DHS Has Taken Steps to Assess Risk to Passenger Rail Systems, but Has Not Issued a Strategy for Securing the Transportation Sector

DHS has made progress in assessing the risks facing the U.S. passenger  rail system, but has not issued a plan based on those risk assessments for  securing the entire transportation sector and supporting plans for each  mode of transportation, including passenger rail. We reported that, until all three  assessments of passenger rail systems—threat, criticality, and  vulnerability—have been completed, and until TSA determined how to use  the results of these assessments to analyze and characterize the level of  risk (high, medium, or low), it will be difficult to prioritize passenger rail  assets and guide investment decisions about protecting them. We also reported in September 2005 that DHS was developing, but had not  yet completed, a framework intended to help TSA, OGT, and other federal  agencies work with their stakeholders to assess risk. Until TSA issues the TSSP and modal plans, the  agency lacks a clearly communicated strategy with goals and objectives  for securing the overall transportation sector, including passenger rail. Federal Agencies Have Taken Actions to Enhance Passenger Rail Security, Improve Federal Coordination, and Develop Industry Partnerships

In addition to ongoing initiatives to enhance passenger rail security  conducted by the FTA and FRA before and after September 11, 2001, TSA  issued security directives to passenger rail operators after the March 2004  terrorist attacks on the rail system in Madrid. However, federal and rail  industry stakeholders have questioned the extent that these directives  were based on industry best practices and expressed confusion about how  TSA would monitor compliance with the directives. For  example, TSA tested rail security technologies, developed training tools  for rail workers, and issued a proposed rule in December 2006 regarding  passenger and freight rail security, among other efforts. In addition, TSA established an Office  of Transportation Sector Network Management and offices for each mode  of transportation to develop security policies and partnerships with  industry stakeholders, including passenger rail and other surface modes. Further, in September 2006, FRA’s and TSA’s  roles and responsibilities for compliance inspections were outlined in an  annex to the existing memorandum of understanding between DHS and  DOT. TSA Has Reported Taking Additional Actions to Strengthen Passenger Rail  Security, Improve Coordination with DOT, and Develop Industry  Partnerships  In January 2007, TSA identified additional actions they had taken to  strengthen passenger rail security. Three Foreign Rail Security Practices Were Not Used in the United States

While many of the security practices we observed in foreign rail systems  are similar to those U.S. passenger rail operators are implementing, we  identified three foreign practices that were not currently in use among the  U.S. passenger rail operators we contacted as of September 2005, nor were  they performed by the U.S. government. Implementing covert testing, random screening, or a government- sponsored clearinghouse for technologies and best practices in the U.S.  could pose political, legal, fiscal, and cultural challenges because of the  differences between the U.S. and these foreign nations. Conclusions

In conclusion, Mr. Chairman, the 2005 London rail bombings and the 2006  rail attacks in Mumbai, India highlight the inherent vulnerability of  passenger rail and other surface transportation systems to terrorist attack. Moreover, securing rail and other surface transportation systems is a  daunting task, requiring that the federal government develop clear  strategies that are based on an assessment of the risks to the security of  the systems, including goals and objectives, for strengthening the security  of these systems. TSA has also taken  steps improve coordination with federal, state, and local governments, and  has reported taking steps to strengthen partnerships with passenger rail  industry stakeholders to enhance the security of the passenger rail system. Passenger Rail Security: Evaluating Foreign Security Practices and  Risk Can Help Guide Security Efforts. Transportation Security: Federal Action Needed to Help Address  Security Challenges.
Why GAO Did This Study

The 2005 London subway bombings and 2006 rail attacks in Mumbai, India highlighted the vulnerability of passenger rail and other surface transportation systems to terrorist attack and demonstrated the need for greater focus on securing these systems. This testimony is based primarily on GAO's September 2005 passenger rail security report and selected program updates obtained in January 2007. Specifically, it addressees (1) the extent to which the Department of Homeland Security (DHS) has assessed the risks facing the U.S. passenger rail system and developed a strategy based on risk assessments for securing all modes of transportation, including passenger rail; (2) the actions that the Transportation Security Administration (TSA) and other federal agencies have taken to enhance the security of the U.S. passenger rail system, improve federal coordination, and develop industry partnerships; and (3) the security practices that domestic and selected foreign passenger rail operators have implemented to enhance security.

What GAO Found

The DHS Office of Grants and Training and TSA have begun to assess the risks facing the passenger rail system. However, we reported in September 2005 that TSA had not completed a comprehensive risk assessment of passenger rail. We found that, until TSA does so, the agency may be limited in its ability to prioritize passenger rail assets and help guide security investments. We also reported that DHS had begun, but not yet completed, a framework to help agencies and the private sector develop a consistent approach for analyzing and comparing risks among and across critical sectors. Since that time, TSA has reported taking additional steps to assess the risks to the passenger rail system. However, TSA has not yet issued the required Transportation Sector Specific Plan and supporting plans for passenger rail and other surface transportation modes, based on risk assessments. Until TSA does so, the agency lacks a clearly communicated strategy with goals and objectives for securing the transportation sector, including passenger rail. After September 11, the Department of Transportation (DOT) initiated efforts to strengthen passenger rail security. TSA has also taken actions to strengthen rail security, including issuing security directives, testing security technologies, and issuing a proposed rule for passenger and freight rail security, among other efforts. However, federal and rail industry stakeholders have questioned the extent to which TSA's directives were based on industry best practices. TSA has also taken steps to strengthen coordination with DOT and develop partnerships with industry stakeholders. DHS and DOT have updated their memorandum of understanding to clarify their respective security roles and responsibilities for passenger rail. TSA also established an Office of Transportation Sector Network Management and offices for each transportation mode to develop security policies and work to strengthen industry partnerships for passenger rail and other surface modes. U.S. and foreign passenger rail operators GAO visited have also taken actions to secure their rail systems. Most had implemented customer security awareness programs, increased security personnel, increased the use of canines to detect explosives, and enhanced employee training programs. GAO also observed security practices among foreign passenger rail systems that are not currently used by U.S. rail operators or by the U.S. government, which could be considered for use in the U.S. For example, some foreign rail operators randomly screen passengers or use covert testing to help keep employees alert to security threats. While introducing these security practices in the U.S may pose political, legal, fiscal, and cultural challenges, they warrant further examination. TSA has also reported taking steps to identify foreign best practices for rail security and working to develop a clearinghouse of security technologies.