread global cyberattacks reinforced challenges they have securing legacy Information Technology systems against threats such as ransomware threats. As a result, the agency is focused on identifying expiring technologies and replacing those that can no longer be patched or updated. Officials from another agency noted that they have increased the number of firewalls they use to further segment and protect systems. Table 4 below provides information on mechanisms that can be used to identify and share rail security key practice information, as identified by TSA and domestic stakeholders. While TSA has taken initial steps to share cybersecurity key practices and other information with passenger rail stakeholders, the BASE assessment, does not fully reflect the updated cyber key practices presented in the NIST Cybersecurity Framework, nor does it include the framework in a list of available cyber resources. As discussed above, TSA uses the BASE assessment to share security best practices with transit agencies, among other things. Our review of the BASE cybersecurity questions in the template found that they cover selected activities associated with three of the five functions outlined in the framework– Identify, Protect, and Respond. For example, the BASE asks agencies if they ensure training reinforces cybersecurity roles and responsibilities, which corresponds to the awareness and training category of the NIST Protect function. However, the remaining two functions—Detect and Recover—are not represented in the BASE. According to the framework, when considered together, these functions provide a high-level, strategic view of the life cycle of an organization’s management of cybersecurity risk. TSA officials stated that they regularly review the BASE and noted that the questions are intended to reflect both industry key practices and agency policy; however, they also stated that the agency has not updated the BASE cybersecurity questions since NIST released its Cybersecurity Framework in 2014. In January 2020, officials responsible for the BASE acknowledged that the cybersecurity questions should be updated to reflect the framework. TSA officials also noted that they would want to align changes to the BASE cybersecurity questions with any new guidance or direction provided by the newly established Surface Transportation Security Advisory Committee. As of January 2020, the Committee is in its initial start-up phase, and has not yet provided any reports or recommendations or published a timeline or project plan. Further, because the framework functions organize basic cybersecurity activities at their highest level, incorporating elements of all five functions into the BASE template should not require additional guidance from the Committee. The 2015 TSA Transportation Systems Sector-Specific Plan states that encouraging the adoption of the NIST Cybersecurity Framework across all transportation modes supports the plan’s goal to manage the security risks to the physical, human, and cyber elements of critical transportation infrastructure. The plan also states that encouraging the adoption of the framework contributes to several of the NIPP’s calls to action related to sharing actionable and relevant information. TSA considers the framework a best practice document. By updating the BASE cybersecurity questions to align more closely with the core functions in the NIST Cybersecurity Framework, TSA could better assist passenger rail and other operators in identifying current key practices and improving their cybersecurity posture. As a result, transit operators would be more aware of cybersecurity vulnerabilities and better prepared to reduce the impact from a cybersecurity incident. In addition, this would create a more consistent cybersecurity approach from TSA, since the agency promotes the framework through other mechanisms, such as the series of cybersecurity workshops, as noted above. Recent physical and cyberattacks in U.S. cities and Europe demonstrate the evolving nature of the threats to passenger rail and highlight the importance of working with both domestic stakeholders and foreign rail security partners. As such, TSA actively engages with domestic passenger rail stakeholders, but could do more to engage with foreign stakeholders. TSARs stationed abroad are well positioned to further leverage bilateral relationships with foreign passenger rail stakeholders, and several TSARs have taken initiative to do so. However, TSA provides only limited guidance to TSARs on surface transportation engagement. Without specific guidance, there is no assurance that TSARs will engage in these exchanges with modes outside of aviation. TSA’s new Regional Operational Implementation Plans provide an opportunity to more clearly incorporate targeted guidance to encourage TSAR outreach and information sharing in specific areas. Additionally, such guidance will provide TSA with greater assurance that TSARs are engaging with foreign stakeholders in a consistent manner. TSA uses various mechanisms to share security standards and key practice information with rail stakeholders, including through BASE assessments. The cybersecurity questions in the BASE template, however, do not fully reflect two of the five core areas identified in the NIST Cybersecurity Framework. By updating the BASE cybersecurity questions to align more closely with current key practices such as the framework, TSA could better assist passenger rail and other operators in improving their cybersecurity posture. As a result, transit operators would be more aware of cybersecurity vulnerabilities and better prepared to reduce the impact from a cybersecurity incident. We are making two recommendations to TSA. The TSA Administrator should ensure that the TSAR Regional Operational Implementation Plans include guidance on how TSARs are to engage with foreign surface transportation stakeholders, including passenger rail stakeholders. (Recommendation 