The TSISE describes, among other things, the  information–sharing process. TSA is also specifically responsible for receiving, assessing, and  distributing intelligence information related to potential threats and  significant security concerns (rail security incidents) related to the nation’s  rail system. Specifically, in 2008, TSA issued a regulation requiring U.S.  rail systems to report all rail security incidents to TSA’s Transportation  Security Operations Center (TSOC), among other things. TSA’s Office of Security Operations (OSO) is responsible for overseeing  and enforcing the incident reporting requirement. TSA Has Developed Processes Designed to Integrate Stakeholder Feedback and Address Gaps in Trend Analysis

		TSA Has Developed a Process Designed to Incorporate Feedback on Security-Related Information

In June 2014, we found that TSA had some mechanisms in place to  collect stakeholder feedback on the products it disseminates containing  security-related information and had initiated efforts to improve how it  obtains customer feedback, but had not developed a systematic process  for collecting and integrating such feedback. TSA Efforts Should Help Address Gaps in Conducting Trend Analysis of Rail Security Incident Information

In December 2012, we found TSA had made limited use of the rail  security incident information it had collected from rail agencies, in part  because it did not have a systematic process for conducting trend  analysis. However, the incident information provided to rail agencies by  TSA was generally limited to descriptions of specific incidents with  minimal accompanying analysis. As a result, officials from passenger rail  agencies we spoke with generally found little value in TSA’s incident  reporting process, because it was unclear to them how, if at all, the  information was being used by TSA to identify trends or threats that could  help TSA and rail agencies develop appropriate security measures. TSA concurred with this recommendation and by August 2013 had  developed a new capability for identifying trends in the rail security  incident data, known as the Surface Compliance Trend Analysis Network  (SCAN). Although we have not assessed the effectiveness of these  efforts to better utilize rail security information, we believe these actions  address the intent of our recommendation. TSA Has Taken Steps to Improve Consistent Implementation of the Rail Security Incident Reporting Process

		TSA Has Taken Steps to Improve the Consistency of the Rail Security Incident Reporting Process

In December 2012, we found that TSA had not provided consistent  oversight of the implementation of the rail security reporting requirement,  which led to considerable variation in the types and number of passenger  rail security incidents reported. Specifically, we found that TSA  headquarters had not provided guidance to local TSA inspection officials,  the primary TSA points of contact for rail agencies, about the types of rail  security incidents that must be reported, a fact that contributed to  inconsistent interpretation of the regulation by local TSA inspection  officials. This variation we identified was compounded by inconsistencies in  compliance inspections and enforcement actions, in part because of  limited utilization of oversight mechanisms at the headquarters level. On the basis of these findings, in December 2012, we recommended that  TSA: (1) develop and disseminate written guidance for local TSA  inspection officials and rail agencies that clarifies the types of incidents  that should be reported to the TSOC and (2) enhance and utilize existing  oversight mechanisms at the headquarters level, as intended, to provide  management oversight of local compliance inspections and enforcement  actions. TSA concurred with both of these recommendations and has  taken actions to implement them. Specifically, in September 2013, TSA  disseminated written guidance to local TSA inspection officials and  passenger and freight rail agencies that provides clarification about the  requirements of the rail security incident reporting process. TSA Has Taken Steps to Improve the Accuracy and Completeness of Incident Data

In December 2012, we also found that TSA’s incident management data  system, known as WebEOC, had incomplete information, was prone to  data entry errors, and had other limitations that inhibited TSA’s ability to  search and extract basic information. On the basis of these findings, in December 2012 we recommended that  TSA (1) establish a process for updating WebEOC when incidents that  had not previously been reported are discovered through compliance  activities, and (2) develop guidance for TSOC officials that includes  definitions of data entry options to reduce errors resulting from data entry  problems. Specifically, in March 2013, TSA  established a process for the surface detailee position, discussed earlier  in this statement, to update WebEOC when previously unreported  incidents are discovered through compliance activities. Additionally, in  October 2014, TSA officials reported they have updated the guidance  used by TSOC officials responsible for entering incident data into  WebEOC to include definitions of incident types.
Why GAO Did This Study

