prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: The national pipeline system consists of more than 2 7 million miles of networked pipelines transporting oil, natural gas, and other hazardous liquids  Hazardous liquid and natural gas pipelines—primarily buried underground in the continental United States—run under remote and open terrain, as well as densely populated areas  These pipelines are of three main types: Hazardous liquid: About 216,000 miles of hazardous liquid pipeline transport crude oil, diesel fuel, gasoline, jet fuel, anhydrous ammonia, and carbon dioxide  Natural gas transmission and storage: About 319,000 miles of pipeline—mostly interstate—transport natural gas from sources to communities  Natural gas distribution: About 2 2 million miles of pipeline—mostly intrastate—transport natural gas from transmission sites to consumers  Figure 1 depicts the network of hazardous liquid and natural gas transmission pipelines in the United States  More than 3,000 pipeline companies operate the nation’s pipeline systems, which can traverse multiple states and the U S  borders with Canada and Mexico  Many pipeline systems are comprised of the pipelines themselves, as well as a variety of facilities, such as storage tanks, compressor stations, and control centers  Most pipeline systems are monitored and moderated through automated ICS or Supervisory Control and Data Acquisition (SCADA) systems using remote sensors, signals, and preprogramed parameters to activate and deactivate valves and pumps to maintain flows within tolerances  Federal agencies and pipeline operators determine the criticality of pipeline systems and their facilities based on their importance to the nation’s energy infrastructure; service to installations critical to national defense; or, if attacked, have the potential to cause mass casualties and significant impact on public drinking water affecting major population centers  Accordingly, those determined to be critical merit increased attention to security  However, as we previously reported, the inherent design and operation of U S  pipeline systems may reduce some potential impacts of lost service  The pipeline sector is generally considered to be resilient and versatile  Historically, pipeline operators have been able to quickly respond to the adverse consequences of an incident—whether it is damage from a major hurricane or a backhoe—and quickly restore pipeline service  Pipeline infrastructure also includes redundancies such as parallel pipelines or interconnections that enable operators to reroute material through the network  Figure 2 depicts the U S  pipeline system, its basic components, examples of vulnerabilities, and the entities to which it supplies energy and raw materials  These entities include utility companies, airports, military sites, and industrial and manufacturing facilities  According to TSA, pipelines are vulnerable to physical attacks—including the use of firearms or explosives—largely due to their stationary nature, the volatility of transported products, and the dispersed nature of pipeline networks spanning urban and outlying areas  The nature of the transported commodity and the potential effect of an attack on national security, commerce, and public health make some pipelines and their assets more attractive targets for attack  Oil and gas pipelines have been and continue to be targeted by terrorists and other malicious groups globally  Terrorists have also targeted U S  pipelines, but have not succeeded in attacking them  Further, environmental activists and lone actors seeking to halt the construction of new pipelines through sabotage have recently emerged as a new threat to pipelines  For example, in March 2017, activists used blowtorches to cut holes in empty portions of the Dakota Access Pipeline in two states  In February 2017, local law enforcement officers fatally shot a man who used an assault rifle to damage the Sabal Trail Pipeline, a natural gas pipeline under construction in Florida  The sophisticated computer systems that pipeline operations rely on are also vulnerable to various cyber threats  According to DOE, the frequency, scale, and sophistication of cyber threats have increased, and attacks have become easier to launch  NCCIC reported that the energy sector, which includes pipelines, experienced more cyber incidents than any sector from 2013 to 2015, accounting for 35 percent of the 796 incidents reported by all critical infrastructure sectors  In 2016, NCCIC reported that the energy sector was the third most frequently attacked sector  Further, according to DOE, the cost of preventing and responding to cyber incidents in the energy sector is straining the ability of companies to adequately protect their critical cyber systems  For example, a 2015 study by the Ponemon Institute estimated the annualized cost of cyber crime for an average energy company to be about $28 million  Ineffective protection of cyber assets from these threats can increase the likelihood of security incidents and cyber attacks that disrupt critical operations; lead to inappropriate access to and disclosure, modification, or destruction of sensitive information; and threaten national security, economic well-being, and public health and safety  Unintentional or nonadversarial threat sources may include failures in equipment or software due to aging, resource depletion, and errors made by end users  They also include natural disasters and failures of critical infrastructure on which the organization depends, but that are outside of the control of the organization  Intentional or adversarial threats may include corrupt employees, criminal groups, terrorists, and nations that seek to leverage the organization’s dependence on cyber resources (i e , information in electronic form, information and communications technologies, and the communications and information-handling capabilities provided by those technologies)  These threat adversaries vary in terms of their capabilities, their willingness to act, and their motives, which can include seeking monetary gain or seeking an economic, political, or military advantage  Cyber threat adversaries make use of various techniques, tactics, practices, and exploits to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information  For example, an attacker could infiltrate a pipeline’s operational systems via the internet or other communication pathways to potentially disrupt its service and cause spills, releases, explosions, or fires  Moreover, ICS, which were once largely isolated from the Internet and the company’s information technology systems, are increasingly connected in modern energy systems, allowing cyber attacks to originate in business systems and migrate to operational systems  For example, malicious nation-state actors used spear-phishing and other similar approaches in 2018 against energy sector organizations to gain access to their business systems, conduct reconnaissance, and collect information about their ICS  Similarly, in April 2012, the Industrial Control Systems Cyber Emergency Response Team reported that an unidentified cyber attacker had conducted a series of cyber intrusions into U S  natural gas pipeline systems beginning in December 2011  Federal policy and public-private plans establish roles and responsibilities for the protection of critical infrastructure, including pipelines  These include Presidential Policy Directive 21 (PPD-21), the NIPP, and Executive Order 13636  PPD-21, issued in February 2013, reflects an all- hazards approach to protecting critical infrastructure, including natural disasters, terrorism, and cyber incidents  The directive also identifies the 16 critical infrastructure sectors and assigns roles and responsibilities for each critical infrastructure sector among nine designated federal sector-specific agencies  While PPD-21 identified the critical infrastructure sectors and assigned responsibility for each sector’s sector-specific agency, the NIPP outlines critical infrastructure stakeholder roles and responsibilities regarding critical security and resilience  It describes a voluntary partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure  As part of the partnership structure, the designated sector-specific agencies serve as the lead coordinators for security programs of their respective sector  As sector-specific agencies, federal departments or agencies lead, facilitate, or support the security and resilience programs and associated activities of their designated critical infrastructure sector  For example, DHS and DOT are both designated as sector-specific agencies for the transportation systems sector, which includes pipelines  Each sector also has a government coordinating council, consisting of representatives from various levels of government, and many have a sector coordinating council (SCC) consisting of owner-operators of these critical assets or members of their respective trade associations  For example, the Transportation Government Coordinating Council has been established, and the Pipeline Modal SCC has been established to represent pipeline operators  The NIPP also outlines a risk management framework for critical infrastructure protection  As shown in Figure 3, the NIPP uses a risk management framework as a planning methodology intended to inform how decision makers take actions to manage risk  The risk management framework calls for public and private critical infrastructure partners to conduct risk assessments to understand the most likely and severe incidents that could affect their operations and communities, and use this information to support planning and resource allocation  According to DHS, the risk management framework is influenced by the nature and magnitude of a threat, the vulnerabilities to that threat, and the consequences that could result, as shown in Figure 4  Federal policy has encouraged voluntary information-sharing mechanisms between the federal government and critical infrastructure owners and operators  For example, Information Sharing and Analysis Centers (ISAC) are formed by critical infrastructure owners and operators to gather, analyze, appropriately sanitize, and disseminate intelligence and information related to critical infrastructure  They typically collect, analyze and disseminate actionable threat information to their members and provide members with tools to mitigate risks and enhance resiliency  ISACs in which pipeline operators may participate have been formed including the Oil and Natural Gas ISAC, Downstream Natural Gas ISAC, and Electricity ISAC  Finally, in February 2013, the president issued Executive Order 13636, Improving Critical Infrastructure Cybersecurity, which cited repeated cyber intrusions into critical infrastructure as demonstrating the need for improved cybersecurity  Executive Order 13636 outlined actions for improving critical infrastructure cybersecurity, including direction for the National Institute of Standards and Technology (NIST) to lead the development of a voluntary risk-based cybersecurity framework that would comprise a set of industry standards and best practices to help organizations manage cybersecurity risks  NIST issued the framework in 2014 and updated it in April 2018  The order also addressed the need to improve cybersecurity information sharing and collaboratively develop risk-based standards and stated that U S  policy was to increase the volume, timeliness, and quality of cyber threat information shared with private sector entities so that these entities may better protect and defend themselves against cyber threats  Protecting the nation’s pipeline systems is a responsibility shared by both the federal government and private industry  As a result, several federal departments, agencies, and the private sector have significant roles in pipeline physical and cyber-related security  These entities include the following: Transportation Security Administration (TSA)  TSA, within DHS, has primary oversight responsibility for the physical security and cybersecurity of transmission and distribution pipeline systems  Within TSA, the Security Policy and Industry Engagement’s Pipeline Security Branch is charged with overseeing its pipeline security program  Pursuant to its authority, TSA’s Pipeline Security Branch first issued its voluntary Pipeline Security Guidelines in 2011, and released revised guidelines in March 2018  In accordance with the 9/11 Commission Act, TSA’s Pipeline Security Branch identifies the top 100 critical pipeline systems in the nation  To do so, it uses system annual throughput, which is based on the amount of hazardous liquid or natural gas product transported through a pipeline in 1 year (i e , annual throughput)  TSA also ranks the relative risk among the top 100 critical pipeline systems, discussed later in the report  Additionally, TSA’s Pipeline Security Branch is responsible for conducting voluntary Corporate Security Reviews (CSR) and Critical Facility Security Reviews (CFSR), which assess the extent to which the 100 most critical pipeline systems are following the intent of TSA’s Pipeline Security Guidelines  See figure 5 below for an overview of the CSR and CFSR processes  In addition, TSA Intelligence and Analysis is responsible for collecting and analyzing threat information related to the transportation network, and sharing relevant threat information to pipeline stakeholders  National Cybersecurity and Communications Integration Center (NCCIC)  Within DHS, NCCIC assists critical infrastructure owners in addressing cyber incidents and attacks, including those targeting industrial control systems  The NCCIC’s mission is to reduce the likelihood and severity of incidents that may significantly compromise the security and resilience of the nation’s critical information technology and communications networks  NCCIC’s role is to serve as the federal civilian interface for sharing information related to cybersecurity risks, incidents, analysis, and warnings with federal and nonfederal entities, and to provide shared situational awareness to enable real-time actions to address cybersecurity risks and incidents to federal and nonfederal entities  Pipeline and Hazardous Materials Safety Administration (PHMSA)  PHMSA, within DOT, is responsible for regulating the safety of hazardous materials transportation and the safety of pipeline systems, some aspects of which can be related to pipeline security  In 2004, PHMSA and TSA entered into a memorandum of understanding regarding their respective roles in all modes of transportation  In 2006, they signed an annex to the memorandum of understanding that further delineates lines of authority and responsibility between TSA and PHMSA on pipeline and hazardous materials transportation security  The annex identifies TSA as the lead federal entity for transportation security, including hazardous materials and pipeline security, and PHMSA as responsible for administering a national program of safety in natural gas and hazardous liquid pipeline transportation, including identifying pipeline safety concerns and developing uniform safety standards  Department of Energy (DOE)  DOE is responsible for protecting electric power, oil, and natural gas delivery infrastructure and, in December 2015, was identified in statute as the sector-specific agency for cybersecurity for the energy sector  The Office of Cybersecurity, Energy Security, and Emergency Response is the lead for DOE’s cybersecurity efforts  In addition, DOE operates the National SCADA Test Bed Program, a partnership with Idaho National Laboratory, Sandia National Laboratories, and other national laboratories which addresses control system security challenges in the energy sector  Among its key functions, the program performs control systems testing, research, and development; control systems requirements development; and industry outreach  Federal Energy Regulatory Commission (FERC)  FERC regulates the U S  bulk electric power system, which is increasingly powered by natural gas pipeline systems  FERC has regulatory authority over interstate natural gas pipelines under the Natural Gas Act  However, its role is limited to natural gas pipeline siting and rate regulation  The North American Electric Reliability Corporation is the federally designated U S  Electric Reliability Organization, and is overseen by FERC  The North American Electric Reliability Corporation, with approval from FERC, has developed mandatory critical infrastructure protection standards for protecting electric utility–critical and cyber-critical assets  Private sector  Although TSA has primary federal responsibility for overseeing interstate pipeline security, private sector pipeline operators are responsible for implementing asset-specific protective security measures  As we previously reported, operators have increased their attention on security by incorporating security practices and programs into their overall business operations  Pipeline operators’ interests and concerns are primarily represented by five major trade associations with ties to the pipeline industry—the Interstate Natural Gas Association of America (INGAA), American Gas Association (AGA), American Public Gas Association, American Petroleum Institute (API), and Association of Oil Pipe Lines  According to TSA officials, pipeline operators, and association representatives, these associations have worked closely with the federal government on a variety of pipeline security-related issues, including collaborating on TSA’s voluntary standards and information sharing  All of the pipeline operators and pipeline association representatives we interviewed reported receiving security information from federal and nonfederal entities  Pipeline operators also reported providing security- related information to federal agencies, including TSA, as incidents occur  Multiple federal entities exchange alerts of physical and cybersecurity incidents and other risk-related information with critical infrastructure partners, including pipeline operators  For example, DHS components including TSA’s Intelligence and Analysis and NCCIC share security- related information on physical and cyber threats and incidents with sector stakeholders  Specifically, Intelligence and Analysis provides quarterly intelligence briefings to pipeline operators  NCCIC also issues indicator bulletins, which can contain information related to cyber threat indicators, defensive measures, and cybersecurity risks and incidents  In addition, TSA and other federal entities have coordinated to address specific pipeline-related security incidents  For example, TSA officials coordinated with DOT, DOE, the Department of Justice, and FERC through the Oil and Natural Gas subsector SCC to address ongoing incidents of vandalism and sabotage of critical pipeline assets by environmental activists in 2016  In July 2017, according to DOT officials, PHMSA and TSA collaborated on a web-based portal to facilitate sharing sensitive but unclassified incident information among federal agencies with pipeline-related responsibilities  See table 1 for the key federal information sharing entities and programs that exchange security-related or incident information with critical infrastructure stakeholders, including the pipeline sector  Pipeline operators also share security-related information with TSA and the NCCIC  In its Pipeline Security Guidelines, TSA requests that pipeline operators report by telephone or email to its Transportation Security Operations Center (TSOC) any physical security incidents that are indicative of a deliberate attempt to disrupt pipeline operations or activities that could be considered precursors to such an attempt  TSA’s Pipeline Security Guidelines also request that operators report any actual or suspected cyber attacks that could impact pipeline industrial control systems or other information technology-based systems to the NCCIC  According to the TSOC’s operating procedures, if a reported incident meets certain criteria, such as the incident was intended to or resulted in damage or requires a general evacuation of a facility, the TSOC watch officer is then to contact Office of Security and Industry Engagement officials  According to TSA officials, the TSOC does not conduct investigations of the specific security incidents that pipeline operators report  However, TSOC staff do analyze the incident information they receive for national trends and common threats  TSA officials stated that they share their observations with pipeline operators and other critical infrastructure asset owners during monthly and quarterly conference calls that TSA holds with pipeline operators  All the pipeline operators and association representatives we interviewed identified other nonfederal information sharing entities, including ISACs, fusion centers, industry associations, and SCCs, which provide forums for exchanging information about physical and cyber incidents throughout the pipeline sector  See table 2 for nonfederal information sharing entities identified as available to pipeline operators  Operators and TSA officials reported that the current backlog in granting security clearances for some key pipeline operator employees was a significant factor affecting information sharing between TSA and pipeline operators  TSA officials acknowledged that some pipeline operators have had difficulty obtaining security clearances for key employees due to ongoing backlogs in processing requests by the Office of Personnel Management National Background Investigation Bureau, and that TSA’s ability to share timely information with operators whose staff do not have a clearance may be hindered  Three of the 10 pipeline operators we interviewed identified receiving timely classified security information as a specific challenge due, in part, to difficulties staff have had obtaining security clearances  Further, 7 of the 10 pipeline operators that we interviewed reported experiencing delays in obtaining a security clearance or were aware of others who had experienced this issue  However, according to three operators we interviewed, TSA was helpful in facilitating approval of security clearances for the operators’ personnel to access classified information when necessary  This security clearance challenge is not faced by pipeline operators alone  In January 2018, we designated the backlog of investigations for the clearance process and the government-wide personnel security clearance process as a high-risk area  We will continue to monitor agencies’ progress in reducing the backlog and improving the security clearance process  Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks, and all of them reported implementing TSA’s voluntary Pipeline Security Guidelines that were applicable to their operations  TSA revised and issued its Pipeline Security Guidelines in March 2018, but the revised guidelines lack a defined process to consider updates to supporting guidance such as to the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework)  Furthermore, TSA has not clearly defined the terms within the criteria that pipeline operators are to use to determine the criticality of their facilities  Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks  For example, all 10 of the pipeline operators we interviewed stated they had implemented the voluntary 2011 TSA Pipeline Security Guidelines the operators determined to be applicable to their operations  The guidelines provide TSA’s recommendations for pipeline industry security practices such as establishing a corporate security program and identifying critical facilities among others (see sidebar)  Five of the 10 pipeline operators we interviewed characterized the guidelines as generally or somewhat effective in helping to secure their operations, 1 was neutral on their effectiveness, and 4 did not provide an assessment of the guidelines’ effectiveness  However, one operator pointed out that they had not adopted the guidelines’ recommended interval of 36 months or less for conducting security vulnerability assessments due to staffing limitations  Also, another pipeline operator noted that they were working to implement the guidelines in the operations of a newly acquired asset that they determined was not using the guidelines in the same manner as their company  All of the pipeline operators we interviewed reported using other guidelines or standards to address pipeline systems’ security risks  For example, pipeline operators reported using and industry association representatives reported that their members use INGAA’s Control Systems Cyber Security Guidelines for the Natural Gas Pipeline Industry, API’s Pipeline SCADA Security standard, and the NIST Cybersecurity Framework as sources of cybersecurity standards, guidelines, and practices that may be scaled and applied to address a pipeline operator’s cybersecurity risks  Further, pipeline operators are required to adhere to regulations related to pipeline safety and, depending upon their assets, operations, and location, may be required to adhere to regulations for electrical utilities, chemical storage facilities, and locations near waterways  For example, all pipeline operators must adhere to DOT’s PHMSA safety regulations  In addition, pipeline operators whose systems include chemical facilities may be required to comply with DHS’s Chemical Facility Anti-Terrorism Standards (CFATS)  Pipeline operators whose systems include a terminal located on a U S  port may be required to comply with Maritime Transportation Security Act regulations  For a listing of federal and industry guidelines identified as applicable to security by the pipeline operators, see appendix I  TSA’s Pipeline Security Branch issued its revised Pipeline Security Guidelines in March 2018, but TSA has not established a documented process to ensure that revisions occur and fully capture updates to supporting standards and guidance  The guidelines were revised to, among other things, reflect the dynamic threat environment and to incorporate cybersecurity principles and practices from the NIST Cybersecurity