Further, TSA completed a threat assessment for  mass transit and rail and has begun to identify critical rail assets, but it has  not yet completed an overall risk assessment for the passenger rail  industry. However, until all three  assessments of rail systems—threat, criticality, and vulnerability—have  been completed in sequence, and until TSA determines how to use the  results of these assessments to analyze and characterize risk (e.g., whether  high, medium, or low), it may not be possible to prioritize passenger rail  assets and guide investment decisions about protecting them. Because neither this element nor the framework as a whole has been  finalized or provided to TSA or other sector-specific agencies, it is not  clear what impact, if any, DHS’s framework may have on ongoing risk  assessments conducted by, and the methodologies used by, TSA, ODP, and  others, and whether or how DHS will be able to use these results to  compare risks and prioritize homeland security investments among  sectors. Rail industry stakeholders and federal agency officials raised  questions about how effectively DHS had collaborated with them on rail  security issues. These agencies undertook a number  of initiatives to enhance the security of passenger rail systems after  September 11. TSA Has Begun Testing Rail Security Technologies

In addition to issuing security directives, TSA also sought to enhance  passenger rail security by conducting research on technologies related to  screening passengers and checked baggage in the passenger rail  environment. U.S. and Foreign Rail Operators Have Taken Similar Actions to Secure Rail Systems, and Opportunities for Additional Domestic Security Actions May Exist

U.S. passenger rail operators have taken numerous actions to secure their  rail systems since the terrorist attacks of September 11, in the United  States, and the March 11, 2004, attacks in Madrid. For example, some assessments evaluated vulnerabilities of  physical assets, such as tunnels and bridges, throughout the passenger rail  system. For  example, 11 of the 13 operators we interviewed had implemented a  customer awareness program. Increased number and visibility of security personnel: Of the 32 U.S.  rail operators we interviewed, 23 had increased the number of security  personnel they utilized since September 11, to provide security throughout  their system or had taken steps to increase the visibility of their security  personnel. Three Foreign Rail Security Practices Are Not Currently Used in the United States

While many of the security practices we observed in foreign rail systems  are similar to those U.S. passenger rail operators are implementing, we  encountered three practices in other countries that were not currently in  use among the domestic passenger rail operators we contacted as of June  2005, nor were they performed by the U.S. government. Implementing these three practices—covert testing, random screening,  and a government-sponsored clearinghouse for technologies and best  practices—in the United States could pose political, legal, fiscal, and  cultural challenges because of the differences between the United States  and these foreign nations. The framework that DHS is  developing to help ensure that risks to all sectors can be analyzed and  compared in a consistent way needs to be completed and shared with TSA  and other sector-specific agencies. In our recently issued report on passenger rail security, we recommended,  among other things, that to help ensure that the federal government has  the information it needs to prioritize passenger rail assets based on risk,  and in order to evaluate, select, and implement commensurate measures  to help the nation’s passenger rail operators protect their systems against  acts of terrorism, TSA should establish a plan with timelines for  completing its methodology for conducting risk assessments and develop  security standards that reflect industry best practices and can be  measured and enforced, by using the federal rule-making process.
Why GAO Did This Study

The July 2005 bombing attacks on London's subway system dramatically highlighted the vulnerability of passenger rail systems worldwide to terrorist attacks, and the need for an increased focus on security for these systems. This testimony provides information on how the Department of Homeland Security (DHS), including the Transportation Security Administration (TSA) and the Office for Domestic Preparedness (ODP), have assessed risks posed by terrorism to the U.S. passenger rail system using risk management principles; actions federal agencies have taken to enhance the security of U.S. rail systems; and rail security practices implemented by domestic and selected foreign passenger rail operators and differences among these practices.

What GAO Found

Within DHS, ODP has completed numerous risk assessments of passenger rail systems around the country, and TSA has begun to conduct risk assessments as well as establish a methodology for determining how to analyze and characterize risks that have been identified. Until TSA completes these efforts, however, the agency will not be able to prioritize passenger rail assets and help guide security investment decisions. At the department level, DHS has begun developing, but has not yet completed, a framework to help agencies and the private sector develop a consistent approach for analyzing and comparing risks to transportation and other sectors. Until this framework is finalized and shared with stakeholders, it may not be possible to compare risks across different sectors, prioritize them, and allocate resources accordingly. In addition to the ongoing initiatives to enhance passenger rail security conducted by the Department of Transportation's (DOT) Federal Transit Administration and Federal Railroad Administration, such as providing security training to passenger rail operators, TSA issued emergency security directives in 2004 to domestic rail operators after terrorist attacks on the rail system in Madrid and piloted a test of explosive detection technology for use in passenger rail systems. However, federal and rail industry officials raised questions about the feasibility of implementing and complying with the security directives, citing limited opportunities to collaborate with TSA to ensure that industry best practices were incorporated. Domestic and foreign passenger rail operators we contacted have taken a range of actions to help secure their systems. Most, for example, had implemented customer awareness programs to encourage passengers to report suspicious activities, increased the number and visibility of their security personnel, upgraded security technology, and improved rail system design to enhance security. We also observed security practices among certain foreign passenger rail systems or their governments not currently used by the domestic rail operators we contacted, or by the U.S. government, which could be considered for use in the United States. For example, some foreign rail operators randomly screen passengers or utilize covert testing to help keep employees alert to security threats, and some foreign governments maintain centralized clearinghouses on rail security technologies. While introducing any of these security practices into the U.S. rail system may pose political, legal, fiscal, and cultural challenges, they may nevertheless warrant further examination.