The U.S. surface transportation system's size and importance to the country's safety, security, and economic well-being make it an attractive target for terrorists. Within the federal government, TSA–a component of the Department of Homeland Security–is the primary federal agency responsible for overseeing and enhancing the security of the surface transportation system. A key component of this responsibility is ensuring that security-related information is collected, analyzed, and shared effectively across all modes, including rail. In 2008, TSA issued a regulation requiring U.S. passenger rail agencies to report all potential threats and significant security concerns to TSA, among other things.
This testimony addresses the extent to which TSA has (1) developed systematic processes for integrating stakeholder feedback about security-related information it provides and analyzing trends in reported rail security incidents and (2) ensured consistent implementation of rail security incident reporting requirements. This statement is based on related GAO reports issued in June 2014 and December 2012, including selected updates on TSA's efforts to implement GAO's prior recommendations related to rail security and information sharing. For the selected updates, GAO reviewed related documentation, including tools TSA developed to provide oversight. GAO also interviewed TSA officials.

What GAO Found

In June 2014, GAO found that the Transportation Security Administration (TSA) did not have a systematic process for incorporating stakeholder feedback to improve security-related information sharing and recommended that TSA systematically document and incorporate stakeholder feedback. TSA concurred with this recommendation and, in April 2015, TSA developed a standard operating procedure to help ensure proper evaluation and consideration of all feedback TSA receives. In December 2012, GAO found TSA had made limited use of the rail security incident information it had collected from rail agencies, in part because it did not have a systematic process for conducting trend analysis. TSA's purpose for collecting this information was to allow TSA to "connect the dots" through trend analysis. However, the incident information provided to rail agencies by TSA was generally limited to descriptions of specific incidents. As a result, officials from passenger rail agencies GAO spoke with reported that they generally found little value in TSA's incident reporting requirement. On the basis of these findings, GAO recommended that TSA establish a systematic process for regularly conducting trend analysis of the rail security incident data. Although GAO has not assessed the effectiveness of TSA's efforts, by August 2013, TSA had developed a new analysis capability that, among other things, produces Trend Analysis Reports from the incident data.
In December 2012, GAO found that TSA had not provided consistent oversight of its rail security reporting requirement, which led to variation in the types and number of passenger rail security incidents reported. Specifically, GAO found that TSA headquarters had not provided guidance to local TSA inspection officials, the primary TSA points of contact for rail agencies, about the types of rail security incidents that must be reported, which contributed to inconsistent interpretation of the regulation. The variation in reporting was compounded by inconsistencies in compliance inspections and enforcement actions, in part because of limited utilization of oversight mechanisms at the headquarters level. GAO also found that TSA's incident management data system, WebEOC, had incomplete information, was prone to data entry errors, and had other limitations that inhibited TSA's ability to search and extract basic information. On the basis of these findings, GAO recommended that TSA (1) develop and disseminate written guidance on the types of incidents that should be reported, (2) enhance existing oversight mechanisms for compliance inspections and enforcement actions, (3) establish a process for updating WebEOC with previously unreported incidents, and (4) develop guidance to reduce data entry errors. TSA concurred with these recommendations and has taken actions to implement them. Specifically, in September 2013, TSA disseminated written guidance to local TSA inspection officials and passenger and freight rail agencies that provides clarification about the rail security incident reporting requirement. In August 2013, TSA enhanced existing oversight mechanisms by creating an inspection review mechanism, among other things. TSA also established a process for updating WebEOC in March 2013, and in October 2014, officials reported that they have updated the guidance used by officials responsible for entering incident data to reduce data entry errors associated with incident types. Although GAO has not assessed the effectiveness of these efforts, they address the intent of the recommendations.

What GAO Recommends

GAO is making no new recommendations in this statement.