Framework, which were initially issued in February 2014  To revise the guidelines and incorporate feedback, according to Pipeline Security Branch officials, they incorporated outcomes from pipeline modal threat assessments and best practices from security reviews, and collaborated with pipeline sector stakeholders—including industry associations and other federal agencies with a role in pipeline security  Officials from the industry associations we interviewed confirmed that they provided input to the revised pipeline guidelines, including meeting with and consolidating comments from member pipeline operators  See figure 6 for a timeline of events pertinent to federal pipeline security guidelines  TSA’s Pipeline Security Smart Practice Observations for pipeline operators states that security plans should have a documented process to include security plan reviews and updates on a periodic and an as- needed basis  Standards for Internal Control in the Federal Government states that periodic review of policies, procedures, and related control activities should occur to determine their continued relevance and effectiveness in achieving identified objectives or addressing related risks  The NIPP and NIST also emphasize the need to provide updates on incident response guidance and security procedures, respectively  Moreover, other pipeline industry guidance cited by TSA’s guidelines also has a prescribed interval for review and revision  For example, API reviews its standards at least every 5 years  However, TSA has not instituted a documented process to consider the need to update the Pipeline Security Guidelines on a regular basis  Pipeline Security Branch officials acknowledged the value of having a defined process for reviewing and, if necessary, revising TSA’s Pipeline Security Guidelines at regular defined intervals to ensure it includes, among other things, newly identified best practices and updated industry guidance that are relevant to pipeline operators, such as the elements of the latest version of NIST’s Cybersecurity Framework  For example, TSA’s revisions to its guidelines incorporated some, but not all of the elements of the NIST Cybersecurity Framework version 1  Specifically, to improve incident response, the NIST framework recommends implementing an incident response analysis and feedback function to a security program  However, TSA’s Pipeline Security Guidelines do not include similar steps for pipelines operators to include in their pipeline security programs  Further, because NIST released version 1 1 of the Cybersecurity Framework in April 2018, the guidelines that TSA released in March 2018 do not incorporate cybersecurity elements that NIST added to the latest Cybersecurity Framework such as the Supply Chain Risk Management category  Pipeline Security Branch officials said that they have not instituted a review process on a regular basis because they intended to review and revise TSA’s guidelines on an as-needed basis in response to updated supporting guidance, but could provide no timeline for doing so  Without a documented process defining how frequently Pipeline Security Branch staff are to review and revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system  Under TSA’s Pipeline Security Guidelines, pipeline operators are to self- identify the critical facilities within their system and report their critical facilities to TSA  TSA’s Pipeline Security Branch conducts CFSRs at the critical facilities that pipeline operators have identified  However, our analysis of TSA’s data found that at least 34 of the top 100 critical pipeline systems deemed highest risk indicated that they had no critical facilities  Accordingly, TSA would not conduct a CFSR at any of these systems’ facilities because their operators identified none of them as critical  The fact that pipeline operators of about one third of the highest risk systems identified no critical facilities may be due, in part, to the Pipeline Security Branch not clearly defining the criteria outlined in the Pipeline Security Guidelines that pipeline operators are to use to determine the criticality of their facilities  Three of the 10 operators we interviewed stated that some companies reported to TSA that they had no critical facilities, and may possibly be taking advantage of the guidelines’ lack of clarity  Accordingly, operators that report no critical facilities would avoid TSA’s reviews of their facilities  service or deliverability resulting in a state or local government's inability to provide essential public services and emergency response for an extended period of time; Significantly damage or destroy national intended use of major rivers, lakes, or waterways (e g , public drinking water for large populations or disruption of major commerce or public transportation routes); service or deliverability to a significant number of customers or individuals for an extended period of time; operations for an extended period of time (i e , business critical facilities)  Our review of the eight criteria included in TSA’s Pipeline Security Guidelines (see sidebar) found that no additional examples or clarification are provided to help operators determine criticality  Although we previously noted that 5 of the 10 operators we interviewed generally found TSA’s Guidelines as a whole helpful in addressing pipeline security, more than half of the operators we interviewed identified TSA’s criticality criteria as a specific area for improvement  Specifically, 3 of the 10 pipeline operators that we interviewed stated that TSA had not clearly defined certain terms within the criteria, and 3 additional operators of the 10 reported that additional consultation with TSA was necessary to appropriately apply the criteria and determine their facilities’ criticality  For example, 2 operators told us that individual operators may interpret TSA’s criterion, “cause mass casualties or significant health effect,” differently  One of these operators that we interviewed stated that this criterion could be interpreted either as a specific number of people affected or a sufficient volume to overwhelm a local health department, which could vary depending on the locality  Another operator reported that because TSA’s criteria were not clear, they created their own criteria which helped the operator identify two additional critical facilities  Pipeline Security Branch officials acknowledged there are companies that report having no critical facilities in their pipeline systems  According to Pipeline Security Branch officials, pipeline operators are in the best position to determine which of their facilities are critical, and the companies that have determined that their pipeline systems have no critical facilities also have reported sufficient redundancies to make none of their facilities critical to the continuity of their operations  According to these officials, they have had extensive discussions with pipeline company officials to assess the validity of their criticality determinations, and have closely questioned companies to ensure they have properly applied TSA’s criteria  However, according to TSA’s Pipeline Security Guidelines, operators should use a consistent set of criteria for determining the criticality of their facilities  In addition, Standards for Internal Control in the Federal Government states that management should define objectives clearly to enable the identification of risks  To achieve this, management generally defines objectives in specific and measurable terms and ensures the terms are fully and clearly set forth so they can be easily understood  Pipeline Security Branch officials acknowledged that the criticality definitions in the Pipeline Security Guidelines could be clarified to be more specific  Additionally, an industry association representative reported that the association, in consultation with TSA, has been developing supplementary guidance for its members to clarify certain terms in TSA’s critical facility criteria  As of October 2018 this guidance is still under review at the association and has not been made available to the association’s members  Pipeline Security Branch officials confirmed they worked with the industry association on its supplementary guidance, but also acknowledged that the supplementary guidance may only be distributed to the association’s membership  Without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying its guidance uniformly  Further, because TSA selects the pipeline facilities on which to conduct CFSRs based on operators’ determinations, TSA cannot fully ensure that all of the critical facilities across the pipeline sector have been identified using the same criteria, or that their vulnerabilities have been identified and addressed  TSA’s Intelligence and Analysis identifies security risks to pipeline systems through various assessments  Additionally, TSA’s Pipeline Security Branch conducts security reviews to assess pipeline operators’ implementation of TSA’s Pipeline Security Guidelines, but gaps in staffing and lack of a workforce plan may affect its ability to carry out effective reviews  The Pipeline Security Branch also developed a pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems and to prioritize its security reviews of pipeline companies, but shortfalls in its calculations of threat, vulnerability, and consequence may limit its ability to accurately identify pipeline systems with the highest risk  Finally, the pipeline risk assessment has not been peer reviewed to validate the assessment’s data and methodology, which we previously reported as a best practice in risk management  TSA’s Intelligence and Analysis produces assessments related to pipeline security risks, including Pipeline Modal and Cyber Modal Threat Assessments and the Transportation Sector Security Risk Assessment  The Pipeline and Cyber Modal Threat Assessments are issued on a semiannual basis; TSA Intelligence and Analysis may also issue additional situation-based products on emerging threats  The Pipeline Modal and Cyber Modal Threat Assessments evaluate, respectively, physical and cyber threats to pipelines  The pipeline modal threat assessment evaluates terrorist threats to hazardous liquid and natural gas pipelines, and the cyber modal threat assessment evaluates cyber threats to transportation, including pipelines  Both assessments specifically analyze the primary threat actors, their capabilities, and activities—including attacks occurring internationally—as well as other characteristics of threat  The Transportation Sector Security Risk Assessment assesses threat, vulnerability, and consequence for various attack scenarios across the five transportation modes for which TSA is responsible  The scenarios define a type of threat actor—including homegrown violent extremists and transnational extremists, such as al Qaeda and its affiliates—a target, and an attack mode  For example, a scenario might assess the risk of attacks using varying sizes of improvised explosive devices on pipeline system assets  As part of the assessment process, TSA engages with subject matter experts from TSA and industry stakeholder representatives to compile vulnerabilities for each mode, and TSA analyzes both direct and indirect consequences of the various attack scenarios  According to Pipeline Security Branch officials, the assessments produced by TSA’s Intelligence and Analysis provide key information to inform the pipeline security program’s efforts  According to TSA officials, TSA conducts pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)—to assess pipeline vulnerabilities and industry implementation of TSA’s Pipeline Security Guidelines  However, as shown by Figure 7 below, the number of CSRs and CFSRs completed by TSA has varied during the last five fiscal years, ranging from zero CSRs conducted in fiscal year 2014 to 23 CSRs conducted in fiscal year 2018, as of July 31, 2018  TSA officials reported that staffing limitations have prevented TSA from conducting more reviews  As shown in table 3, TSA Pipeline Security Branch staffing levels (excluding contractor support) have varied significantly over the past 9 years ranging from 14 full-time equivalents (FTEs) in fiscal years 2012 and 2013 to one FTE in fiscal year 2014  They stated that, while contractor support has assisted with conducting CFSRs, there were no contractor personnel providing CSR support from fiscal years 2010 through 2017, but that has now increased to two personnel in fiscal year 2018  TSA prioritizes reviewing and collecting information on the nation’s top 100 critical pipeline systems  According to TSA officials, they would need to conduct 46 CSRs in order to review the top 100 critical pipeline systems  In July 2018, TSA officials stated that TSA’s current target was to assess each pipeline company every 2 to 3 years; this would equate to about 15 to 23 CSRs per year  TSA officials stated that they expect to complete 20 CSRs and 60 CFSRs per fiscal year with Pipeline Security Branch employees and contract support, and have completed 23 CSRs through July 2018 for fiscal year 2018  Given the ever-increasing cybersecurity risks to pipeline systems, ensuring that the Pipeline Security Branch has the required cybersecurity skills to effectively evaluate pipeline systems’ cybersecurity is essential  Pipeline operators we interviewed emphasized the importance of cybersecurity skills among TSA staff  Specifically, 6 of the 10 pipeline operators and 3 of the 5 industry representatives we interviewed reported that the level of cybersecurity expertise among TSA staff and contractors may challenge the Pipeline Security Branch’s ability to fully assess the cybersecurity portions of its security reviews  TSA officials stated that Security Policy and Industry Engagement staff are working with DHS’s National Protection and Programs Directorate to help address cyber- related needs, including identifying specific cybersecurity skills and competencies required for the pipeline security program  The officials were uncertain, however, whether TSA would use contractor support or support from the National Protection and Programs Directorate to provide identified skills and competencies  TSA officials also stated that Security Policy and Industry Engagement staff work with TSA’s human resource professionals to identify critical skills and competencies needed for Pipeline Security Branch personnel, and helps its workforce maintain professional expertise by providing training and education for any identified skill or competency gaps  Our previous work has identified principles that a strategic workforce planning process should follow including developing strategies tailored to address gaps in number, deployment, and alignment of human capital approaches for enabling and sustaining the contributions of all critical skills and competencies  Workforce planning efforts, linked to an agency’s strategic goals and objectives, can enable it to remain aware of and be prepared for its needs, including the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed for it to pursue its mission  Agencies should consider how hiring, training, staff development, performance management, and other human capital strategies can be aligned to eliminate gaps and improve the long-term contribution of skills and competencies identified as important for mission success  TSA has not established a workforce plan for its Security Policy and Industry Engagement or its Pipeline Security Branch that identifies staffing needs and skill sets such as the required level of cybersecurity expertise among TSA staff and contractors  When asked for TSA strategic workforce planning documents used to inform staffing allocations related to the pipeline security program, TSA officials acknowledged they do not have a strategic workforce plan  Rather, according to these officials, TSA determines agency-level staffing allocations through the Planning, Programming, Budgeting and Execution process, which is used to decide policy, strategy, and the development of personnel and capabilities to accomplish anticipated missions  According to TSA officials, when they use this process they look at existing resources and then set priorities based on the TSA Administrator’s needs  However, a strategic workforce plan allows an agency to identify and prepare for its needs, such as the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed to pursue its mission  TSA officials stated that the agency has a detailed allocation plan for strategically aligning resources to screen passengers at TSA-regulated airports, but not for the entire agency  By establishing a strategic workforce plan, TSA can help ensure it has identified the knowledge, skills, and abilities that the future workforce of TSA’s Pipeline Security Branch may need in order to meet its mission of reducing pipeline systems’ vulnerabilities to physical and cybersecurity risks, especially in a dynamic and evolving threat environment  Further, as greater emphasis is placed on cybersecurity, determining the long- term staffing needs of the Pipeline Security Branch will be essential  Furthermore, a workforce plan could enable TSA to determine the number of personnel it needs to meet its stated goals for conducting CSRs and CFSRs  After TSA identifies the top 100 critical pipeline systems based on throughput, the Pipeline Security Branch uses the Pipeline Relative Risk Ranking Tool (risk assessment), which it developed in 2007, to assess various security risks of those systems  We previously reported, in 2010, that the Pipeline Security Branch was the first of TSA’s surface transportation modes to develop a risk assessment model that combined all three components of risk—threat, vulnerability, and consequence—to generate a risk score  The risk assessment generates a risk score for each of the 100 most critical pipeline systems and ranks them according to risk  The risk assessment calculates threat, vulnerability, and consequence for each pipeline system on variables such as the amount of throughput in the pipeline system and the number critical facilities  The risk assessment combines data collected from pipeline operators, as well as other federal agencies, such as the Departments of Transportation and Defense, to generate the risk score  However, the last time the Pipeline Security Branch calculated relative risk among the top 100 critical pipeline systems using the risk assessment was in 2014  Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting CSRs state the results of the risk ranking are the primary factor considered when prioritizing corporate security reviews of pipeline companies  According to Pipeline Security Branch officials, the risk assessment has not changed since 2014 because the Pipeline Security Branch is still conducting CSRs based on the 2014 ranking of pipeline systems  As outlined in table 4 below, we identified several factors that likely limit the usefulness of the current risk assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems  For example, because the risk assessment has not changed since 2014, information on threat may be outdated  Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented  For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor  Further, the risk assessment does not include information that is consistent with the NIPP and other DHS priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data)  According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk  Rather, officials said they are primarily interested in assessing risk data that impacts security  However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation would better align their efforts with PPD-21  For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts  For a more detailed discussion of the shortfalls we identified, refer to appendix II  In addition to the shortfalls identified above, the risk assessment has not been peer reviewed since its conception in 2007  In our past work, we reported that independent, external peer reviews are a best practice in risk management and that independent expert review panels can provide objective reviews of complex issues  According to the National Research Council of the National Academies, external peer reviews should, among other things, address the structure of the assessment, the types and certainty of the data, and how the assessment is intended to be used  The National Research Council has also recommended that DHS improve its risk analyses for infrastructure protection by validating the assessments and submitting them to independent, external peer review  Other DHS components have implemented our prior recommendations to conduct peer reviews of their risk assessments  For example, in April 2013, we reported on DHS’s management of its Chemical Facility Anti- Terrorism Standards (CFATS) program and found that the approach used to assess risk did not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals  The Infrastructure Security Compliance Division, which manages the CFATS program conducted a multiyear effort to improve their risk assessment methodology and included commissioning a peer review by the Homeland Security Studies and Analysis Institute, which resulted in multiple recommendations  As part of the implementation of some of the peer review’s recommendations, DHS conducted peer reviews and technical reviews with government organizations and facility owners and operators, and worked with Sandia National Laboratories to verify and validate the CFATS program’s revised risk assessment methodology, which was completed in January 2017  According to Pipeline Security Branch officials, they are considering updates to the risk assessment methodology including changes to the vulnerability and consequence factors  These officials said the risk assessment was previously reviewed within the past 18 months by industry experts and they consider input from several federal partners including DHS, DOT, and the Department of Defense  Officials also said they will consider input from industry experts and federal partners while working on updating the risk assessment  However, most of the proposed changes to the risk assessment methodology officials described are ones that have been deliberated since our last review in 2010  Therefore, an independent, external peer review would provide the opportunity for integration and analysis of additional outside expertise across the critical infrastructure community  While independent, external peer reviews cannot ensure the success of a risk assessment approach, they can increase the probability of success by improving the technical quality of projects and the credibility of the decision-making process  According to the National Research Council of the National Academies, independent, external peer reviews should include validation and verification to ensure that the structure of the risk assessment is both accurate and reliable  Thus, an independent, external peer review would provide better assurance that the Pipeline Security Branch can rank relative risk among pipeline systems using the most comprehensive and accurate threat, vulnerability, and consequence information  TSA has established performance measures, as well as databases to monitor pipeline security reviews and analyze their results  However, weaknesses in its performance measures and its efforts to record pipeline security review recommendations limit its ability to determine the extent that its pipeline security program has reduced pipeline sector risks  Furthermore, we identified data reliability issues in the information that TSA collects to track the status of pipeline security review recommendations, such as missing data, inconsistent data entry formats, and data entry errors  TSA has three sets of performance measures for its pipeline efforts: the Pipeline Security Plan in the 2018 Biennial National Strategy for Transportation Security (NSTS), a management measure in the DHS fiscal year 2019 congressional budget justification, and summary figures in their CSR and CFSR databases  As a result of our 2010 work, TSA established performance measures and linked them to Pipeline Security Plan goals within the Surface Security Plan of the 2018 NSTS  See table 5 below for the 2018 NSTS Pipeline Security Plan performance measures  As shown in table 6 below, DHS also included a management measure in its fiscal year 2019 congressional budget justification to track the annual number of completed pipeline security reviews  Finally, TSA Pipeline Security Branch officials said they use summary figures in the CFSR status database and the CSR goals and priorities database as performance measures  For example, these include the percentage of CFSR recommendations implemented and the average percentage compliance with the guidelines by fiscal year  We previously found that results-oriented organizations set performance goals to clearly define desired program outcomes and develop performance measures that are clearly linked to the performance goals  Performance measures should focus on whether a program has achieved measurable standards toward achieving program goals, and allow agencies to monitor and report program accomplishments on an ongoing basis  Our previous work on performance metrics identified 10 attributes of effective performance  Table 7 identifies each key attribute of effective performance measures along with its definition  We evaluated the current performance measures included in the 2018 NSTS, the DHS fiscal year 2019 congressional budget justification, the CSR goals and priorities database, and the CFSR status database related to TSA’s Pipeline Security Branch  We primarily focused on key attributes which could be applied to individual measures  These include clarity, linkage, measurable targets, objectivity, reliability, and baseline and trend data  Our prior work on performance measurement found that all performance measure attributes are not equal and failure to have a particular attribute does not necessarily indicate that there is a weakness in that area or that the measure is not useful; rather, it