DHS Has Taken Steps to Assess Risk to Passenger Rail Systems, but Has Not Issued a Strategy for Securing the Transportation Sector

DHS has made progress in assessing the risks facing the U.S. passenger  rail system, but has not issued a plan based on those risk assessments for  securing the entire transportation sector and supporting plans for each  mode of transportation, including passenger rail. Further, we reported in September 2005 that TSA had not completed a  comprehensive risk assessment of the entire passenger rail system. More recently, in January 2007, TSA reported taking additional actions to  assess the risks facing the U.S. passenger rail system. We also reported in September 2005 that DHS was developing, but had not  yet completed, a framework intended to help TSA, OGT, and other federal  agencies work with their stakeholders to assess risk. Until TSA issues the TSSP and modal plans, the  agency lacks a clearly communicated strategy with goals and objectives  for securing the overall transportation sector, including passenger rail. Federal Agencies Have Taken Actions to Enhance Passenger Rail Security

In addition to ongoing initiatives to enhance passenger rail security  conducted by FTA and FRA before and after September 11, 2001, TSA  issued security directives to passenger rail operators after the March 2004  terrorist attacks on the rail system in Madrid. However, federal and rail  industry stakeholders have questioned the extent to which these directives  were based on industry best practices and expressed confusion about how  TSA would monitor compliance with the directives. For  example, TSA tested rail security technologies, developed training tools  for rail workers, and issued a proposed rule in December 2006 regarding  passenger and freight rail security, among other efforts. OGT has also  acted to help improve passenger rail security by, for example, providing  funding for security enhancements to rail transit agencies and Amtrak  through various grant programs. DHS and DOT have taken steps to better  coordinate their rail security roles and responsibilities. These annexes describe each agency’s roles  and responsibilities for passenger rail security. Conclusions

In conclusion, the rail attacks in Europe and Asia highlight the inherent  vulnerability of passenger rail and other surface transportation systems to  terrorist attack. Moreover, securing rail and other surface transportation  systems is a daunting task, requiring the federal government to develop  clear strategies that are based on an assessment of the risks to the security  of the systems, including goals and objectives, for strengthening the  security of these systems. We will continue to assess DHS and DOT’s efforts to secure the U.S.  passenger rail system during follow-on work to be initiated later this year.
Why GAO Did This Study

The four rail attacks in Europe and Asia since 2004, including the most recent in India, highlight the vulnerability of passenger rail and other surface transportation systems to terrorist attack and demonstrate the need for greater focus on securing these systems. This testimony is based primarily on GAO's September 2005 passenger rail security report and selected recent program updates. Specifically, it addressees (1) the extent to which the Department of Homeland Security (DHS) has assessed the risks facing the U.S. passenger rail system and developed a strategy based on risk assessments for securing all modes of transportation, including passenger rail, and (2) the actions that federal agencies have taken to enhance the security of the U.S. passenger rail system.

What GAO Found

The DHS Office of Grants and Training (OGT) and TSA have begun to assess the risks facing the U.S. passenger rail system. However, GAO reported in September 2005 that TSA had not completed a comprehensive risk assessment of passenger rail. GAO found that, until TSA does so, it may be limited in its ability to prioritize passenger rail assets and help guide security investments. GAO also reported that DHS had begun, but not yet completed, a framework to help agencies and the private sector develop a consistent approach for analyzing and comparing risks among and across critical sectors. Since that time, TSA has reported taking additional steps to assess the risks to the passenger rail system. However, as of March 2, 2007, TSA has not issued the required Transportation Sector Specific Plan and supporting plans for passenger rail and other surface transportation modes, based on risk assessments. Until TSA does so, it lacks a clearly communicated strategy with goals and objectives for securing the transportation sector, including passenger rail. After September 11, DOT initiated efforts to strengthen passenger rail security. TSA has also taken actions to strengthen rail security, including issuing security directives, testing security technologies, and issuing a proposed rule for passenger and freight rail security, among other efforts. However, federal and rail industry stakeholders have questioned the extent to which TSA's directives were based on industry best practices. OGT has also acted to help improve passenger rail security by, for example, providing funding for security enhancements to rail transit agencies and Amtrak through various grant programs. DHS and DOT have taken steps to better coordinate their respective rail security roles and responsibilities. In particular, DHS and DOT updated their memorandum of understanding to clarify their respective security roles and responsibilities for passenger rail.