Federal and Industry Stakeholders Have Assessed Individual Elements of Risk, Which Have Informed TSA’s Security Strategy, but TSA Could Strengthen Its Approach by Conducting a Risk Assessment and Updating Its Security Strategy

Since 2004, federal and industry stakeholders have conducted assessments  of individual elements of risk—threat, vulnerability and consequence— and this information has informed TSA’s mass transit and passenger rail  security strategy. Additionally, TSA has gathered vulnerability data through such  programs as the Baseline Assessment for Security Enhancement (BASE). While TSA reported using these various assessments to inform its mass  transit and passenger rail security strategy, it could further strengthen its  approach for securing these systems by combining the results from these  assessments to conduct a risk assessment of the mass transit and  passenger rail systems. Completing a risk assessment would provide TSA greater assurance that it  is directing its resources toward mitigating the highest priority risks. For  example, TSA plans to introduce a performance measure for its BASE  review program. Federal and Industry Stakeholders Have Taken Key Actions to Strengthen Transit Security and Federal Actions Have Been Generally Consistent with TSA’s Strategy, but Opportunities Exist to Strengthen Some Programs

Since 2004, federal and industry stakeholders have implemented several  key actions to strengthen the security of the nation’s mass transit and  passenger rail systems and federal actions have generally been consistent  with TSA’s security strategy. However, TSA’s  security directives contained limited requirements for passenger rail, and  TSA has not enforced their implementation. TSA Reported Implementing Some 9/11 Commission Act Provisions for Mass Transit and Passenger Rail Security, but Implementing New Regulations May Pose Challenges for TSA and Industry Stakeholders

In March 2009, TSA reported that it had implemented some of the 9/11  Commission Act’s provisions related to mass transit and passenger rail  security. But the reports did not include a plan for addressing these  challenges or milestones for implementing several 9/11 Act Commission  provisions, as called for by project management best practices. However, until TSA  develops a plan with milestones, it will be difficult to provide reasonable  assurance that the provisions of the act are being developed and that a  strategy is in place for overcoming identified challenges. Additionally, these  12 agencies also reported concerns about the logistical feasibility of  implementing the training requirement. Recommendations for Executive Action

To help ensure that the Transportation Security Administration is  successfully prioritizing resources and collaborating with federal and  industry stakeholders in implementing actions to secure the mass transit  and passenger rail systems from acts of terrorism, and that its strategy is  consistent with the characteristics of a successful national strategy, we are  making six recommendations to the Assistant Secretary for the  Transportation Security Administration:    To help ensure that the federal strategy to secure the mass transit and  passenger rail systems considers assessment information within the  context of risk, TSA, as the sector-specific agency for mass transit and  passenger rail, should conduct a risk assessment that integrates all  three elements of risk—threat, vulnerability, and consequence. Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to: (1) determine the extent that federal  and industry stakeholders assessed or supported assessments of the  security risks to mass transit and passenger rail since 2004, and how, if at  all, TSA used risk assessment information to inform and update its  security strategy; (2) describe key actions, if any, that federal and industry  stakeholders implemented or initiated, since 2004, to strengthen the  security of mass transit and passenger rail systems, the extent to which  federal actions were consistent with TSA’s security strategy, and what  challenges, if any, TSA faces in implementing these actions; and (3)  describe TSA’s reported status in implementing provisions of the  Implementing Recommendations of the 9/11 Commission Act of 2007  related to mass transit and passenger rail security, and discuss challenges,  if any, TSA and the mass transit and passenger rail industry face in  implementing the actions required by the act. Moreover, to obtain information on industry  perspectives of potential challenges, we interviewed officials from 30 mass  transit and passenger rail systems and Amtrak as well as APTA. Homeland Security Advisory System

6.
Why GAO Did This Study

Terrorist incidents worldwide have highlighted the need for securing mass transit and passenger rail systems. The Department of Homeland Security's (DHS) Transportation Security Administration (TSA) is the primary federal entity responsible for securing these systems. GAO was asked to assess (1) the extent to which federal and industry stakeholders have assessed risks to these systems since 2004, and how TSA has used this information to inform its security strategy; (2) key actions federal and industry stakeholders have taken since 2004 and the extent to which federal actions are consistent with TSA's security strategy, and the challenges TSA faces in implementing them; and (3) TSA's reported status in implementing 9/11 Commission Act provisions for mass transit and passenger rail security. GAO reviewed documents including TSA's mass transit and passenger rail strategic plan, and interviewed federal officials and industry stakeholders from 30 systems and Amtrak--representing 75 percent of U.S. mass transit and passenger rail ridership.

What GAO Found

Since 2004, federal and industry stakeholders have conducted assessments of individual elements of risk--threat, vulnerability and consequence--for mass transit and passenger rail systems and this information has informed TSA's security strategy; however, TSA has not combined information from these three elements to conduct a risk assessment of these transportation systems. By completing a risk assessment, TSA would have reasonable assurance that it is directing its resources toward the highest priority needs. Further, while TSA's mass transit and passenger rail security strategy contains some information, such as goals and objectives, that is consistent with GAO's prior work on characteristics of a successful national strategy, it could be strengthened by including performance measures to help TSA track progress in securing these systems, among other things. Federal and industry stakeholders have taken several key actions to strengthen the security of mass transit and passenger rail systems since 2004, and while federal actions have been generally consistent with TSA's security strategy, TSA faces coordination challenges, and opportunities exist to strengthen some programs. TSA has deployed surface inspectors to assess industry security programs and worked with DHS to develop security technologies, among other actions. Mass transit and passenger rail systems, including Amtrak, also reported taking actions to increase security, such as implementing passenger and baggage screening programs. Although TSA has taken steps to enhance its efforts, it can further strengthen security programs by, for example, expanding its efforts to obtain and share security technology information with industry. By improving information sharing with industry, TSA can help to ensure that its and industry's limited resources are used more productively to secure mass transit and passenger rail systems. As of March 2009, TSA reported implementing some of the 9/11 Commission Act provisions related to securing mass transit and passenger rail such as developing a strategy for securing transportation, but had missed deadlines, for example, for issuing new regulatory requirements for mass-transit and passenger-rail employee security training. In addition, TSA's progress reports that track its implementation of 9/11 Act provisions lack milestones to guide this effort as called for by project management best practices. Additionally, in some cases, TSA progress reports identify challenges to meeting 9/11 Act provisions, but these reports do not include a plan for addressing these challenges. Until TSA develops a plan with milestones, it will be difficult for TSA to provide reasonable assurance that the act's provisions are being implemented and that a plan is in place for overcoming challenges that arise. Additionally, officials from almost half of the mass transit and passenger rail systems GAO visited reported concerns with the potential costs and the feasibility of implementing pending employee security training requirements.