may indicate an opportunity for further refinement  Based on our evaluation, the TSA-identified measures do not possess attributes that we have identified as being key to successful performance measures  As a result, TSA cannot fully determine the extent to which the Pipeline Security Branch has achieved desired outcomes, including the effectiveness of its efforts to reduce risks to pipelines  Specifically, many of TSA’s measures cover agency goals and mission, but they generally lack clarity and measurable targets, provide significantly overlapping information, and do not include baseline and trend data  Clarity  The pipeline-related measures in the 2018 NSTS are not clear because they do not describe the methodology used to calculate them, and the names and definitions are not clearly described  For example, NSTS goal 1 includes an objective to conduct training of employees responding to terrorist attacks  The desired outcome is to improve the capability of industry employees to respond and recover from terrorist attacks  However, the performance measure is the percentage of critical pipeline systems implementing the TSA Pipeline Security Guidelines  It is not clear if this measure is specific to the sections of the guidelines related to employee training or overall implementation of the guidelines  The CFSR status database measures include the percentage of recommendations implemented by topic, such as “Site Specific Security Measures,” “Signage,” or “Miscellaneous ” However, the database does not specifically define these topics or explain the methodology for calculating the measures  Unclear measures could be confusing and misleading to users  Core program activities  The pipeline-related measures in the 2018 NSTS cover some of the agency’s core program activities, such as conducting security exercises with the pipeline industry and providing intelligence and information products to the industry  However, the NSTS Pipeline Security Plan measures do not specifically include some core program activities, such as updating the TSA Pipeline Security Guidelines or the results of conducting CSRs and CFSRs in order to collect the information necessary for the existing performance measures  The CSR goals and priorities database and the CFSR status database include measures intended to track some of the results of pipeline security reviews, such as the average percentage compliance with the guidelines by fiscal year and the percentage of CFSR recommendations implemented  If core program activities are not covered, there may not be enough information available in those areas to managers and stakeholders  Limited overlap  The pipeline-related measures in the 2018 NSTS do not have limited overlap  As discussed previously, four of the five NSTS measures are based on the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines  The management measure is based on the number of complete pipeline security reviews  The CFSR status database measures are based on the percentage of recommendations implemented overall and by groups  Finally, the CSR goals and priorities database measures are based on the average compliance percentage of companies that had CSRs conducted in fiscal years 2016 and 2017  This is similar to four of the five NSTS measures  Significantly overlapping measures may lead to redundant, costly information that does not add value for TSA management  Linkage  The pipeline-related measures in the 2018 NSTS generally exhibited this key attribute  For example, all of the NSTS measures were arranged by agency strategic goals and risk-based priorities  However, the management measure in DHS’s fiscal year 2019 congressional budget justification and the CFSR status database measures did not specify the TSA goals and priorities to which they were aligned  If measures are not aligned with division and agency- wide goals and mission, the behaviors and incentives created by these measures do not support achieving those goals or mission  Measurable target  TSA’s measures generally did not include measurable targets in the form of a numerical goal and none of the NSTS measures had measurable targets  For example, the NSTS measure under the Security Planning priority, which tracks the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines, does not state what specific percentages would be considered an improvement in industry security plans  However, the management measure did include target numbers of pipeline security reviews by fiscal year  Both the CFSR status database measures and CSR goals and priorities database measures did not include measurable targets  Without measurable targets, TSA cannot tell if performance is meeting expectations  Objectivity  Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity and measurable targets, TSA cannot ensure its measures are free from bias or manipulation, and therefore, are not objective  If measures are not objective, the results of performance assessments may be systematically overstated or understated  Reliability  Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity, measurable targets, and baseline and trend data, it is not clear if TSA’s measures produce the same result under similar conditions; therefore, the pipeline-related measures are unreliable  If measures are not reliable, reported performance data may be inconsistent and add uncertainty  Baseline and trend data  TSA’s measures generally did not include baseline and trend data  For example, none of the NSTS measures included past results and compared them to measurable targets  TSA officials were unable to identify measures or goals to assess the extent to which pipeline operators have fully implemented the guidelines or increased pipeline security, but did say developing a feedback mechanism to measure progress in closing vulnerability gaps was important  However, the management measure did include the number of completed pipeline security reviews for each fiscal year from 2014 through 2017, as well as numerical goals  The CFSR status database includes information on CFSRs conducted from May 22, 2012, through June 29, 2017, but the measures are calculated for the entire time period rather than year-by-year  The CSR goals and priorities database measures include percentage compliance with the guidelines for CSRs conducted in fiscal years 2016 and 2017, as well as a combined measure  However, baseline and trend data are not tracked or reported in either database  Collecting, tracking, developing, and reporting baseline and trend data allows agencies to better evaluate progress being made and whether or not goals are being achieved  Pipeline Security Branch officials explained that in addition to the measures reported in the 2018 NSTS Pipeline Security Plan, they primarily rely on measures assessing CSR and CFSR implementation for assessing the value of its pipeline security program  TSA officials reported that they collect and analyze data and information collected from CSRs and CFSRs to, among other things, determine strengths and weaknesses at critical pipeline facilities, areas to target for risk reduction strategies, and pipeline industry implementation of the voluntary Pipeline Security Guidelines  For example, TSA officials reported that they analyzed information from approximately 734 CFSR recommendations that were made during fiscal years 2012 through 2016  They found that pipeline operators had made the strongest improvements in security training, public awareness outreach and law enforcement coordination, and site specific security measures  The most common areas in need of improvement were 24x7 monitoring, frequency of security vulnerability assessments, and proper signage  However, as described above, we found those measures also did not comport with key attributes for successful measures and we report below on reliability concerns for underlying data supporting those measures  In addition, while the Pipeline Security Branch may not rely on the measures included in the 2018 NSTS Pipeline Security Plan and the fiscal year 2019 congressional budget justification, they are important for reporting the status of pipeline security efforts to TSA as a whole and to external stakeholders such as Congress  Taking steps to ensure that the pipeline security program performance measures exhibit key attributes of successful performance measures could allow TSA to better assess the program’s effectiveness at reducing pipeline physical and cybersecurity risks  This could include steps such as modifying its suite of measures so they are clear, have measurable targets, and add baseline and trend data  Further examples include the following: Adding measurable targets consisting of numerical goals could allow TSA to better determine if the pipeline security program is meeting expectations  For example, measurable targets could be added to TSA’s existing measures by developing annual goals for the percentage of recommendations implemented to the CFSR status database and then reporting annual results  To make measures clearer, TSA could verify that each measure has a clearly stated name, definition, and methodology for how the measure is calculated  For example, the NSTS objective for security training mentioned above could have more specific language explaining how the measure is calculated and whether it applies to pipeline operators’ implementation of the training-related portions of the TSA Pipeline Security Guidelines or overall implementation  Finally, adding baseline and trend data could allow TSA to identify, monitor, and report changes in performance and help ensure that performance is viewed in context  For example, the NSTS measures, CFSR status database measures, and CSR goals and priorities database measures could have annual results from prior years  This could help TSA and external stakeholders evaluate the effectiveness of the pipeline security program and whether it is making progress toward its goals  According to TSA officials, the primary means for assessing the effectiveness of the agency’s efforts to reduce pipeline security risks is through conducting pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)  However, TSA has not tracked the status of CSR recommendations for over 5 years and related security review data are not sufficiently reliable  When conducting CSRs and CFSRs, TSA staff makes recommendations to operators, if appropriate  For example, a CSR recommendation might include a suggestion to conduct annual security-related drills and exercises, and a CFSR recommendation might include a suggestion to install barbed wire on the main gate of a pipeline facility  In response to recommendations that we made in our 2010 report, TSA developed three databases to track CSR and CFSR recommendations and their implementation status by pipeline facility, system, operator, and product type  In addition, the agency recently developed a fourth database to collect and analyze information gathered from pipeline operators’ responses to CSR questions  TSA officials reported that they use this database to assess the extent that TSA’s pipeline security program has met NSTS goals and Pipeline Security Branch priorities  TSA officials stated that they use the CSR goals and priorities database for follow-up on recommendations, indications of improvement in pipeline security, and as an input into TSA performance goals and measures, including the performance measures for the 2018 NSTS Pipeline Security Plan  We found several problems with the databases that indicate that the pipeline security program data are not sufficiently reliable and do not provide quality information that is current, complete, and accurate  First, the CSR recommendations database only included information for reviews conducted from November 2010 through February 2013  TSA officials stated that the agency stopped capturing CSR recommendations and status information in 2014  A TSA official stated that one factor was that the pipeline staffing level was one FTE in fiscal year 2014  However, the Pipeline Security Branch did not resume entering CSR recommendation-related information when staffing levels rose to 6 FTEs in the following year and beyond  As a result, TSA is missing over 5 years of data for the recommendations it made to pipeline operators when conducting CSRs  The agency collected some information from CSRs conducted in fiscal years 2016 and 2017 in the separate CSR goals and priorities database  However, this database does not include all of the information that TSA collects when conducting CSRs  Specifically, the CSR goals and priorities database does not state which companies were reviewed, what specific recommendations were made, or the current status of those recommendations, and only records operators’ responses to 79 of the 222 CSR questions  Second, our review identified instances of missing data, inconsistent data entry formats, and data entry errors in the four databases  For example: The CSR recommendations database had missing data in all 13 of the included fields and a data entry error shifted 50 observations into the wrong fields, impacting both the Status Date and Completion Code fields  The CSR goals and priorities database had seven entries with inconsistent data formatting and five of those entries were not taken into account when calculating summary figures  The CFSR recommendations database had missing data in 3 of 9 fields  There was also inconsistent data entry formats in 3 fields  The CFSR status database had missing data in 7 of 29 fields and inconsistent data entry formats in 4 fields  Finally, TSA has not documented its data entry and verification procedures, such as in a data dictionary or user manual, and does not have electronic safeguards for out-of-range or inconsistent entries for any of the databases it uses to track the status of CSR or CFSR recommendations and analyze operator responses to the CSR  TSA Pipeline Security Branch officials told us that they had not documented data entry and verification procedures and did not have electronic safeguards  This was for two reasons  First, the officials stated that the databases are small and maintained in a commercial spreadsheet program that does not allow for electronic safeguards  However, based on our review of the databases, the spreadsheet program does allow for a variety of electronic safeguards  For example, entries can be restricted to only allow selections from a drop-down list or only allow dates to be entered  Second, only a small number of TSA employees enter information into these databases  TSA officials explained that typically one TSA employee is responsible for entering information from pipeline security reviews, and another individual, usually whoever conducted the review, is tasked to verify the accuracy of the data entered  As a result, according to the officials, any errors would be self-evident and caught during these TSA employees’ reviews  Our work has emphasized the importance of quality information for management to make informed decisions and evaluate agencies’ performance in achieving key objectives and addressing risks  The Standards for Internal Control in the Federal Government states that management should use quality information to achieve agency objectives, where “quality” means, among other characteristics, current, complete, and accurate  In addition, DHS’s Information Quality Guidelines state that all DHS component agencies should treat information quality as integral to every step of the development of information, including creation, collection, maintenance, and dissemination  The guidelines also state that agencies should substantiate the quality of the information disseminated through documentation or other appropriate means  Without current, complete, and accurate information, it is difficult for TSA to evaluate the performance of the pipeline security program  Until TSA monitors and records the status of these reviews’ recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk  By entering information on CSR recommendations and monitoring and recording their status, developing written documentation of its data entry and verification procedures and electronic safeguards, and improving the quality of its pipeline security program data, TSA could better ensure it has the information necessary to effectively monitor pipeline operators’ progress in improving their security posture, and evaluate its pipeline security program’s effectiveness in reducing security risks to pipelines  A successful pipeline attack could have dire consequences on public health and safety, as well as the U S  economy  Recent coordinated campaigns by environmental activists to disrupt pipeline operations, and the successful attempts by nation-state actors to infiltrate and obtain sensitive information from pipeline operators’ business and operating systems, demonstrate the dynamic and continuous threat to the security of our nation’s pipeline network  To help ensure the safety of our pipelines throughout the nation, it is important for TSA to address weaknesses in the management of its pipeline security program  TSA’s Pipeline Security Branch revised its security guidelines in March 2018 to, among other things, reflect the dynamic threat environment and incorporate NIST’s Cybersecurity Framework cybersecurity principles and practices  However, without a documented process defining how frequently TSA is to review and, if deemed necessary, revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system  Further, without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying guidance uniformly and that all of the critical facilities across the pipeline sector have been identified; or that their vulnerabilities have been identified and addressed  TSA could improve its ability to conduct pipeline security reviews and the means that it uses to prioritize which pipeline systems to review based on their relative risk ranking  Establishing a strategic workforce plan could help TSA ensure that it has identified the necessary skills, competencies, and staffing allocations that the Pipeline Security Branch needs to carry out its responsibilities, including conducting security reviews of critical pipeline companies and facilities, as well as their cybersecurity posture  Better considering threat, vulnerability, and consequence elements in its risk assessment and incorporating an independent, external peer review in its process would provide more assurance that the Pipeline Security Branch ranks relative risk among pipeline systems using comprehensive and accurate data and methods  We are making 10 recommendations to TSA: The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to implement a documented process for reviewing, and if deemed necessary, for revising TSA’s Pipeline Security Guidelines at regular defined intervals  (Recommendation 1) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to clarify TSA’s Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities  (Recommendation 2) The TSA Administrator should develop a strategic workforce plan for its Security Policy and Industry Engagement’s Surface Division, which could include determining the number of personnel necessary to meet the goals set for its Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs  (Recommendation 3) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to update the Pipeline Relative Risk Ranking Tool to include up-to-date data to ensure it reflects industry conditions, including throughput and threat data  (Recommendation 4) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to fully document the data sources, underlying assumptions and judgments that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment  (Recommendation 5) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies  (Recommendation 6) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach  (Recommendation 7) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, and baseline and trend data  (Recommendation 8) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to enter information on CSR recommendations and monitor and record their status  (Recommendation 9) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors  (Recommendation 10) We provided a draft of this report to DHS, DOE, DOT, and FERC  DHS provided written comments which are reproduced in appendix III  In its comments, DHS concurred with our recommendations and described actions planned to address them  DHS, DOE, DOT, FERC, also provided technical comments, which we incorporated as appropriate  We also provided draft excerpts of this product to the American Petroleum Institute (API), the Association of Oil Pipe Lines, the American Gas Association (AGA), the Interstate Natural Gas Association of America (INGAA), the American Public Gas Association, and the selected pipeline operators that we interviewed  For those who provided technical comments, we incorporated them as appropriate  With regard to our first recommendation, that TSA implement a documented process for reviewing, and if deemed necessary, for revising its Pipeline Security Guidelines at regular defined intervals, DHS stated that TSA will implement a documented process for reviewing and revising its Pipeline Security Guidelines at regular defined intervals, as appropriate  DHS estimated that this effort would be completed by March 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our second recommendation, that TSA clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities, DHS stated that TSA will clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities  DHS estimated that this effort would be completed by May 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our third recommendation, that TSA develop a strategic workforce plan for its Security Policy and Industry Engagement's Surface Division, DHS stated that TSA will develop a strategic workforce plan for the division, which includes determining the number of personnel necessary to meet the goals set for the Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs  DHS estimated that this effort would be completed by June 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our fourth recommendation, that TSA update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data, DHS stated that TSA will update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data  DHS estimated that this effort would be completed by February 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our fifth recommendation, that TSA fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment, DHS stated that TSA will fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool  According to DHS, this will include sources of uncertainty and any implications for interpreting the results from the assessment  DHS estimated that this effort would be completed by February 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our sixth recommendation, that TSA identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, DHS stated that TSA will identify and/or develop other sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities  DHS also stated that TSA will incorporate that data into the Pipeline Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies  DHS estimated that this effort would be completed by June 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our seventh recommendation, that TSA take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach, DHS stated that, after completing enhancements to its risk assessment approach, TSA will take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool  DHS estimated that this effort would be completed by November 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our eighth recommendation, that TSA ensure that the Security Policy and Industry Engagement's Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data, DHS stated that TSA’s Surface Division’s Pipeline Section will develop both physical and cyber security performance measures, in consultation with pipeline stakeholders, to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data  DHS estimated that this effort would be completed by November 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our ninth recommendation, that TSA take steps to enter information on CSR recommendations and monitor and record their status, DHS stated that TSA will enter information on CSR recommendations and monitor and record their status  DHS estimated that this effort would be completed by October 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our tenth recommendation, that TSA take steps to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors, DHS stated that TSA will develop written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors  DHS estimated that this effort would be completed by July 31, 2019  This action, if fully implemented, should address the intent of the recommendation  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until one day from the report date  At that time, we will send copies to the appropriate congressional committees; the Secretaries of Energy, Homeland Security, and Transportation; the Executive Director of the Federal Energy Regulatory Committee; and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Chris Currie at (404) 679-1875 or curriec@gao gov, and Nick Marinos at (202) 512-9342 or marinosn@gao gov  Key contributors to this report are listed in appendix IV  This appendix lists security guidance and guidance-related tools that the pipeline operators and industry association officials we interviewed identified as adopted or available in order to secure their physical and cyber operations  This list should not be considered to include all physical and cybersecurity guidance that may be available or used by all pipeline operators nor do all operators use all guidance listed  The Transportation Security Administration’s (TSA) Pipeline Security Branch developed the Pipeline Relative Risk Ranking Tool (risk assessment) in 2007  The risk assessment calculates threat, vulnerability, and consequence on variables such as the amount of throughput in the pipeline system (consequence