	Background

As previously stated, TSA’s 2008 regulation requires passenger rail  agencies to report potential threats and significant security concerns to  the TSOC. This  variation is compounded by inconsistency in compliance inspections and  enforcement actions, due in part to limited utilization of oversight  mechanisms at the headquarters level. According to PARIS  data, from January 2011 through July 2012, Amtrak was inspected 145 times. To help fulfill TSA’s stated purpose for collecting rail security incident  information and improve the accuracy and completeness of the incident  data in TSA’s incident management system, WebEOC, we recommend  that the Administrator of TSA take the following three actions: establish a process for updating the database when incidents that had  not previously been reported are discovered through compliance  activities; develop guidance for TSOC officials that includes definitions of data  entry options to reduce errors resulting from data entry problems; and establish a systematic process for regularly conducting trend analysis  of the rail security incident data, in an effort to identify potential  security trends that could help the agency anticipate or prevent an  attack against passenger rail and develop recommended security  measures. TSA  plans to disseminate the guidance to passenger rail agencies. According to DHS, existing  oversight mechanisms include RSI-Ss, who serve as technical specialists,  oversee and implement transportation security policy and programs, and  conduct field office audits and visits, among other things. To what extent has TSA analyzed passenger rail security incident  information to identify security trends and potential threats against  passenger rail systems? To assess the extent to which TSA has overseen and enforced the rail  security reporting requirement, we interviewed officials from the selected  rail systems discussed earlier on how they have implemented this  requirement, including the guidance they have received from TSA on the  types of incidents to report to the TSOC.
Why GAO Did This Study

Terrorist attacks on foreign passenger rail systems, which include rail transit and intercity rail, have underscored the importance of collecting and analyzing security incident information to identify potential vulnerabilities. Within the federal government, TSA is the primary agency responsible for overseeing and enhancing passenger rail security, and has several programs to fulfill this responsibility. In 2008, TSA issued a regulation requiring U.S. passenger rail agencies to report all potential threats and significant security concerns to TSA, among other things. GAO was asked to assess the extent to which (1) TSA has overseen and enforced this reporting requirement and (2) TSA has analyzed passenger rail security incident information to identify security trends. GAO reviewed TSA policy documents, guidance, and incident data from January 2011 through June 2012, and interviewed federal officials and security officials from 19 passenger rail agencies. GAO selected these agencies, in part, because of their ridership volume. The results of these interviews are not generalizable but provide insights.

What GAO Found

GAO recommends, among other things, that TSA (1) develop guidance on the types of incidents that should be reported, (2) enhance existing oversight mechanisms for compliance inspections and enforcement actions, (3) develop guidance to reduce errors from data entry problems, and (4) establish a process for regularly conducting trend analysis of incident data. TSA concurred and is taking actions in response.