DHS Has Taken Steps to Assess Risk to Passenger Rail Systems, but Additional Work Is Needed to Guide Security Investments

DHS component agencies have taken a variety of steps to assess the risk  posed by terrorism to U.S. passenger rail systems. TSA has also begun to assess risks to the passenger rail system. Until all three assessments of passenger rail systems—threat,  criticality, and vulnerability—have been completed, and until TSA  determines how to use the results of these assessments to analyze and  characterize the level of risk (high, medium, or low), it will be difficult to  prioritize passenger rail assets and guide investment decisions about  protecting them. As of January 2007, TSA had not completed a comprehensive risk  assessment of the passenger rail system. This  framework is intended to help the private sector and state and local  governments develop a consistent approach to analyzing risk and  vulnerability across infrastructure types and across entire economic  sectors, develop consistent terminology, and foster consistent results. Multiple Federal Agencies Have Taken Actions to Enhance Passenger Rail Security

In addition to the ongoing initiatives to enhance passenger rail security  conducted by the FTA and FRA before and after September 11, 2001, TSA  issued security directives to passenger rail operators after the March 2004  terrorist attacks on the rail system in Madrid. However, federal and rail  industry stakeholders have questioned the extent that these directives  were based on industry best practices and expressed confusion about how  TSA would monitor compliance with the directives. For  example, TSA has tested rail security technologies, developed training  tools for rail workers, and issued a proposed rule in December 2006  regarding passenger and freight rail security, among other efforts. The memorandum of understanding between  DHS and DOT had been recently updated to include specific agreements  between TSA and FTA and FRA to delineate security-related roles and  responsibilities, among other things, for passenger rail and mass transit. FRA has also taken a number of actions to enhance passenger rail security  since September 11, 2001. TSA Has Taken Other Actions to Strengthen the Security of the Passenger Rail System and Coordinate Its Efforts with Other Federal Agencies

In January 2007, TSA provide us an update on additional actions they had  taken to strengthen passenger rail security. In  response to a previous recommendation we made, DHS and DOT signed a  memorandum of understanding (MOU) to develop procedures by which  the two departments could improve their cooperation and coordination for  promoting the safe, secure, and efficient movement of people and goods  throughout the transportation system. Three Foreign Rail Security Practices Are Not Currently Used in the United States

While many of the security practices we observed in foreign rail systems  are similar to those U.S. passenger rail operators are implementing, we  identified three foreign practices that were not currently in use among the  U.S. passenger rail operators we contacted as of September 2005, nor were  they performed by the U.S. government. No U.S. federal agency has  compiled or disseminated information on research and development and  other best practices for U.S. rail operators. Implementing covert testing, random screening, or a government- sponsored clearinghouse for technologies and best practices in the U.S.  could pose political, legal, fiscal, and cultural challenges because of the  differences between the U.S. and these foreign nations. TSA has not yet completed its methodology for  determining how the results of threat, criticality, and vulnerability  assessments will be used to identify and prioritize risks to passenger rail  and other transportation sectors. GAO-05-851.
Why GAO Did This Study

The July 2005 London subway bombings and July 2006 rail attacks in Mumbai, India dramatically revealed the vulnerability of passenger rail and other surface transportation systems worldwide to terrorist attack and demonstrated the need for increased focus on the security of these systems. This testimony, which is based primarily on GAO's September 2005 report on passenger rail security (GAO-05-851) and selected program updates obtained in January 2007 provides information on (1) how the Department of Homeland Security (DHS) has assessed the risks posed by terrorism to the U.S. passenger rail system; (2) actions TSA and other federal agencies have taken to enhance the security of U.S. rail systems; and (3) rail security practices implemented by domestic and selected foreign passenger rail operators.

What GAO Found

The DHS Office of Grants and Training has conducted risk assessments of passenger rail systems to identify and protect rail assets that are vulnerable to attack, such as stations and bridges. TSA has also begun to conduct risk assessments of passenger rail assets. While TSA has begun to establish a methodology for analyzing and characterizing risks, as of January 2007, the agency has not completed a comprehensive risk assessment of the U.S. passenger rail system. Until TSA does so, the agency may be limited in its ability to prioritize passenger rail assets and help guide security investments. DHS has also begun developing a framework to help agencies and the private sector develop a consistent approach for analyzing and comparing risks among and across different transportation sectors. However, until this framework is finalized, it may not be possible to compare risks across different sectors, prioritize them, and allocate resources accordingly. After September 11, 2001, the Department of Transportation initiated a number of efforts to improve passenger rail security. After its creation, TSA also took a number of actions, including issuing rail security directives, testing rail security technologies, developing training tools for rail workers, and issuing a proposed rule in December 2006 regarding passenger and freight rail security, among other efforts. However, federal and rail industry stakeholders have questioned the extent to which TSA's directives were based on industry best practices and expressed confusion about how TSA would monitor compliance with the directives. DHS and DOT also signed a memorandum of understanding (MOU) that delineated the two departments' respective roles and responsibilities for promoting the safe, secure, and efficient movement of people and goods throughout the transportation system. TSA has recently completed specific agreements with the Federal Transit Administration (FTA) and the Federal Railroad Administration (FRA) to further delineate security-related roles and responsibilities for passenger rail. U.S. and foreign passenger rail operators GAO visited have also taken actions to secure their rail systems. Most had implemented customer security awareness programs, increased security personnel, increased the use of canines to detect explosives, and enhanced employee training programs. GAO also observed security practices among foreign passenger rail systems that are not currently used by U.S. rail operators or by the U.S. government, which could be considered for use in the U.S. For example, some foreign rail operators randomly screen passengers or use covert testing to help keep employees alert to security threats. While introducing these security practices in the U.S may pose political, legal, fiscal, and cultural challenges, they warrant further examination. TSA has reported taking steps to identify foreign best practices for rail security.