input)  Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting Corporate Security Reviews (CSR) state the results of the risk ranking are the primary factor considered when prioritizing CSRs of pipeline companies  However, we identified several factors that likely limit the usefulness of the current assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems  For example, because the risk assessment has not changed since 2014, information on threat may be outdated  Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented  For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor  Further, the risk assessment does not include information that is consistent with the National Infrastructure Protection Plan (NIPP) and other Department of Homeland Security (DHS) priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data)  According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk  Rather, officials said they are primarily interested in assessing risk data that impacts security  However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation of the most critical pipeline systems would better align their efforts with Presidential Policy Directive 21 (PPD-21)  For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts  Below we present the various shortfalls in the risk assessment—outdated data, limited description of sources and methodology, and opportunities to better align with the NIPP and other DHS priorities for critical infrastructure risk mitigation—in the context of the components that comprise a risk assessment: threat, vulnerability, and consequence  Whereas in 2010 we made recommendations to improve the consequence component in the pipeline relative risk ranking tool, we have currently identified shortfalls that cut across all risk components: threat, vulnerability, and consequence  We identified several shortfalls in the pipeline risk assessment’s calculation of threat  First, while the risk assessment assesses consequence and vulnerability by pipeline system through use of multiple variables, it currently ranks threat for pipeline systems equally  Second, the evolving nature of threats to pipelines may not be reflected, since the risk assessment was last updated in 2014  Third, the threat calculation does not take into account natural hazards  Pipeline Security Branch officials said they currently rank threat equally across pipeline systems because they do not have granular enough threat information to distinguish threat by pipeline  However, ranking threat equally effectively has no effect on the risk calculation for pipeline systems  Further, this judgment is not documented in the risk assessment’s methodology  According to the NIPP, a risk assessment’s methodology must clearly document what information is used and how it is synthesized to generate a risk estimate, including any assumptions and judgments  Additionally, our analysis of the pipeline risk assessment found that it includes at least one field that TSA could use to differentiate threat by pipeline  Specifically, the risk assessment includes a field that accounts for whether a pipeline experienced a previous security threat (including failed attacks), and information provided by Pipeline Security Branch suggests some pipeline systems have experienced such threats  However, the Pipeline Security Branch did not capture these events in the risk assessment’s calculation, which Pipeline Security Branch officials said should be part of the threat calculation, but could not account for why they were not calculated for the systems in the risk assessment  These officials also clarified that incidents such as suspicious photography or vandalism do not constitute an attack to be accounted for in the threat calculation  Documenting such assumptions, judgments, or decisions to exclude information could provide increased transparency to those expected to interpret or use the results  Pipeline Security Branch officials also said that they ranked threat equally because TSA Intelligence and Analysis data show that threats to the oil and natural gas sector have been historically low, and Intelligence and Analysis does not conduct specific threat analysis against individual pipeline systems  However, the Pipeline Security Branch has not updated the risk assessment since June 2014; therefore, the threat information it used to determine threat calculations—and decide to rank threat equally—may be outdated and not reflect the threats to the industry that have emerged in recent years  In fact, pipeline operators we interviewed indicated that the types of threats that concern pipeline operators have evolved  For example, 5 of the 10 operators we interviewed indicated that environmental activists were an increased threat to the pipeline industry because they use sabotage techniques, such as valve turning and cutting in service pipelines with blow torches, against pipelines  Additionally, 6 of 10 pipeline operators we interviewed said cyber attacks from nation-state actors were a primary threat to their industry  Further, when TSA issued its revised Pipeline Security Guidelines in March 2018, it stated that its revisions to the guidelines were made to reflect the ever-changing threat environment in both the physical and cybersecurity realms  However, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology  Recent Pipeline Modal and Cyber Modal Threat Assessments include cyber threats to the pipeline industry, but the description of the pipeline risk assessment’s methodology does not specify what types of threat assessments (sources) are used to calculate its threat score  To better align with the guidance in the NIPP for documenting sources of information when conducting risk assessments, the Pipeline Security Branch should document the information used  Keeping the risk assessment updated with current information, as well as documenting those data sources, could help the Pipeline Security Branch ensure it is using its limited resources to review the pipeline systems with greater risk  Natural Hazard Threats to Pipelines The Transportation Systems Sector, of which pipelines are a part, is critical to the Pacific Northwest, but also at risk from natural hazards, like earthquakes  For example, according to the Department of Homeland Security, an earthquake in the Puget Sound region—which relies on the transportation of crude oil from Alaska—could cripple the ports of Seattle and Tacoma, as well as the Olympic and Williams Pipelines greatly impacting the Pacific Northwest Economic Region  Hurricanes are the most frequent disruptive natural hazard for the oil and natural gas subsector and can cause the shutdown of facilities in an area, even when the facilities themselves are not directly affected by the storms  For example, according to the U S  Energy Information Administration, the flow of petroleum into the New York area via pipeline from the Gulf Coast relies on the ability to move it through major terminals  In August 2017, Hurricane Harvey caused major disruptions to crude oil and petroleum product supply chains, including those to New York Harbor from Houston, Texas via the Colonial Pipeline  Due to the hurricane, decreased supplies of petroleum products available for the pipeline in Houston forced Colonial Pipeline to limit operations temporarily  Finally, another shortfall in the current pipeline risk assessment methodology is that it does not account for natural hazards in its threat calculation, even though DHS’s definition of threat includes natural hazards, and security and resilience of critical infrastructure are often presented in the context of natural hazards  According to the NIPP, threat is a natural or manmade occurrence, individual, entity, or action that has or indicates the potential to harm life, information, operations, the environment, and/or property  As such, along with terrorism, criminal activity and cybersecurity, natural disasters are a key element of DHS’s critical infrastructure security and resilience mission  According to Pipeline Security Branch officials, there is not sufficient historical data available that would indicate a significant impact from natural disasters on specific pipeline systems  However, we identified possible sources of data for the Pipeline Security Branch to consider  For example, a 2016 RAND Corporation study examined national infrastructure systems’ exposure to natural hazards, including pipelines  Additionally, the Federal Emergency Management Agency (FEMA) has collaborated with stakeholders to develop the National Risk Index to, among other things, establish a baseline of natural hazards risk for the United States While there may not be historical data of natural hazard impact for every pipeline system, consulting other sources or experts could provide regional data or analysis to build a more comprehensive threat picture to help distinguish threats by pipeline system  According to the NIPP, hazard assessments should rely not only on historical information, but also future predictions about natural hazards to assess the likelihood or frequency of various hazards  We also identified multiple shortfalls in the vulnerability factors used in the risk assessment methodology, such as the potential uncertainty of the number of critical facilities and incorporating a feedback mechanism to calculate overall risk reduction  Other considerations for vulnerability calculations include physical condition of the pipeline system, cybersecurity activities, and interdependencies among sectors  The number of critical facilities a pipeline system has identified is used as an input for its vulnerability calculation in the Pipeline Security Branch’s risk assessment methodology  As discussed earlier, we identified deficiencies in TSA’s criteria for identifying critical facilities, and found that well-defined criteria and consistent application of the criteria for identifying critical facilities could improve the results of the Pipeline Security Branch’s risk assessment  Nevertheless, communicating in the risk assessment the uncertainty that may be inherent in this self-reported information would better align the risk assessment with the NIPP  Measuring Effectiveness in a Voluntary Environment According to the National Infrastructure Protection Plan, the use of performance metrics is an important step in the critical infrastructure risk management process to enable assessment of improvements in critical infrastructure security and resilience  The metrics provide a basis for the critical infrastructure community to establish accountability, document actual performance, promote effective management, and provide a feedback mechanism to inform decision making  By using metrics to evaluate the effectiveness of voluntary partnership efforts to achieve national and sector priorities, critical infrastructure partners can adjust and adapt their security and resilience approaches to account for progress achieved, as well as changes in the threat and other relevant environments  Metrics are used to focus attention on areas of security and resilience that warrant additional resources or other changes through an analysis of challenges and priorities at the national, sector, and owner/operator levels  Metrics also serve as a feedback mechanism for other aspects of the critical infrastructure risk management approach  Another shortfall in the risk assessment is its inability to reliably measure the progress a pipeline system made in addressing vulnerability gaps between security reviews  The current risk assessment includes a CSR score as part of its vulnerability calculation, which was developed in part in response to our 2010 recommendation to use more reliable data to measure a pipeline system’s vulnerability gap  However, during our review, Pipeline Security Branch officials said they plan to remove pipeline companies’ CSR scores from the risk assessment calculations, because they and industry partners do not have confidence that the score appropriately measures a pipeline system’s vulnerability  For example, Pipeline Security Branch officials explained that pipeline companies consider security factors differently, which can lead to variation in implementing risk reduction activities and by extension lead to different CSR scores  However, removing the CSR score eliminates the only feedback mechanism in the risk assessment from a pipeline company’s actual security review conducted by the Pipeline Security Branch  The NIPP and DHS’s Risk Management fundamentals emphasize the important role that such feedback mechanisms play in risk management  Officials from the Pipeline Security Branch agree on the importance of a feedback mechanism tying results of reviews to a revised vulnerability metric, but said they need a better measure than the current CSR score which is unreliable for comparative and analytic purposes  Developing a feedback mechanism based on implementation of TSA’s Pipeline Security Guidelines could be an important input to the risk assessment’s vulnerability calculation  This information would also inform the amount of risk pipeline companies are reducing by implementing the guidelines and could be used to inform overall risk reduction  The physical and cyber environments in which the pipeline sector operates also present vulnerabilities not accounted for in the pipeline risk assessment  In recent years, DHS has listed the potential for catastrophic losses to dramatically increase the overall risk associated with failing infrastructure and highlighted risks due to climate change and natural hazards to pipelines  For example, DHS reported extreme temperatures—such as higher and lower temperatures over prolonged periods of time—increase vulnerability to the critical infrastructure by causing elements to break and cease to function  Pipelines that freeze and then rupture can affect the energy and transportation systems sectors  As noted above, according to the NIPP, a natural or man-made occurrence or action with the potential to harm life is considered a threat, whereas vulnerability is defined as a physical feature or operational attribute that renders an entity open to exploitation or susceptible to a given threat or hazard  While pipeline physical condition is typically thought of in context of safety, pipeline condition or location (such as above or below ground) could touch upon pipeline security as it relates to system vulnerability  For example, a pipeline system or segment of a system with a compromised physical condition due to corrosion or age could affect the system’s vulnerability to threats and affect its ability to recover from such threats by potentially increasing the time a system is offline  According to the Transportation Systems Sector-Specific Plan, vulnerabilities to damage in aging transportation infrastructure—of which pipelines are a part—are projected to increase with the continued effects of climate change  Further, according to TSA’s Pipeline Security and Incident Recovery Protocol Plan, pipeline integrity efforts—including the design, construction, operation, and maintenance of pipelines—are important to pipeline security because well-maintained, safe pipelines are more likely to tolerate a physical attack  The Pipeline Security Branch already collects information from the Pipeline and Hazardous Materials Safety Administration (PHMSA) for its risk assessment, specifically information on High Consequence Area and High Threat Urban Area mileage  By considering additional information PHMSA collects on pipeline integrity, the Pipeline Security Branch could also use the information to help pipeline operators identify security measures to help reduce the consequences related to the comparatively higher vulnerability of an aging or compromised system  This would align with the Pipeline Security Branch’s efforts to improve security preparedness of pipeline systems and could better inform its vulnerability calculations for relative risk ranking of pipeline systems  Capturing cybersecurity in the risk assessment is also an area for improvement  Pipeline Security Branch officials told us they consulted with the National Cybersecurity and Communications Integration Center to revise TSA’s Pipeline Security Guidelines to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and that absent data specific to pipelines on their cybersecurity vulnerabilities, they are unable to include a pipelines’ vulnerability to cyber attack in the risk assessment  However, the Pipeline Security Branch recently updated the security review questions asked of pipeline operators during corporate and critical facility reviews based on the recently updated Pipeline Security Guidelines  Using these updated questions related to companies’ cybersecurity posture, the Pipeline Security Branch could collect additional information on cybersecurity vulnerabilities which could inform the risk assessment  This could be an element of the feedback mechanism described above and emphasized in the NIPP  Additionally, NIST identified several supply chain vulnerabilities associated with cybersecurity, which are not currently accounted for in TSA’s Pipeline Security Guidelines  As pipeline operators implement increasing levels of network technologies to control their systems, the Pipeline Security Branch may not be fully accounting for pipeline systems’ cybersecurity posture by not including the cybersecurity-related vulnerabilities in its risk assessment inputs  Finally, we identified shortfalls in cross-sector interdependencies, which could affect vulnerability calculations  According to the NIPP, understanding and addressing risks from cross-sector dependencies and interdependencies is essential to enhancing critical infrastructure security and resilience  The Pipeline Security Branch’s pipeline risk assessment currently considers the effects of a pipeline system’s ability to service assets such as major airports, the electric grid, and military bases  However, consequence is calculated on the loss or disruption of the pipeline system to these other assets and does not capture the dependency of the pipeline system on other energy sources, such as electricity  Weather events such as Gulf of Mexico hurricanes and Superstorm Sandy highlighted the interdependencies between the pipeline and electrical sectors  Specifically, according to a 2015 DHS annual report on critical infrastructure, power failures during Superstorm Sandy in 2012 closed major pipelines for 4 days, reducing regional oil supplies by 35 to 40 percent  The report goes on to say that the interconnected nature of infrastructure systems can lead to cascading impacts and are increasing in frequency  Pipeline Security Branch officials are considering cross-sector interdependencies and said they discuss these factors with operators as they relate to system resiliency  Considering interdependencies of sectors in both directions—such as calculating the likelihood that an input like electricity could fail and cause disruptions to critical pipelines—could improve the calculations in the pipeline risk assessment  As previously discussed, the Pipeline Security Branch last calculated relative risk among the top 100 pipeline systems in 2014  When doing so, it used pipeline systems’ throughput data from 2010 to assess relative risk  According to Pipeline Security Branch officials, the amount of throughput in pipeline systems does not change substantially year to year  However, Standards for Internal Control in the Federal Government calls for management to use quality information to achieve the entity’s objectives, including using relevant data from reliable sources obtained in a timely manner  The Pipeline Security Branch uses throughput data as a consequence factor in the risk assessment to determine a pipeline system’s relative risk score  Throughput changes could affect relative risk ranking and the Pipeline Security Branch’s ability to accurately prioritize reviews based on relative risk  Chris P  Currie at (404) 679-1875 or curriec@gao gov Nick Marinos at (202) 512-9342 or marinosn@gao gov  In addition to the contacts named above, Ben Atwater, Assistant Director; Michael W  Gilmore, Assistant Director; and Michael C  Lenington, Analyst-in-Charge, managed this assignment  Chuck Bausell, David Blanding, Dominick Dale, Eric Hauswirth, Kenneth A  Johnson, Steve Komadina, Susanna Kuebler, Thomas Lombardi, David Plocher, and Janay Sam made significant contributions to this report 


Report 2: In the United States, both FRA and FTA regulate rail transportation safety  FRA oversees safety of railroads operating on what is known as the general system, a network of standard gage track over which goods may be transported and passengers may travel  This system includes freight railroads, which typically own their own tracks and locomotives, transporting products among states and regions  FRA also oversees safety of intercity passenger and commuter railroads that operate over tracks owned by freight railroads and other entities  FTA oversees safety of rail transit systems that typically serve individual metropolitan areas, using track not shared with freight and other passenger trains  Rail transit includes a variety of modes, such as heavy and light rail, streetcars, automated guideways, cable cars, and others  Rail transit is an important component of the nation’s transportation network, particularly in large metropolitan areas  Rail transit systems provided over 4 4 billion passenger trips in 2016  “Heavy rail” systems in large cities account for much of the total rail transit activity, including 88 percent of passenger trips in 2016  According to FTA, 61 rail transit systems within 28 states, the District of Columbia, and Puerto Rico are subject to safety oversight by one of the 31 agencies in FTA’s state safety oversight program (see fig  1)  The states have long played a central role in conducting safety oversight of rail transit systems  The Intermodal Surface Transportation Efficiency Act of 1991 required, among other things, that states with rail transit operators designate an agency to oversee the safety of those systems, known as a state safety oversight agency  In overseeing state safety agencies, FTA designed the program as one in which FTA, states, and rail transit operators collaborate to ensure the safety and security of rail transit systems  However, limitations have been identified in the state safety oversight program  In 2006, we reported on some state safety agency challenges in overseeing rail transit safety  Specifically, we found many of the state safety agencies lacked enough qualified staff and adequate levels of training to meet their responsibilities  In a 2009 hearing before the Subcommittee on Highways and Transit of the House Committee on Transportation and Infrastructure, then Secretary Ray LaHood of the Department of Transportation discussed some of the weaknesses under the current state safety oversight program and introduced a public transportation safety legislative proposal  In 2010, various bills were introduced in both houses of Congress that would have provided FTA with various enforcement mechanisms and with the authority to issue safety regulations  Additionally, the bills would have required the Secretary to establish a federal certification program for employees and contractors who carry out a state public transportation safety program  In the 112th Congress, the Senate amended a House bill to include a public transportation safety provision, which eventually became section 20021 of MAP-21, the federal public transportation safety program  MAP-21 enhanced FTA’s authority to oversee the safety of rail transit, potentially addressing some of the weaknesses identified by various stakeholders  Specifically, MAP-21 established a comprehensive Public Transportation Safety Program, which continues to rely on state safety agencies to monitor rail transit systems’ safety operations  MAP-21 required that, within 3 years of the effective date of a final state safety oversight program rule, each eligible state have in place a state safety oversight program certified by FTA  An eligible state must, among other things, establish a state safety agency and determine, in consultation with FTA, an appropriate staffing level for this state agency that is commensurate with the number, size, and complexity of the rail transit systems within the state  Additionally, a state safety agency must be financially and legally independent from any rail transit system it oversees and have investigative and enforcement authority with respect to the safety for its rail transit systems, among other things  Each eligible state has until April 15, 2019, to receive FTA approval of its state safety oversight program, or else FTA will be prohibited from obligating certain federal financial assistance to any entity in the state that is otherwise eligible to receive that federal financial assistance  After that approval, state safety agencies will be evaluated for continued compliance with FTA regulations a minimum of once every 3 years through a triennial review process  According to FTA, these requirements represent a dramatic increase in federal expectations for state safety oversight and for the rail transit industry  MAP-21 also established a state safety oversight grant program, offering federal funding to states for their state safety activities  FTA’s Office of Transit Safety and Oversight administers the state safety oversight program  Freight and passenger railroads have played a transformational role in the development of America and continue to be an important part of the economy  The general railroad system consists of a vast network of operations (see fig  2)  The $60 billion freight rail industry is operated by seven Class I, and hundreds of smaller, railroads  In addition, about 40 railroads move passengers, which carry greater than 670 million passengers per year  The federal government has long provided regulatory oversight of railroad safety, both passenger and freight, that operate on the general system  The Interstate Commerce Commission, the first federal