1) The TSA Administrator should update the BASE cybersecurity template to ensure it reflects cybersecurity key practices, including the Detect and Recover functions outlined in the NIST Cybersecurity Framework. (Recommendation 2) We provided a draft of this report to DHS for review and comment. DHS provided written comments, which are reprinted in appendix II, and also provided technical comments, which we incorporated as appropriate. DHS concurred with both recommendations and described actions TSA plans to take to address them. Specifically, to address recommendation 1, TSA plans to draft an Operational Implementation Plan, which will provide guidance to TSARs for engaging with foreign surface transportation stakeholders, including in passenger rail security. According to TSA, this plan will also serve as the outline for the development of Regional Operational Implementation Plans, which will help align resources worldwide. To address recommendation 2, TSA plans to update the BASE Cybersecurity Security Action Item section to ensure it reflects the NIST Cybersecurity Framework Detect and Recover functions. These actions, if fully implemented by TSA, should address the intent of both recommendations. We are sending copies of this report to the appropriate congressional committees and the acting Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact Triana McNeil at (202) 512-8777 or McNeilT@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributors to this report are listed in appendix III. We asked domestic and foreign passenger rail agencies and foreign passenger rail stakeholders we interviewed to identify some security related key practices or lessons learned that they employ, including, but not limited to, intermodal stations and cybersecurity. Table 5 below provides examples of common security practices both domestic and foreign officials identified; table 6 shows several additional key practices foreign rail stakeholders cited. These tables are not intended to be a comprehensive list, but provide examples of key security practices utilized by selected domestic and foreign rail agencies. Figure 4 below shows an example of a Project Servator poster displayed during an exercise at St. Pancras International Station in London. As noted in table 6 above, foreign passenger rail stakeholders cited Project Servator as a key rail security practice. In additional to the contact named above, Christopher Ferencik (Assistant Director), Sarah Turpin (Analyst in Charge), Chuck Bausell, Benjamin Crossley, Suzanne Kaasa, Tracey King, Ronald La Due Lake, William Reed, and Adam Vogt made key contributions to this report.
Recent physical and cyberattacks on rail systems in U.S. and foreign cities highlight the importance of strengthening and securing passenger rail systems around the world. TSA is the primary federal agency responsible for securing transportation in the United States. GAO was asked to review TSA's efforts to assess passenger rail risk, as well as its role in identifying and sharing security standards and key practices. This report addresses (1) TSA's efforts to assess risk; (2) the extent to which TSA works with U.S. and foreign passenger rail stakeholders to identify security standards and key practices; and (3) the extent to which TSA shares passenger rail security standards and key practices with stakeholders. GAO analyzed TSA risk assessments from fiscal years 2015 through 2019 and reviewed TSA program documents and guidance. GAO interviewed officials from TSA, and from seven domestic rail agencies, three foreign rail agencies, and two foreign government agencies. The results from these interviews are not generalizable but provide perspectives on topics in this review. The Transportation Security Administration (TSA) assesses passenger rail risks through the Transportation Sector Security Risk Assessment, the Baseline Assessment for Security Enhancement (BASE), and threat assessments. TSA uses the risk assessment to evaluate threat, vulnerability, and consequence for attack scenarios across various transportation modes. TSA surface inspectors use the baseline assessment, a voluntary security review for mass transit, passenger rail, and highway systems, to address potential vulnerabilities and share best practices, among other things. TSA works with U.S. stakeholders to identify security standards and key practices and identifies foreign standards and practices through multilateral and bilateral exchanges. However, TSA Representatives (TSARs), the primary overseas point of contact for transportation security matters, lack specific guidance on foreign rail stakeholder engagement. As a result, TSA is less likely to be fully aware of key practices in other countries, such as station security guidance. Specific guidance would provide TSARs with clear expectations and encourage more consistent engagement with foreign rail stakeholders. Public Awareness Campaign Canine Units Emphasize security awareness Detection of vapor from explosives TSA shares standards and key practices with stakeholders, including those related to cybersecurity, through various mechanisms including BASE reviews; however, this assessment does not fully reflect current industry cybersecurity standards and key practices. For example, it does not include any questions related to two of the five functions outlined in the National Institute of Standards and Technology's Cybersecurity Framework—specifically the Detect and Recover functions. Updating the BASE questions to align more closely with this framework would better assist passenger rail operators in identifying current key practices for detecting intrusion and recovering from incidents. GAO is making two recommendations: (1) that TSA update TSAR guidance to include engaging with foreign passenger rail stakeholders; and (2) that TSA update the BASE cybersecurity questions to ensure they reflect key practices. DHS concurred with both recommendations.