regulatory commission in U S  history, was established in 1887 to regulate interstate commerce by rail  The Commission’s safety functions were transferred to FRA, which was created by the Department of Transportation Act in 1966  In its role as federal regulator and overseer of railroad safety, FRA prescribes and enforces railroad safety regulations and conducts research and development in support of improved railroad safety and rail transportation policy  FRA utilizes safety inspectors and specialists, primarily covering five safety disciplines, to review and enforce compliance with these regulations  FRA’s safety disciplines are track, signal, and train control; motive power and equipment; operating practices; and hazardous materials  Following several fatal rail accidents between 2002 and 2008, the Rail Safety Improvement Act of 2008 was enacted, the first authorization of FRA’s safety programs since 1994  This act directed FRA to, among other things, issue new safety regulations for different aspects of railroad safety, such as hours of service requirements for passenger railroad workers, positive train control implementation, track inspection rules, and safety at highway-rail grade crossings  FRA’s Office of Railroad Safety administers the agency’s safety program  Rail transportation is a relatively safe way to transport people and products though serious incidents continue to occur on railroads and rail transit  According to an analysis of DOT’s Bureau of Transportation Statistics data by the American Public Transportation Association, travel by rail transit is far safer than automobile travel  From 2000-2014, for instance, there were 6 53 and 0 33 fatalities per billion passenger-miles traveled in cars or light trucks and rail transit, respectively  Within rail travel, the fatality rates on both railroads and rail transit operators have remained similar in recent years  Further, the rate of accidents and incidents—including collisions and derailments—also do not appear to differ substantially between railroads and rail transit in recent years  Nevertheless, serious incidents continue to occur on railroads and rail transit, posing safety risks to passengers, railroad employees, and the public  For example, in June 2009, two WMATA trains collided, resulting in 52 injuries and 9 deaths  A smoke incident on WMATA’s Metrorail system in January 2015 also resulted in the death of 1 person and injured over 90  In a 10-month period from May 2013 to March 2014, the Metro- North commuter railroad, which serves New York and Connecticut, was involved in five accidents that resulted in the death of 6 people and 126 injured  In June 2016, two BNSF Railway freight trains collided near Panhandle, Texas, resulting in the death of three crew members  Incidents such as these have prompted investigations into both the causes and contributing factors of the specific accidents as well as broader rail safety oversight  FRA has a more centralized safety oversight program for railroads, while FTA is implementing changes to the rail transit oversight program, established in federal statute, which relies on states to monitor and enforce safety  Key characteristics of both programs include: (1) the establishment of safety regulations, (2) inspections and other oversight activities, such as audits and investigations, based on those regulations, and (3) enforcement mechanisms to ensure that safety deficiencies are addressed (see fig  3)  FRA has developed extensive railroad safety regulations over decades  FRA’s railroad safety regulations include requirements governing track design and inspection, grade crossings, signal and train control, mechanical equipment including locomotives, and railroad-operating practices including worker protection rules  For example, FRA’s regulations for track and equipment include detailed, prescriptive minimum requirements, such as formulas that determine the maximum allowable speeds on curved track  Many of FRA’s rail safety regulations establish minimum safety requirements, though railroads can apply for waivers  As FRA updates its safety regulations, it has proposed more performance-based regulations in recent years  Many of FRA’s current safety regulations specify the behavior or manner of compliance that railroads must adopt, such as inspecting each locomotive at least every 92 days  Performance-based regulations, however, specify a desired outcome rather than a behavior or manner of compliance  For example, FRA’s recent rulemaking to amend its passenger equipment safety regulations proposes performance-based crashworthiness and occupant protection requirements, rather than explicit targets or tolerances  According to FRA, establishing performance requirements in these areas would allow a more open rail market that incorporates recent technologies  FTA is currently assessing the need for rail transit safety regulations, having been provided the authority to issue safety regulations in 2012  Since MAP-21 was enacted, FTA has finalized regulations implementing the public transportation safety program authorized by statute  These include regulations that establish rules for FTA’s administration of a comprehensive safety program to improve rail transit safety as well as updated regulations governing state safety oversight of rail transit  In addition to its public transportation safety program regulations, FTA also has regulations governing its drug and alcohol testing program  MAP-21 also authorized FTA, for the first time, to issue rail transit safety regulations, which would establish minimum safety performance requirements for rail transit operators, as part of its requirement to develop a National Public Transportation Safety Plan  FTA initiated a regulatory development effort after the passage of MAP-21, which included a compilation and evaluation of existing transit safety standards, guidance, and best practices from the federal government, states, industry, and other sources  After the evaluation, FTA issued a report that concluded there was limited documentation or evidence of the effectiveness of these existing rail transit safety standards  The report included recommendations that are intended to enable FTA to undertake further data-driven, risk-based analysis of rail transit safety performance and the applicability and effectiveness of the identified safety standards  FTA is also currently analyzing specific focus areas to determine any areas that should be addressed by federal safety regulations  For example, FTA is studying the need for regulations related to rail transit vehicle crashworthiness  Since no federal rail transit safety regulations that establish minimum safety performance requirements for rail transit operators currently exist, rail transit operators are subject to different safety standards, depending largely on what voluntary standards they have chosen to adopt, according to American Public Transportation Association officials we spoke with  The American Public Transportation Association, for instance, has issued a variety of rail transit safety standards, addressing various aspects of the industry including operations, training, and inspections  In addition, states vary in the extent to which they have regulations for rail transit operators  For example, officials from the California Public Utilities Commission noted that it has issued a variety of safety regulations applicable to rail transit operators within the state of California to improve safety of rail operations  Both FRA and FTA have mechanisms to gather the input of stakeholders—including rail operators, labor unions, industry associations, and others—when considering development of safety regulations  In developing most of its safety regulations, FRA seeks input from stakeholders through its Railroad Safety Advisory Committee  In 1996, FRA established this committee to develop new regulations through a collaborative process, with the rail community working together to create mutually satisfactory solutions to safety issues  FTA is collaborating with stakeholders as it assesses the need for rail transit safety regulations  More specifically, FTA’s research partner, the Center for Urban Transportation Research, established a working group to collaborate with industry stakeholders to inform the safety regulations development process  FTA also solicited comments from industry stakeholders on its compilation of existing rail transit safety standards  More broadly, FTA also has a Transit Advisory Committee for Safety, which provides information, advice, and recommendations to FTA on safety matters  FRA fulfills its mission, in part, through safety compliance audits and inspections, and investigations  FRA ensures compliance with its safety regulations through inspections, using a staff of railroad safety experts, inspectors, and other professionals assigned to eight regional offices across the nation  For example, to determine a railroad’s compliance with FRA safety regulations, inspectors examine track, equipment, signal devices, employee actions, and procedures and review maintenance and accident records  Additionally, 31 states have rail safety programs that partner with FRA  Under this approach, FRA enters into agreements with states to allow state inspectors to participate in investigative and surveillance activities concerning federal railroad safety laws  State inspectors who participate in this program submit inspection reports to FRA  More broadly, FRA’s inspections are guided by a risk-based model  Under this approach, FRA focuses its inspections on locations that, according to the data-driven model, are likely to have safety problems  Like other operating administrations within DOT, FRA has relatively few resources for overseeing railroads, compared with the size of the general system  The risk-based model is designed to help FRA target the greatest safety risks  FRA has begun utilizing automated inspections as well  In particular, according to FRA, new imaging technologies have the potential to better inspect track for cracks in the rail that could lead to breakage as well as measure the track’s geometry to ensure that rails are positioned to meet standards  To further promote safety in railroad operations, FRA conducts accident investigations  Separate from investigations conducted by NTSB, FRA investigates select railroad accidents to determine root causation, and any contributing factors, so that railroad properties can implement corrective actions to prevent similar incidents in the future  Resources for railroad safety oversight activities have increased in recent years  FRA was appropriated about $218 million in fiscal year 2017, an increase over the approximately $187 million it received in fiscal year 2015, for safety and operations, which funds FRA’s personnel, including inspectors, and safety programs  According to FRA, Congress provided FRA with increased funding in recent years for the purpose of increasing staffing related to specific safety issues, such as trespasser prevention and passenger rail safety  As part of this effort, FRA has hired additional inspectors, going from 347 inspectors in fiscal year 2013 to over 360 currently, out of the nearly 930 total full-time equivalent staff  FRA officials told us, as we have reported in the past, that it can be difficult to recruit, train, and certify qualified inspectors in a timely manner, especially in certain areas of expertise  Further, according to FRA, its inspectors have the ability to inspect less than 1 percent of the general system annually  Though FTA now has more robust inspection authorities, states will continue to conduct front-line rail transit safety oversight activities  MAP- 21 provided FTA with new authorities to inspect, audit, and investigate practices at rail transit agencies, including safety practices, while also preserving the role of state safety agencies to monitor rail transit systems’ safety operations  According to FTA officials, any federal inspections of rail transit operators are intended to supplement a state safety agency’s oversight activities, except where FTA assumes temporary, direct oversight of a rail transit system from an inadequate state safety agency  FTA officials told us that establishing a nationwide safety inspection program at the federal level is inconsistent with the statutory framework of the state safety oversight program and with congressional intent, which contemplates preserving the primary role of state safety agencies in providing direct safety oversight of rail transit systems  The officials also noted that the state-based approach to rail transit safety oversight is valuable because states are generally closer to, and more familiar with, rail transit operators  To date, FTA has utilized its new inspection authorities only on WMATA’s rail system  As part of oversight activities, some state safety agencies have conducted inspections of the rail transit systems they oversee, though they were not required to do so, according to FTA officials we spoke with  To strengthen states’ abilities to conduct oversight activities, FTA has recommended that state safety agencies develop risk-based inspection programs  Further, to ensure the independence of state safety agencies, these agencies cannot receive funding from the rail transit entities they oversee  Resources for FTA’s rail transit safety oversight administrative expenses have remained relatively stable in recent years, though more are needed, according to FTA  Since fiscal year 2012, FTA’s appropriations for administrative expenses, which funds FTA personnel and support activities including the Office of Transit Safety and Oversight, has increased $14 million, to about $113 million in fiscal year 2017, according to FTA  However, for several years, FTA has averaged about 508 total full-time equivalent staff agency-wide, and a little over 30 safety staff in the Office of Transit Safety and Oversight  According to FTA, the Office of Transit Safety and Oversight has been under-resourced since it was established in response to new safety authority provided in MAP-21  For fiscal year 2018, FTA requested in their submission for the President’s Budget proposal funding to hire up to an additional 20 positions for various lines of safety work  FRA’s and FTA’s oversight activities also include regular audits of, and communication with, the rail operators under their oversight  Given finite resources and large rail networks, FRA and FTA audit rail operators’ own inspections rather than conducting comprehensive federal inspections  More specifically, FRA inspectors, and state safety agencies in FTA’s oversight program, regularly examine records of rail operators’ internal inspections to identify safety deficiencies  Officials from FRA, FTA, and five rail stakeholders we spoke with told us that FRA and FTA rail safety oversight programs also rely on collaboration and communication between rail operators and regulators to ensure safety  For example, regular meetings between FRA and railroad staff to discuss safety trends and industry developments are important to ensuring safety, according to officials we spoke with from FRA and the railroads  FRA specialists and inspectors participate, with representatives of railroad labor and management, in the implementation of voluntary safety programs  For example, FRA sponsors the Confidential Close Call Reporting System, a voluntary, confidential program allowing railroads and their employees to report accident and incident “close calls ” According to FRA officials, voluntary programs such as this increase industry awareness of railroad safety and engagement with it  FTA also collaborates with state safety agencies as rail transit safety issues arise, according to FTA officials, using federal oversight and enforcement authorities as a “back-stop” against the oversight of state safety agencies  Additionally, according to officials we spoke with from FTA and two rail transit operators, state safety agency staff meet with rail transit operators regularly, using knowledge of local operating conditions to help ensure safety  FRA uses a variety of tools, including civil penalties, to resolve safety issues  While some safety issues are resolved informally through discussion and collaboration between FRA and railroads, as noted above, some defects identified during inspections are classified as violations and subject to financial penalties  More specifically, when railroads do not resolve issues in a timely manner or identified defects are serious, FRA has the authority to cite violations and assess civil penalties, against either railroads or individuals  Further, as authorized by law, FRA negotiates settlements with railroads and other entities subject to its safety jurisdiction to resolve claims for civil penalties  In fiscal year 2016, FRA assessed over $11 8 million in civil penalties against railroads  According to FRA, fiscal year 2016 was the second year in a row that it took steps to increase penalty amounts paid by railroads, as part of a continued effort to increase consequences for violations that negatively affect safety  To ensure the safety of rail transit systems, states will continue to be the primary enforcers of safety requirements, according to FTA officials, though FTA now has more enforcement tools  MAP-21 preserved the role of state safety agencies as the primary enforcement body for rail transit  FTA has now required that state safety agencies have enforcement authorities sufficient to compel action from rail transit entities to address safety deficiencies  Though no specific authorities are required, FTA has suggested that a variety of mechanisms could be appropriate, such as the ability to remove deficient equipment from service or assess fines  According to FTA, this requirement is designed to overcome a long- standing vulnerability in state safety oversight, which allowed safety deficiencies to remain for long periods of time  MAP-21 and the FAST Act also provided FTA with more options for enforcement when rail transit operators are found to be out of compliance with safety requirements  In particular, FTA can withhold federal funding for rail transit operators or direct a rail transit operator to use federal funding for a specific purpose  Additionally, after FTA assumes temporary direct oversight of an inadequate state safety agency, FTA can withhold federal funds from the state until the state safety oversight program has been certified  To date, FTA has utilized this authority only with the states responsible for safety oversight of WMATA’s rail system  In February 2017, FTA announced that it would withhold 5 percent of fiscal year 2017 urbanized area formula funds from Maryland, Virginia, and the District of Columbia until a new state safety oversight program is certified for WMATA’s rail system  This action built upon FTA’s determination that WMATA’s state safety agency was ineffective at “providing adequate oversight consistent with prevention of substantial risk of death or personal injury ” FRA and FTA also have the authority to directly intervene in rail operations  In particular, both FRA and FTA can suspend the service of rail operators in response to certain safety concerns  Additionally, FTA can assume direct safety oversight of a rail transit operator if FTA determines the state safety oversight program is not adequate, among other things  In response to safety incidents on WMATA’s rail system, FTA assumed temporary and direct safety oversight of WMATA in October 2015, as previously noted

ground_truth: More than 2.7 million miles of pipeline transport and distribute oil, natural gas, and other hazardous products throughout the United States. Interstate pipelines run through remote areas and highly populated urban areas, and are vulnerable to accidents, operating errors, and malicious physical and cyber-based attack or intrusion. The energy sector accounted for 35 percent of the 796 critical infrastructure cyber incidents reported to DHS from 2013 to 2015. Several federal and private entities have roles in pipeline security. TSA is primarily responsible for the oversight of pipeline physical security and cybersecurity. GAO was asked to review TSA's efforts to assess and enhance pipeline security and cybersecurity. This report examines, among other objectives: (1) the guidance pipeline operators reported using to address security risks and the extent that TSA ensures its guidelines reflect the current threat environment; (2) the extent that TSA has assessed pipeline systems' security risks; and (3) the extent TSA has assessed its effectiveness in reducing pipeline security risks. GAO analyzed TSA documents, such as its Pipeline Security Guidelines ; evaluated TSA pipeline risk assessment efforts; and interviewed TSA officials, 10 U.S. pipeline operators—selected based on volume, geography, and material transported—and representatives from five industry associations. Pipeline operators reported using a range of guidelines and standards to address physical and cybersecurity risks, including the Department of Homeland Security's (DHS) Transportation Security Administration's (TSA) Pipeline Security Guidelines , initially issued in 2011. TSA issued revised guidelines in March 2018 to reflect changes in the threat environment and incorporate most of the principles and practices from the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity . However, TSA's revisions do not include all elements of the current framework and TSA does not have a documented process for reviewing and revising its guidelines on a regular basis. Without such a documented process, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical security and cybersecurity, or address the dynamic security threat environment that pipelines face. Further, GAO found that the guidelines lack clear definitions to ensure that pipeline operators identify their critical facilities. GAO's analysis showed that operators of at least 34 of the nation's top 100 critical pipeline systems (determined by volume of product transported) deemed highest risk had identified no critical facilities. This may be due, in part, to the guidelines not clearly defining the criteria to determine facilities' criticality. To assess pipeline security risks, TSA conducts pipeline security reviews—Corporate Security Reviews and Critical Facility Security Reviews—to assess pipeline systems' vulnerabilities. However, GAO found that the number of TSA security reviews has varied considerably over the last several years, as shown in the table on the following page. TSA officials stated that staffing limitations have prevented TSA from conducting more reviews. Staffing levels for TSA's Pipeline Security Branch have varied significantly since fiscal year 2010 with the number of staff ranging from 14 full-time equivalents in fiscal years 2012 and 2013 to 1 in 2014. Further, TSA does not have a strategic workforce plan to help ensure it identifies the skills and competencies—such as the required level of cybersecurity expertise—necessary to carry out its pipeline security responsibilities. By establishing a strategic workforce plan, TSA can help ensure that it has identified the necessary skills, competencies, and staffing. GAO also identified factors that likely limit the usefulness of TSA's risk assessment methodology for prioritizing pipeline system reviews. Specifically, TSA has not updated its risk assessment methodology since 2014 to reflect current threats to the pipeline industry. Further, its sources of data and underlying assumptions and judgments regarding certain threat and vulnerability inputs are not fully documented. In addition, the risk assessment has not been peer reviewed since its inception in 2007. Taking steps to strengthen its risk assessment, and initiating an independent, external peer review would provide greater assurance that TSA ranks relative risk among pipeline systems using comprehensive and accurate data and methods. TSA has established performance measures to monitor pipeline security review recommendations, analyze their results, and assess effectiveness in reducing risks. However, these measures do not possess key attributes—such as clarity, and having measurable targets—that GAO has found are key to successful performance measures. By taking steps to ensure that its pipeline security program performance measures exhibit these key attributes, TSA could better assess its effectiveness at reducing pipeline systems' security risks. Pipeline Security Branch officials also reported conducting security reviews as the primary means for assessing the effectiveness of TSA's efforts to reduce pipeline security risks. However, TSA has not tracked the status of Corporate Security Review recommendations for the past 5 years. Until TSA monitors and records the status of these reviews' recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk. GAO makes 10 recommendations to TSA to improve its pipeline security program management (many are listed on the next page), and DHS concurred. GAO recommends, among other things, that the TSA Administrator take the following actions: implement a documented process for reviewing, and if deemed necessary, for revising TSA's Pipeline Security Guidelines at defined intervals; clarify TSA's Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities; develop a strategic workforce plan for TSA's Security Policy and Industry Engagement‘s Surface Division; update TSA's pipeline risk assessment methodology to include current data to ensure it reflects industry conditions and threats; fully document the data sources, underlying assumptions and judgments that form the basis of TSA's pipeline risk assessment methodology; take steps to coordinate an independent, external peer review of TSA's pipeline risk assessment methodology; ensure the Security Policy and Industry Engagement‘s Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures; and enter information on Corporate Security Review recommendations and monitor and record their status.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.



Report 2:  FRA and FTA’s approaches to their rail safety oversight missions each have strengths and limitations, including how the agencies develop safety regulations, conduct inspections, and carry out enforcement  Compared to FRA’s long-standing role in providing safety oversight over railroads, FTA is in the process of implementing significant changes to its program for rail transit safety oversight after being granted new authorities in MAP- 21 and the FAST Act  With respect to regulations, FRA’s extensive and well-established safety regulations are a strength  FTA has made some progress toward developing appropriate safety regulations, such as identifying subjects for potential regulatory action  With respect to inspections, FRA’s use of a risk-based approach to distributing inspection resources is a strength  FTA has sought to address previously identified deficiencies in state safety oversight by recommending that state safety agencies develop risk-based inspection programs  FTA, though, has not provided states guidance for these efforts  With respect to enforcement, FRA’s use of its enforcement authorities is a strength  FTA is also implementing new statutory requirements that state safety agencies have enforcement authorities but does not have a process or methodology to evaluate the effectiveness of these enforcement practices  Extensive and well-established safety regulations are a strength of FRA’s safety oversight program based on studies we reviewed and discussions with rail operators and stakeholder organizations  According to NTSB, FRA’s railroad safety regulations are an important and effective part of its oversight program  Our previous work reported that according to stakeholders, the Railroad Safety Advisory Committee provides a collaborative environment where stakeholders in the rail community work with FRA to identify issues and proposals for safety standards and regulations that improved the quality of railroads’ safety initiatives and fostered a greater level of compliance with safety regulations  This is consistent with views of stakeholders we spoke with, who characterized FRA’s safety regulations as a strength  An industry association told us that FRA’s regulations promote safety by helping to ensure that no operator falls below a minimum threshold for safe operations, while a rail operator told us that federal regulations help to standardize the operating environment and prevent a patchwork of various state regulations  Four stakeholders also characterized the Railroad Safety Advisory Committee, which plays a large role in crafting FRA’s railroad safety regulations, as effective and inclusive  However, based on studies we reviewed and discussions with rail operators’ and stakeholders’ organizations, FRA faces limitations in its efforts to regulate safety across railroad systems that differ from one another and sometimes change more quickly than the federal regulatory process  Five railroad operators and an industry association told us that some of FRA’s safety regulations do not account for differences in railroads or innovation in safety practices, with three railroad operators stating that this approach requires the extensive use of waivers for particular regulations  Further, two railroad operators and a rail transit operator we spoke with stated that additional federal regulations are needed to provide minimum baseline requirements in specific areas of railroad safety such as medical fitness for duty  In 2014, NTSB also found that FRA needs to do more to regulate particular safety issues including medical fitness for duty and signal protection  FRA officials acknowledged that time and resources are two of the primary challenges that the agency faces when developing safety regulations but also noted additional ways in which the agency can require railroads to adopt safety practices  FRA officials described the process of creating or significantly amending a regulation as involving years of work, even before the agency commences with the process of drafting a rule  The officials also noted that the agency has additional tools to compel railroads to adopt safety practices  For example, FRA officials discussed the use of compliance agreements, in which railroads can have fines reduced in exchange for adopting safety measures that go beyond what FRA regulations require  FRA officials are considering the use of performance-based regulations as they update their safety regulations  As noted above, FRA’s proposed regulations regarding passenger equipment safety incorporates performance -based safety requirements, rather than explicit safety targets or tolerances  FRA has promulgated performance-based regulations about the implementation of positive train control, a communications-based system designed to prevent certain types of train accidents, as well as system safety programs that set general safety parameters and thresholds by which successful performance is governed  FRA’s consideration of performance-based regulations is in line with federal guidance  OMB’s Circular A-4 states that performance standards “are generally superior to engineering or design standards because performance standards give the regulated parties the flexibility to achieve regulatory objectives in the most cost-effective way ” Additionally, under Executive Order 12866, agencies should (to the extent permitted by law and where applicable) identify and assess alternative forms of regulation and specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt  However, as the language of OMB’s Circular A-4 and Executive Order 12866 suggest that performance-based regulations are not always feasible, studies of performance-based regulations find that as with any other form of regulation, performance-based standards have trade-offs  FRA officials told us that under certain circumstances, performance- based regulations are appropriate for issues regarding design, maintenance, operation, and technology-driven safety requirements  FRA officials we spoke with did not think performance-based standards are appropriate for areas that require standardization  One example is track safety standards, where the need for different operators to use the same equipment precludes a performance-based approach that allows railroads to meet requirements through different means  FRA officials added that a key aspect of the success of performance-based regulations concerns how railroads demonstrate compliance  This concern is consistent with other studies of performance-based regulations, which find that these regulations are most appropriate when regulators have capacity to measure and monitor performance  Though FTA has made progress assessing the state of rail transit safety standards, a limitation of FTA’s rail transit safety oversight program is the lack of federal rail transit safety regulations, which may contribute to inconsistent safety practices across the rail transit industry, according to studies we reviewed and discussions with rail operators and stakeholder organizations  NTSB reported that the structure of FTA’s oversight process leads to inconsistent practices, inadequate standards, and marginal effectiveness  In addition, a 2016 DOT OIG report found that because FTA’s safety standards are voluntary, they are unenforceable  In 2012, FTA gained the authority to issue safety regulations, though it has not done so yet, and NTSB and other stakeholders we spoke with indicated that the lack of such federal safety regulations is a weakness in federal rail transit safety oversight  Despite differences across rail transit systems, there is value in establishing federal rail transit safety regulations, according to stakeholders from all categories of those we interviewed, including a state safety agency, three rail transit operators, a railroad operator, and two industry associations  Some stakeholders identified specific areas that would benefit from federal rail transit regulations  For example, two rail transit agencies called for federal regulations to address operator fatigue  Some of these officials stated that federal rail transit safety regulations could help ensure safety by establishing clear and consistent minimum standards  Officials from a rail transit entity and an industry association stated that voluntary standards are not enough to ensure that transit entities will adopt appropriate safety measures  According to our analysis, a past study, and stakeholders we spoke with, FTA’s ability to develop and implement performance-based regulations is limited by its lack of capacity to collect and analyze rail safety performance data  In 2017, DOT OIG found that data limitations of FTA’s National Transit Database results in limited safety performance criteria in FTA’s National Public Transportation Safety Plan  Further, two rail transit entities as well as a state safety agency we spoke with stated that they face challenges in analyzing data due to either the size of their systems or their capacity  FTA officials told us that they need more data to inform their decisions regarding whether to establish rail transit safety regulations, and also added that a limitation to their ongoing assessment of potential areas for rail transit safety regulation is the concern about public disclosure of safety data provided to FTA and its potential use in private litigation  According to FTA officials, they need more information to do a comprehensive evaluation of efficacy of current safety standards and practices  As required by the FAST Act, FTA has entered into an agreement with the National Academies of Sciences, Engineering, and Medicine, to conduct a study to evaluate whether it is in the public interest to withhold from federal or state court proceedings any information collected by DOT through its public transportation safety program oversight activities  The National Academies of Sciences is expected to complete this study in 2018  FTA is taking positive steps toward developing safety regulations that may address inconsistent safety practices across rail transit operators  FTA officials stated that the agency is considering issuing rail transit safety regulations and also employs additional tools to compel rail transit entities to adopt safety measures  As noted above, FTA is currently studying whether federal regulations are appropriate for specific areas of rail transit safety  Executive Order 12866 and OMB’s Circular A-4 direct federal agencies to consider performance-based regulations when developing regulations  Further, as the Transportation Research Board recently reported, any decision to use performance-based regulations “must take into account the regulator’s own ability to enforce and motivate compliance (through methods such as auditing and field inspections) as well as the capacity of regulated entities to meet their obligations ” FTA officials noted that they are actively engaged with members of the Transportation Research Board in reviewing and discussing these recent findings related to safety regulations for high-hazards industries  In January 2017, FTA issued its National Public Transportation Safety Plan, which FTA officials noted is one component of their transit safety standard development program  According to FTA officials, the plan identifies a list of issue areas that the agency is currently studying to determine whether national regulations are needed  FTA officials also stated that the plan includes “voluntary standards,” which are intended to put the industry “on notice” that federal safety regulations may be proposed in those areas  FTA officials stated that they view the National Public Transportation Safety Plan as iterative and more easily updated compared with official regulations  Additional tools that FTA officials stated the agency employs in its approach to safety oversight include general directives as well as the requirements associated with FTA grants  Based on our assessment and studies we reviewed, a strength of FRA’s safety oversight program is its risk-based approach to distributing inspection resources, which may serve as an example for FTA and state safety agencies  According to NTSB, FRA’s qualified inspectors are a strength of its oversight program  To help target these inspectors to the areas of highest risk, FRA developed the National Inspection Plan, which includes a quantitative model for allocating inspection resources in a way that tries to minimize railroad accidents  This model utilizes data including: (1) accident and incident data that railroads are required to report, (2) data from FRA inspection activity, and (3) information on railroad activities such as train miles and other data  Based on our assessment of FRA’s model, we believe that it can be an appropriate and useful tool for directing its inspection resources based on risk because it relies on statistical methods commonly used to predict the risk of a violation for regulated entities  While we did not review FRA’s entire modeling process, nor did we validate the results it generates, we do believe that FRA’s approach to using these statistical models as a key part of its inspection program is appropriate  However, a potential limitation of FRA’s inspection program is the flexibility granted to individual inspectors and whether the manner and extent to which inspectors implement this discretion may be inconsistent with the risk-based National Inspection Plan  FRA’s National Inspection Plan provides guidance for inspectors about how much time they should spend inspecting individual railroads  According to FRA officials, FRA inspectors have considerable flexibility to deviate from the National Inspection Plan based on their judgment regarding where to more effectively use their resources  FRA officials stated that situations arise that call for deviations in planned inspections  For example, a particular railroad may experience a serious accident and therefore require more oversight from FRA  According to FRA officials, regional offices make these decisions based on their understanding of emerging issues  Inspectors are expected to know their region and decide which locations to go to, and are in part evaluated based on these decisions  When a region’s record of total inspection time spent on a particular railroad differs from the National Inspection Plan by more than 5 percent, the region’s leadership submits an explanation to FRA’s Office of Railroad Safety  This practice, if not monitored, could allow inspectors to deviate from the data-driven model results in ways that undermine the goal of the National Inspection Plan to deploy FRA’s limited resources efficiently and based on risk  However, FRA officials told us that flexibility for individual inspectors is important, and that FRA is continuously monitoring the model’s performance and making changes as appropriate  Further, OECD’s Best Practice Principles for Regulatory Policy note that it is important to ensure “that sufficient flexibility is left to enforcement and inspection officials to adapt their response in proportion to the facts on the ground ” A strength of FTA’s approach to rail transit safety oversight is that it is working to overcome weaknesses in state oversight of rail transit identified in our prior work and stakeholders we spoke with  For example, FTA has noted that in the past some state safety agencies lacked sufficient oversight authorities  To now be certified by FTA, state safety agencies must demonstrate that they have authority to review, approve and oversee the implementation of rail transit operator’s safety plans  Additionally, we have found, and FTA has also noted, that some state safety agencies would benefit from more training and additional staff  To now be certified by FTA, state safety agencies must be capable of directly hiring and developing staff and contract support, as well as have a training plan for certain staff  Though FTA is seeking to implement stronger safety oversight activities, a limitation of its program is that state safety agencies have not received the guidance and support necessary to develop effective inspection programs  FTA does not currently plan to conduct widespread inspections itself and recommends that state safety agencies develop risk-based inspection programs  According to FTA, states have discretion to establish their inspection programs in accordance with their program standards, and are not required to actually conduct inspections as the method of verifying rail transit operators’ compliance with safety rules  However, direct observation, audits, and performance indicator tracking are useful methods for an oversight agency in assessing a regulated entity’s safety culture  Officials we spoke with from selected state safety agencies say that they have received little guidance from FTA on what their risk-based inspection programs should look like  In the materials FTA provided to states, it said that it intends to provide guidance to states on risk-based inspections but did not provide us with a plan or timeline for doing so  Without guidance from FTA, state safety agencies may not develop effective risk-based inspection programs and thus not use their resources efficiently  Effective risk-based inspection programs are particularly important given state safety agencies’ limited resources  We have reported in the past that some state safety agencies lack sufficient resources, including training and staff  Officials from two rail transit operators and all four industry associations we spoke with stated that state safety agencies continue to have limited resources and capacity  Several state safety agencies we spoke with rely on contractors or employees with other responsibilities besides oversight of rail transit to meet their increased oversight responsibilities and achieve certification from FTA  Federal standards for internal control as well as leading practices for regulatory inspections state that agency objectives, including those related to inspections and enforcement, should be clearly communicated  Specifically, federal standards for internal control require that management communicate the necessary quality information to achieve the agency’s objectives  Additionally, the OECD’s Best Practice Principles for Regulatory Policy recommends that governments ensure clarity of rules and processes for enforcement and inspections and clearly articulate rights and obligations of officials  According to OECD, the frequency of inspections and the resources employed should be proportional to the level of risk  A strength of FRA’s safety oversight program is that the agency has and utilizes clear enforcement authority, according to NTSB and stakeholders we spoke with  As previously discussed, FRA has several enforcement tools available when inspectors find that railroads are noncompliant with applicable regulations, including civil penalties, individual liability, compliance orders, and emergency orders  According to NTSB, this array of specific enforcement tools helps ensure safety deficiencies are addressed by railroads  FRA officials also told us that the process of adjudicating civil penalties provides a forum for FRA and railroad officials to meet to discuss safety issues  Four rail operators also told us that FRA’s authority to issue civil penalties is necessary to ensure railroads’ compliance with regulations  However, a potential limitation of FRA’s approach to enforcement is that it is difficult to quantify the effectiveness of FRA’s civil penalties  FRA has reported that it cannot determine whether observable safety improvements are directly attributable to discrete civil penalties or whether the amount of civil penalties has any effect on safety  We have reported in the past about the challenges of determining the effect of penalties on compliance in tax policy, though we also noted that, despite these challenges, some analyses likely would be useful for better understanding the effect of penalties on compliance  FRA also reported, though, that according to the judgments of its inspectors, issuing civil penalties yields observable improvements in safety practices and compliance with the law  Further, according to FRA, though it does not quantify the impact of civil penalties, FRA monitors railroad responses to its enforcement activity and adjusts its oversight as necessary  More broadly, civil penalties are not meant, by themselves, to ensure railroad safety  Instead, FRA reported that it uses its entire regulatory regime as a whole to try and ensure safety  FRA officials also noted that the agency has additional tools, apart from civil penalties, to compel railroads to adopt safety practices  A strength of FTA’s rail transit safety oversight is that it seeks to improve historically weak state safety agency enforcement authorities, as described in our previous report as well stakeholders we spoke with  FTA requires state safety agencies to adopt enforcement authorities that are sufficient to enable states to compel action from rail transit agencies to address identified deficiencies  FTA has also communicated to states that it is focusing its evaluation of each state’s enforcement authorities in two major areas: ensuring that the state can carry out its primary responsibility for rail transit safety in response to (1) an imminent threat to public safety on the rail transit system and (2) a lack of action or non- compliance from the rail transit operator in carrying out certain safety plans  FTA has provided states with examples of the enforcement authorities and policies state safety agencies could establish to address these specific concerns  Authorities to address imminent safety threats may include the authority to suspend rail transit agencies’ operations, inspect and remove deficient equipment or system infrastructure from service, or issue an order requiring the rail transit agency to correct an unsafe condition prior to placing equipment or infrastructure back into passenger service  FTA has also provided state safety agencies with examples of authorities to address a lack of action or cooperation by the rail transit operator, including the authority to withhold or redirect funds, levy civil or criminal fines or penalties, and a formal citation or ticketing program  Though federal law requires that state safety agencies have enforcement authorities over the safety of the rail transit entities they oversee, a limitation of FTA’s approach is that FTA has not developed a method to evaluate the effectiveness of states’ enforcement practices  Certified state safety agencies will be evaluated for continued compliance with FTA regulations every 3 years  This triennial review process (for rail transit safety) seeks to ensure that states are effectively carrying out their responsibilities  While FTA officials told us that they will evaluate state safety agencies’ enforcement during the triennial reviews, FTA has not developed a process or methodology to evaluate whether state enforcement authorities and practices as a whole are effective  Without a method for determining the effectiveness of state safety agencies’ enforcement, FTA may not have the information needed to identify ineffective safety enforcement  As a result, deficiencies may remain for long periods of time, potentially contributing to safety incidents  Federal standards for internal control maintain that agency managers should perform a range of practices that would facilitate the establishment of a system to monitor the effectiveness of agency activities, which in the context of FTA’s mission includes the effectiveness of its rail transit safety oversight  Agency managers should define objectives clearly to enable the identification of risks, establish activities to monitor performance measures and indicators, and externally communicate the necessary quality information to achieve the entity’s objectives  Internal control standards further stipulate that agency managers should perform monitoring activities regarding their internal control system and evaluate the results  To do so, federal standards for internal control state that agency managers should monitor ongoing operations and effectiveness, evaluate the results of this monitoring, and identify any changes that need to be made to achieve improvement in agency operations  The effectiveness of state safety agency enforcement is especially important because questions have been raised about the efficacy of FTA’s own enforcement mechanisms, including its ability to withhold funds from and assume direct control over safety oversight for a rail transit entity  Rail transit operators and industry association representatives we spoke with stated that FTA’s authority to withhold funding from states is overly punitive, and two stakeholders said the FTA needs more precise tools  Officials from an industry association added that withholding funds can be counterproductive, as most state safety agencies are already underfunded and understaffed  FTA officials pointed to examples in which the agency successfully supported state safety agencies in compelling action from rail transit agencies as evidence that the state safety oversight model, in which FTA backs up state safety agencies, is effective  Additionally, officials from numerous state safety agencies and others questioned whether FTA has the capacity to effectively assume direct safety oversight of rail transit operators  FTA has not assumed direct safety oversight of any rail transit operators outside of WMATA, and FTA officials noted that they intend to continue supporting state safety agencies in their oversight wherever possible  The approaches to rail safety oversight utilized by FRA and FTA each have strengths and limitations  However, FTA’s program is currently in transition as the agency implements new authorities and responsibilities provided in federal law  Though FTA has made progress by evaluating existing rail transit safety standards and providing some guidance to states as part of the certification process, limitations in FTA’s approach may still hinder the success of the state-based rail transit safety oversight program  Given the looming 2019 deadline for state safety oversight programs to achieve FTA certification, FTA can improve its efforts to implement its new rail transit safety oversight program  In particular, without guidance from FTA on how to develop and carry out risk-based inspection programs, state safety agencies may not use limited resources efficiently, risking that important safety issues will go undetected  Further, without a method for how it will monitor the effectiveness of states safety agencies’ enforcement, FTA will lack the information needed to identify ineffective state enforcement, which risks allowing safety deficiencies to remain for long periods of time  By providing this additional guidance and direction to the state safety agencies, FTA would help ensure that states are able to effectively identify and resolve rail transit safety issues  We are making the following two recommendations to FTA: The Office of Transit Safety and Oversight should create a plan, with a timeline, for developing guidance for state safety agencies about how to develop and implement a risk-based inspection program  (Recommendation 1) The Office of Transit Safety and Oversight should develop and communicate a method for how it will monitor the effectiveness of the enforcement authorities and practices of state safety agencies  (Recommendation 2) We provided a draft copy of this report to DOT, NTSB, and WMATA for review and comment  In written comments, reproduced in appendix I, DOT agreed with both our recommendations  DOT also provided technical comments, which we incorporated as appropriate  In e-mails, NTSB and WMATA provided technical comments, which we incorporated as appropriate  NTSB noted that we do not discuss the role of system safety initiatives, such as safety management systems, in the FRA and FTA rail safety oversight programs  We agree with NTSB that system safety concepts are increasingly influencing the FRA and FTA approaches to rail safety oversight but, as NTSB also noted, both FRA and FTA lack finalized regulations codifying their approaches to system safety initiatives  Because the extent of rail entities’ implementation of these initiatives varies and is not complete we did not include an assessment of the strengths and limitations of those initiatives in our scope  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the Secretary of Transportation, Chairman of NTSB, General Manager of WMATA, and the appropriate congressional committees  In addition, the report will be available at no charge on GAO’s website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-2834 or goldsteinm@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  Individuals who made key contributions to this report are listed in appendix II  In addition to the contact named above, Steve Cohen (Assistant Director); Kyle Browning (Analyst in Charge); Melissa Bodeau; Lacey Coppage; Serena Lo; Sean Miskell; and Josh Ormond made key contributions to this report 
Report 2:  Central to estimating the magnitude of these distortions is determining who bears the economic burden, or incidence, of the tax  The economic incidence of a tax can differ from the statutory incidence (i e , who is obligated by law to pay the tax) depending on conditions in the affected market  Once the economic incidence of a tax is established, the exact distortions to consumers and producers can be determined as well as any other economic activity that is typically discouraged by a tax  The statutory incidence of the DST is borne by firms that provide covered services  For example, under the Spanish DST, companies that sell online advertising services, provide platforms for online marketplaces and intermediation services, and data transfer services—all to users with IP addresses within Spain's jurisdiction—will be subject to the DST (providing that they meet the threshold requirements)  The economic incidence of such a tax could vary depending on the structure and characteristics of those individual markets, as explained in more technical detail in the Appendix   Under one scenario, digital economy firms providing services subject to the DST are perfectly competitive, and the economic burden is borne by the consumers of the digital services in the form of higher prices over the long term  For example, Spain levies its DST on firms that place digital advertisements, based on the revenue earned from showing advertisements on the search results and web pages of users with Spanish IP addresses  In a perfectly competitive market, firms providing digital advertisements earn zero economic profit in that they could not earn a higher rate of return via alternative investments  When faced with the DST, these advertising firms can either (a) exit the industry and pursue higher returns in other industries that are not subject to tax or (b) pass along the tax in the form of higher prices to businesses that purchase the advertising services  The firms purchasing digital advertising could be Spanish companies, but they could also be foreign firms purchasing advertisements that are ultimately targeted to Spanish users  In this case, the imposition of a DST in a competitive market will increase the price of taxable services and lead to a decline in the quantity demanded  The exact magnitude of these changes will depend on the responsiveness, or "elasticity," of the companies purchasing the internet advertising to changes in price  Assuming that companies purchasing the advertising services are also operating in a perfectly competitive market, they are faced with the same options as the firms that sell internet advertising: exit the industry or pass the tax along to consumers of their goods  Higher prices could result in lower consumer demand for the advertised product  The magnitude of this reduced demand depends on the responsiveness of consumer demand to changes in price (i e , the price elasticity of demand)  Thus, a DST imposed on intermediary services can have ripple effects downstream within markets  Under perfect competition, the economic incidence of an upstream DST is ultimately borne by the final consumers of those advertised products  Under an alternative scenario, sellers of digital services (e g , Google, Facebook, Amazon) could be monopolies, or a small number of firms could have "market power" (the ability to influence the price for their services prevailing in the market), and at least part of the tax is borne by these firms in the form of reduced economic profits  Firms can derive market power from a number of factors  For example, lack of competition could enable one firm to have a significant effect on the prevailing rate of digital advertising services  Also, the presence of complements and substitutes could affect market power  In contrast to firms in perfectly competitive markets, firms that have market power are able to earn positive economic profits, also known as "supernormal profits," because they are able to set a price above their marginal cost of production  Some have argued that digital economy firms are more likely to generate supernormal profits because the marginal cost of scaling production of their business model is relatively low, if not costless  For example, the marginal cost for Facebook to display an advertisement to a user is basically zero  Others argue that some firms generate supernormal profits because they are operating in an oligopoly or near-monopoly  For example, most search results are conducted through Google, and Facebook has the most users among social media platforms  These arguments, though, may not provide clear indication of supernormal profits  A variation of the first argument could have been made during the rise of the retail catalog industry, where the marginal cost of producing a single magazine and mailing it to a consumer was relatively small  However, the presence of competing catalog retailers should have driven the prices of firms down close to their marginal costs (which encompass more than just the cost of printing one additional catalog)  The second argument could be seen to misidentify the structure of "two-sided markets" in which many digital economy firms provide services to individual users as well as businesses  For example, Google provides search engine results to individual users (at no cost) and sells advertising space on those search results to businesses  Even if Google dominates the search engine market, it still competes against other firms, such as Facebook, for digital advertising  Digital economy firms also compete with nondigital economy methods of providing advertising services (e g , television, print, and radio), which could constrain their ability to set prices well above their marginal cost of production  When faced with the DST, a monopolist or firms with market power bear at least some of the tax in the form of lower profit  This analysis is explained in more detail in the Appendix   How much of the tax is passed along to companies buying the advertising placement (and their customers) depends on the elasticities of supply and demand in those markets  Like the analysis in the competitive market, consumers in the affected industries reduce their demand in response to higher prices  The ultimate implication of the analyses above is that DSTs introduce distortions in various markets by reducing the financial return to capital in digital economy industries or by raising the cost of goods and services intermediated through digital platforms  Investment in affected markets would be expected to decrease  An example of the former would shift investment out of digital economy firms (e g , as retailers purchase more print, television, or radio advertisement instead of internet advertisement or increased sales via brick-and-mortar or catalog outlets instead of digital), while an example of the latter would involve a reduction in demand of the final goods  The exact magnitude of these changes will vary based on the responsiveness of supply and demand in those various markets  Distortions can also arise in different ways depending on how a particular country's DST is applied to different firms  These issues are described more in the " Differential Treatment of Firms " section below  The principle of vertical equity generally implies that taxpayers with a greater ability to pay the tax should generally pay a greater share of their household income in taxes compared to households with a lesser ability  A tax is "progressive" if higher income households pay a greater share of their income in tax than lower-income households, whereas the opposite is true in a regressive tax system  If the economic incidence of DSTs resemble that of an excise tax rather than a tax on corporate profits, as discussed in the " Economic Efficiency " section, this finding also has an impact on the vertical equity analysis of DSTs  A review of the economic literature shows that the majority of the corporate income tax is borne by capital (i e , the corporation's shareholders) with the residual being borne by labor, or workers  Capital, here in the form of stock ownership, tends to be disproportionately concentrated in higher-income households  In contrast, excise taxes are commonly borne by consumers in the form of higher prices  Excise taxes are often regressive, as lower-income households bear a higher share of their pre-tax income on consuming goods and services than higher-income households  The exact equity effects of DSTs could vary based on different abilities for intermediate firms to pass the tax along to consumers, the nature of the goods and services that they sell, and the responsiveness of consumers in those relative markets  For example, assume that Facebook charges higher prices for advertising on the social media platform to companies, and companies are able to pass those higher advertising costs in full to their customers in the form of higher prices  If one of those companies sells luxury cars and another sells consumer household goods, the DST has more progressive effects in the former case and more regressive effects in the latter  In the aggregate, though, there is little reason to assume that final consumers of goods and services sold through taxable activities in digitized business models are disproportionately higher-income  Thus, it can be expected that a DST affecting a broad range of goods and services is more likely to be regressive than not, especially when compared to a tax on corporate profits  DSTs create unequal economic treatment between similarly situated firms inside and outside of the digital economy  Firms outside of the digital economy can earn just as much global or local revenue as firms taxed under DSTs without being subject to an additional layer of tax on their revenue  Firms outside or inside the digital economy can also engage in profit shifting and "aggressive" transfer pricing to reduce their taxes owed in a country  DSTs, as they have been presented thus far, also create inequalities for firms of similar size based on certain exemptions and thresholds  For example, each of the specific European DST proposals use different or multiple thresholds based on total cross-border profits, revenue generated from covered business activities, "clicks" or interaction based from local users, etc  While proponents of these DSTs with minimum thresholds might have other policy goals in mind (e g , exempting smaller businesses from potentially costly tax compliance burdens), the exact levels at which these thresholds are drawn among larger MNCs are arbitrary from a policy perspective  Critics of DSTs would argue that the thresholds are drawn to exclude domestic MNCs or to target the taxes to a narrow set of foreign MNCs  Regardless of their rationale, these thresholds create concerns of inequitable treatment between different sectors  In the situation where the tax is fully passed along to consumers, digital firms either charge a higher price (reducing demand) or exit the industry  Where the MNCs subject to the statutory incidence of the tax bear at least a portion of the economic incidence of the DST, then they face a lower return to business investment in that country compared to firms not subject to the DST  Additionally, the UK DST's proposed exemption or "safe harbor" for "low profit" firms could create another layer of equity concerns  If the exemption is based on low profits as calculated by UK tax rules, then firms that are not subject to the UK corporate income tax (because they do not have a permanent establishment in the UK) will not be eligible for the exemption  In other words, if a firm must be subject to the UK corporate income tax to be eligible for exemption then, by definition, the exemption is not available to foreign MNCs  MNCs with similar amounts of global revenue would be subject to different effective tax rates on their worldwide consolidated earnings (across all related entities) based on whether they were subject to UK income taxes or not  An alternative exemption being considered by the UK, based on global consolidated profits, could have some administrative issues, as discussed in the next section of this report  DSTs present several administrative challenges to both the public and private sectors  With regard to the public sector, lawmakers and revenue-collecting agencies will have to clarify exactly what types of activities are subject to tax and which parties bear the statutory burden of paying tax  These decisions affect the costs of administering the tax or the gross revenue collected by the tax  With regard to the private sector, the decisions made by lawmakers and agencies could affect the costs of complying with DST regimes  Technology could present administrative challenges to the implementation of DST proposal  First, some digital economy platforms allow users to opt out of having their data tracked or resold to third parties  Without this information a digital service provider may be able to fulfill a user's desire for privacy, but the absence of the information limits the provider's ability to apply proper taxes based on the customer's jurisdiction  "Do not track" or internet browser plugins that make it more difficult for companies to track users' activities could affect the measurement of data collected from local users  Second, users could reroute their internet traffic to servers outside of the country imposing the DST and mask their physical location  Virtual private network services (VPNs) allow users to access websites while making it appear that their IP addresses are from locations other than their actual locations  VPNs connect users to servers located in different parts of the world  Websites will see that a user's web traffic is originating from the VPN server, which could or could not be in the same jurisdiction as the user  Typically, VPNs are used for anonymity reasons or to bypass firewalls and website censors imposed in certain jurisdictions  VPNs are not sufficient to protecting a user's IP address, as other unmasking techniques (some requiring more effort) can be used  Still, users could use VPNs located outside of the taxing jurisdiction to reduce the flow of user activity attributed to IPs within the taxing jurisdiction, thereby reducing revenue collected from "local" user activity  Even if this does not completely eliminate the revenue base for a DST, VPN use still results in mismeasurement of the amount of revenue attributed to local users  Overall, lawmakers writing DSTs would likely need to consider specifying what level of enforcement would be sufficient for companies to make good faith efforts to source their revenues to local users  More due diligence required by companies to determine the source of their users or unmask user efforts designed to preserve their privacy will impose higher costs to the companies  A lower standard might require fewer resources from firms and be less intrusive on user privacy but reduce the amount of tax raised from local users  Thus, DSTs could present policy tradeoffs between individual privacy concerns and tax revenue collection  Two features of the UK's proposed DST create additional administrative challenges  An exemption based on low UK-source profits could also have unintended consequences for proponents of the DST in the form of reduced revenue  Some digital economy MNCs do have subsidiaries physically located in Europe  For example, these firms might have the purpose of providing customer service or call centers that speak the local language or market the company's lines of business  Generally, these types of business activities are low profit margin  If a digital economy MNC does have a permanent establishment in the UK that earns close to zero profits, thereby owing little to no income tax in the UK, does the tax situation of this local subsidiary justify an exemption for the entire MNC controlled group? If so, the MNC could still be technically generating millions of British pounds in revenue from sales to UK customers over the internet  In contrast, an MNC that does not have a UK subsidiary but also has millions in revenue from sales to UK customers would not be eligible for the low-profit exemption  The clear tax planning implication of such an interpretation of the low-profit exemption is that MNCs should establish a low-profit subsidiary in the UK as a means to claim the low-profit margin exemption  If allowed, then the UK DST would likely raise little to no revenue  Alternatively, the UK could base its low-profit exemption based on worldwide profits of the MNC  In the United States, corporations are required to report a number of tax-related calculations and information on their annual Securities and Exchange Commission filings for shareholders  Among these tax-related data are their effective tax rate and tax paid across all jurisdictions where the firm is subject to tax  However, the tax data reported under financial accounting rules typically varies from actual tax paid  This phenomenon is described as "book-tax differences " For example, different rules for depreciation are typically used for accounting purposes compared to actual tax policy in a jurisdiction (e g , if the lawmakers in that country decided to speed up cost recovery with the intent of increasing business investment)  Thus, an exemption based on financial disclosure forms may not accurately reflect taxable income  U S  corporations are allowed to claim a tax credit against U S  corporate income tax liability for income taxes paid to foreign jurisdictions  The rationale is to prevent double taxation of foreign-source income  DSTs are taxes on revenue earned from specific business activities and should not be eligible for U S  foreign tax credit treatment for several reasons  First, such taxes are not income taxes under common bilateral tax treaty language  Statements from some countries imposing DSTs, such as the UK, indicate that they do not intend DST payments to be creditable against taxes that an MNC might owe in its home country  Nor are DSTs "in lieu of income taxes," as the countries imposing DSTs do have a corporate income tax system  The Internal Revenue Service (IRS) could clarify that U S  bilateral income tax treaties do not provide for a foreign tax credit against U S  tax for U S  corporations that make DST payments to foreign jurisdictions  If the IRS does not do so, then Congress could enact legislation denying a U S  foreign tax credit for such payments  Denying a foreign tax credit could increase the total taxes paid by U S  MNCs in jurisdictions around the world, but allowing DST payments to be creditable would effectively force the U S  Treasury (and U S  taxpayers) to subsidize tax rates imposed by foreign jurisdictions  Policymakers who sympathize with the premise that MNCs in the digital economy are unfairly able to shift profits to low-tax jurisdictions could still disagree with the unilateral response of foreign countries to impose DSTs  The tax on GILTI serves as an alternative policy tool intended to impose higher effective tax rates on U S  firms in the digital economy  For example, in the 115 th Congress, the No Tax Break for Outsourcing Act ( H R  5108 ; S  2459 ) would have increased the GILTI tax rate to 21% and eliminated the deduction for the return on tangible assets derived by domestic corporations from serving foreign markets in computing GILTI tax liability, among other provisions  As discussed, above, DSTs have the same economic effects as an excise tax  It is not controversial for countries to levy excise taxes on imported as well as domestically consumed goods or services  Such taxes are considered to not distort trade  However, some DST proponents have not explicitly labeled them as "excise taxes," making it unclear how these taxes should be viewed in terms of international agreements  Regardless of the label attached to them, some commentators argued that DSTs violate restrictions on tariffs under the rules of the World Trade Organization  For example, some scholars argue that the high-revenue thresholds for taxation and the exclusion of certain revenues earned by European firms effectively discriminate against the digital exports of U S  firms  Many proponents of DSTs argue that they are "interim measures" until the international community adopts broader reforms in international tax rules  As mentioned in the discussion of the European Commission's DST proposal, the commission prefers changes, both inside and outside of the EU, in the permanent establishment rules to incorporate some measure of "digital presence " This goal aligns with the EU's goal of a consolidated tax base among its members and formulary apportionment of corporate tax revenue based on a set of factors (e g , sales, assets, employment), which would result in a shift away from tax allocation based on assets  The form and rationale of DSTs appear to better comport with a formulary apportionment tax being pursued in the EU than a traditional national corporate income tax  The inability for consensus to impose a DST at the European Commission level could lead more individual member states to unilaterally impose their own DSTs  Even if the United States objects to unilateral DSTs, these sovereign countries are generally able to impose their own tax systems (within the boundaries of any other international agreements, such as EU membership)  Congress could consider creating "carrots" or "sticks" affecting the policy choices of DST proponents  Tax policy and legal scholars have debated the merits of "potential compromises" that would not require fundamental rewrites of international tax rules  Some of these options would rely on the executive branch for day-to-day negotiations at a bilateral or multilateral level (e g , at the OECD)  Any modification to existing or new tax treaties, though, would require Senate approval  Congress could also direct the executive branch to impose incentives (and disincentives) that would affect key sectors of the EU economy  An evaluation of these emerging ideas and concepts is, however, beyond the scope of this report  DSTs Are Not Structured as Taxes on Profits Corporate profit is generally defined as: (1) π=TR-TC Where π is profit, TR is total revenue, and TC is total cost  This is before taxes  After tax corporate profit, π t , for a firm after imposition of a percentage tax ( t ) on corporate profit, is defined as: 2 πt=(1-t)(TR-TC) In contrast, a DST ( dst ) is levied as a percent of total, gross revenue yielding an after tax profit, π dst , of: 3 πdst=(1-dst)TR-TC Algebraically, equations (2) and (3) are not equivalent  To further illustrate, the following amounts can be substituted: TR = $1,000, TC = $500, and t = 0 03 (or a 3% tax rate)  Using these parameters, πt based on a 3% profit tax would be: 4 πt=(1-0 03)($1,000-$500) 5 πt=$485 Using these parameters, πdst based on a 3% DST revenue tax would be: 6 πdst=(1-0 03)$1,000-$500 7 πdst=$470 As shown above, after-tax profit for a corporation subject to a 3% income tax rate (equation 5) is greater than after-tax profit for a corporation subject to a 3% DST (equation 7) in lieu of an income tax  The two taxes are not the same  Effects of a DST on Supply-Demand Conditions in Digital Markets To analyze the economic effects of a DST, the different markets in which digital economy firms operate must be conceptualized  In a general sense, the consumers or buyers in these markets are those that pay money to the supplier or seller for the provision of a service  Many firms in digital economies operate in "two-sided markets" in which they provide services to two different consumers: individual users and businesses  While both sides of these markets could be relevant for calculating DST liability, the markets for the latter group of services are the starting point for analyzing the economic effects of a DST, because these business-to-business transactions are where the statutory incidence of a DST is typically first imposed  For example, in the market for internet advertisements, a clothing company could be the consumer and Google or Facebook could be the seller or supplier  In the market for marketplace sales, a vendor could be the consumer and Amazon could be the seller or supplier  In the market for user data sales, a data transfer firm could be the consumer and Facebook, Google, or Fitbit could the supplier  From an economic perspective, there are two extremes of market structure: perfect competition and monopoly  Most market structures lie somewhere in between  Monopolies rarely exist, and they are typically regulated  For reasons explained below, there are specific reasons why monopolies are likely not to exist in the markets in which DSTs apply  However, firms could have market power if there are barriers to entry  The following analyses examine how a DST would apply, over the long run, in the two extremes of market structure for a digital economy firm facing a downward sloping demand curve  Analysis of a DST in a Competitive Market In perfect competition, firms face a downward-sloping demand curve, and the supply curve is perfectly elastic (horizontal) as increases in output are achieved by new firms entering the industry over the long run  Each firm earns no economic profit, meaning that the opportunity cost of investing in alternative ventures is zero, and each is a price taker in the market (i e , an individual firm cannot influence the price prevailing in the market)  In this scenario, when the government imposes an excise tax, firms must ultimately pass on the cost of the tax to their consumers or exit the market  The market for services provided by firms in the digital economy could be depicted as "perfectly competitive " Under this scenario, many firms are willing to provide a relatively similar service  These markets can be outlined more narrowly to encompass only activities by other digital economy firms (e g , internet advertising, marketplace sales, data transfer), or they can be outlined more broadly (e g , consumer advertising, retail outlets, consumer marketing research)  In other words, although users typically associate Facebook as primarily a social network and Google as primarily a search engine, both firms may operate and compete in the same market for internet advertising  Additionally, both firms compete in the larger market for consumer advertising alongside television, print, and radio advertisers  If a clothing seller is deciding where to spend his advertising budget, that seller can purchase advertising placements on Facebook, Google, etc  (not to mention television, print, and radio)  Similarly, a data transfer company looking to purchase and analyze user data then selling marketing services for another good or service not only has the choice to purchase data from Facebook, Google, etc ; it can also collect data from other companies that collect data and surveys on consumer preferences  Figure A-1 and Figure A-2 illustrate the long-run effects of a DST in a perfect competition scenario with demand curves of different slopes  The demand curves are downward-sloping because consumers demand less of the taxed service as price increases  The different slopes represent scenarios where consumer demand is more responsive, or elastic, to changes in price ( Figure A-1 ) and less responsive, or inelastic ( Figure A-2 )  The supply curves in both figures are flat, or "infinitely elastic" because suppliers, in the aggregate, are able to adjust their capacity to meet whatever level of consumer demand prevails in the market  In both figures, the initial equilibrium (E), before the tax, between the prevailing market price (P) and quantity (Q) is denoted by an asterisk superscript (*)  After the tax is applied, the change in equilibrium between price and quantity is denoted by a subscript ( t )  In both figures, the tax is also passed forward to consumers in the form of higher prices  Firms reduce output or some firms exit the market because participants earn zero economic profit  If the DST rate is 3%, for example, then suppliers in a competitive market are assumed to increase price by 3% minus any tax savings (i e , deductions for excise tax payments from any income tax owed to the jurisdiction imposing the DST)  In Figure A-1 , imposition of a DST causes prices to rise and quantity demanded to fall in the market  The magnitude of the change in quantity is roughly similar to the change in price in the illustration below, but in a market with relatively elastic demand, the change in quantity can exceed the change in price  One cause for this phenomenon is the availability of near-substitutes  For example, if television advertisement is equally as effective as internet advertising, then a tax increasing prices of the latter will lead to a larger decline in demand as more companies purchase advertisements on television instead of the internet  In Figure A-2 , imposition of a DST also causes prices to rise and quantity demanded to fall in the market  With a relatively inelastic demand curve, though, the magnitude of the change in price exceeds the change in quantity  This could be caused, for example, by a lack of substitutes (e g , a strong preference for internet advertising or lack of alternative outlets to online marketplaces to sell goods and services)  In this case, the change in price is greater than the change in quantity demanded  Many of the services subject to a DST are intermediate inputs to the final sales of other goods and services  This means that the method of analyzing the effects of the DST would be replicated for each stage in the supply chain  For example, if a DST increases the price of advertising a clothing company's products over the internet, then that clothing company will likely increase the cost of the clothing that it charges its customers (the retail consumer in the country levying the tax)  The exact magnitude of the effects will vary depending on elasticities of supply and demand in that downstream market for retail clothing sales  In a perfectly competitive retail clothing market, though, it is anticipated that prices will increase and quantity demanded will decrease  In addition to effects on price and quantity prevailing within a market, DSTs can also have "welfare effects " Under this method of analysis, economists consider changes to consumer surplus, producer surplus, and deadweight loss  Consumer surplus is the total benefit of value of a good or service that consumers receive beyond what they actually pay in the market  It is depicted on a supply-demand graph as the area below the demand curve and above the price  Producer surplus is the benefit to producers from selling a good or service at a price higher than their marginal cost of producing one additional unit  It is depicted on a supply-demand graph as the area above the supply curve and below the price  Deadweight loss is an inefficiency in the market that is typically introduced by government intervention, such as a tax, that results in a loss in economic activity and potential losses to consumer or producer surpluses  In a supply-demand graph of a competitive market, like the ones above, deadweight loss is depicted as the center triangle created after the imposition of a tax  Welfare analyses of the DSTs depicted in Figure A-1 and Figure A-2 indicate that they reduce consumer surplus, have no effect on producer surplus, and create deadweight loss inefficiencies  Before the imposition of a DST, consumer welfare is measured as the areas a + b + c in both figures  This area indicates that consumers are receiving benefits from consuming goods or services subject to DSTs in excess of the price they actually pay for them  This could be in part because social media platforms, shopping on online marketplaces, or using search engines are free to consumers  After the imposition of a DST, though, consumer welfare is reduced to the area a   As producers increase the cost of goods and services subject to a DST, consumer welfare decreases due to higher costs  The area b becomes revenue collected by the government and the area c becomes deadweight loss in economic activity discouraged by the DST  There is no effect on producer surplus, because it does not exist in a perfectly competitive market  In a perfectly competitive market, producers are price takers and earn no economic profit  The main differences in Figure A-1 and Figure A-2 are due to the slope of the demand curve  The relatively inelastic demand in Figure A-2 leads to greater reductions in consumer welfare, more tax revenue collected, and smaller deadweight losses  This is because a relatively inelastic demand curve indicates that consumers are less responsive to changes in price  If consumers are unable to substitute away from goods or services subject to DSTs toward nontaxed activities, then they pay higher prices for taxed activities, and the government collects more revenue  Analysis of a DST in a Monopoly Market Some argue that major firms in the digital economy have "monopoly power " Proponents of this assertion could point out that Facebook is the largest social media platform or that Google is the predominant search engine  Others may say that digital economy platforms create network effects that prevent competition  For example, Facebook is able to maintain its status as the most popular social media platform because the value of interacting on a network with billions of users exceeds a new platform with only a few users  Similarly, Amazon might be characterized as a monopoly because many customers shop and provide reviews on its website, so a vendor looking for exposure to the largest customer base will choose to pay for the service of listing its products on that site compared to a smaller internet marketplace  These views may be seen, by others, as misguided because they are viewing the opposite side of the two-sided markets in the digital economy or defining the "market" too narrowly  As explained in the perfect competition analysis, above, Google and Facebook can be viewed as competitors in the market for selling digital advertising space or data transfer services even if they have some degree of market power on the other side of the market (e g , search engines and social networks)  Additionally, digital economy firms also compete against "non-digital" competitors  For example, in the larger markets for consumer product advertising, internet companies compete with advertising via television, print, and radio  Whether firms have supernormal profits or economic rents in an industry is often difficult to determine  In general, the presence of high accounting profits (total revenue minus total costs) is not indicative of whether a firm has profits in an economic sense  Economic profits take into consideration the opportunity costs of investing in a different income-producing activity  There is typically a risk-free portion of the return to any investment  For example, in the corporate sector this could be the average rate of return of the stock market  However, riskier investments generally require a higher potential return in order to attract capital (also known as the "risk premium")  The point of this distinction is that high accounting profits can be an indication of a higher risk premium  For the sake of argument, Figure A-3 illustrates the effects of a DST in a hypothetical monopoly market where there is one producer  An example of this phenomenon in the digital economy could be a single firm that sells internet advertising, marketplace sales, or data transfers to a potential buyer  Figure A-3 illustrates a monopoly market before the imposition of a tax  In a monopoly market, the seller still faces a downward-sloping demand curve  However, the monopolist does not have a supply curve because it does not accept the price prevailing in the market (like individual sellers in a competitive market)  Instead, it sets price (P M ) and output (Q M ) at the intersection of marginal revenue (MR) and marginal cost (MC) to arrive at a profit-maximizing equilibrium (E M ) along the demand curve  The upward-sloping MC represents the fact that the monopolist firm faces increasing marginal costs as it increases the quantity supplied in the market  The monopolist also has an upward-sloping average total cost (ATC) curve, which includes the upward-sloping function of the MC curve plus added fixed costs of production  Unlike producers in the competitive markets in Figure A-1 and Figure A-2 , the monopolist in Figure A-3 earns economic profits, or rents  Economic profit per unit sold is the difference between the price charged by the monopolist (P M ) and the ATC curve, or the distance bc   That average profit per unit times the total number of units sold ( dc ) equals the total economic profit earned by the monopolist, as shown in the gray shaded box ( abcd )  The effects of a DST on a monopoly market are illustrated in Figure A-4   A DST shifts the demand curve in as consumers of taxed services respond to higher after-tax prices  As a result of the reduced demand, the marginal revenue earned by the monopolist declines, and the MR curve shifts from MR M to MR t   The equilibrium in the market shifts from E M to E t   Quantity decreases from Q M to Q t   The price faced by the consumer in the market increases from P M to P t   The price received by the monopolist, though, decreases from P M to P Mt   The economic profit earned by the monopolist under the new post-tax demand and MR t curves is represented by the gray shaded box ( fghi )  The revenue collected by the government is represented by the dashed-line area just above the monopolist's profit  Changes to deadweight loss is not illustrated on Figure A-4 , but they can be explained in qualitative terms  The presence of a monopoly market creates deadweight loss relative to a competitive market because P M is set higher than the price where supply and demand intersect in the competitive market (e g , in Figure A-1 and Figure A-2 )  When a tax is introduced on top of the distortions caused by the monopolist, the size of the deadweight loss in the market is further increased 

ground_truth: In 2012 and 2015, DOT was provided with additional authority to oversee the safety of rail transit. Within DOT, FTA is now implementing this authority. The DOT's Office of Inspector General has reported, though, that FTA faces challenges in carrying out its enhanced safety oversight. FRA, also in DOT, has long carried out safety oversight of freight, intercity passenger, and commuter railroads. GAO was asked to review various rail safety and oversight issues, including the differences between FRA's and FTA's rail safety oversight programs. This report examines (1) key characteristics of FRA's and FTA's rail safety oversight programs and (2) strengths and limitations of FRA's and FTA's rail safety oversight programs. GAO assessed FRA's and FTA's information about rail safety oversight activities against guidance from the Office of Management and Budget, leading practices developed by the transit industry, and federal standards for internal control. GAO also interviewed stakeholders, including rail operators chosen based on mode, size, and location. The Department of Transportation's (DOT) Federal Railroad Administration (FRA) and Federal Transit Administration (FTA) carry out different approaches to rail safety oversight. FRA has a more centralized safety oversight program for railroads, while FTA's program for oversight of rail transit safety largely relies on state safety agencies to monitor and enforce rail transit safety, as established in federal statute. Key characteristics of both programs include: (1) safety regulations, (2) inspections and other oversight activities, and (3) enforcement mechanisms to ensure that safety deficiencies are addressed (see figure). There are strengths and limitations to FRA's and FTA's approaches to their safety oversight missions, including how the two agencies develop safety regulations, conduct inspections, and carry out enforcement. The National Transportation Safety Board has reported, and stakeholders GAO spoke with generally agreed, that strengths of FRA's rail safety oversight program include its safety regulations, its risk-based inspection program, and its enforcement authorities. FRA also has potential limitations in its oversight framework, though, such as difficulty evaluating the effectiveness of its enforcement mechanisms. FTA has made some progress implementing changes to the rail transit safety program. However, FTA has not provided all the necessary guidance and support to states' safety agencies to ensure they develop appropriate and effective rail transit safety inspection programs. In particular, FTA has not provided states with guidance on how to develop and implement risk-based inspection programs. Though FTA has said that it will develop such guidance, it does not have a plan or timeline to do so. Without guidance from FTA on how to develop and carry out risk-based inspections, state safety agencies may not allocate their limited resources efficiently, and important safety issues may go undetected. In addition, FTA has not developed a process or methodology to evaluate whether state safety agency enforcement authorities and practices are effective. Without clear evidence that state safety agencies' enforcement is effective, states and FTA may not be able to compel rail transit operators to remedy safety deficiencies. As a result, deficiencies may remain for long periods, potentially contributing to safety incidents. GAO recommends that FTA (1) create a plan, with timeline, for developing risk-based inspection guidance for state safety agencies, and (2) develop and communicate a method for how FTA will monitor whether state safety agencies' enforcement practices are effective. DOT agreed with our recommendations. DOT, NTSB, and WMATA provided technical comments that we incorporated as appropriate.