Department of Homeland Security 

Office of Inspector General 

DHS Grants Used for Mitigating Risks to 
 

Amtrak Rail Stations 
 

(Redacted)
 


OIG-11-93 June 2011 
Office Offce of Inspector General ofInspector General 

U.S. U.S. Department of Homeland Security Department of Homeland Security

Washington, Washington, DC 20528 DC 20528

Homeland Homeland

Security Security

JUN JUN 2 '7 2011 2'1 2011

Preface Preface

The The Department of 
 Department ofHomeland Homeland Security (DHS) Offce ofInspector General (OIG) was Security (DHS) Office ofInspector General (01G) was 

established established by the Homeland Security Act of2002 (Public Law 107-296) by amendment by the Homeland Security Act 0/2002 (Public Law 107-296) by amendment 

to to the Inspector General Act of 1978. This is one of a series of audit, inspection, and the Inspector General Act of1978. This is one of a series of audit, inspection, and 

special special reports prepared as part of our oversight responsibilities to promote economy, reports prepared as part of our oversight responsibilities to promote economy, 

efficiency, effciency, and effectiveness within the department.
 and effectiveness within the department. 

This This report addresses the strengths and weaknesses of the Transportation Security report addresses the strengths and weaknesses of the Transportation Security 

Administration's Administration's assistance provided to Amtrak for mitigating known vulnerabilities at assistance provided to Amtrak for mitigating known vulnerabilities at 

high-risk high-risk rail stations. It is based on interviews with employees and offcials of relevant rail stations. It is based on interviews with employees and officials of relevant 

agencies agencies and institutions, direct observations, and a review of applicable documents. and institutions, direct observations, and a review of applicable documents. 

The The recommendations herein have been developed to the best knowledge available to our recommendations herein have been developed to the best knowledge available to our 

office, office, and have been discussed in draft with those responsible for implementation. We and have been discussed in draft with those responsible for implementation. We 

trust this report wil result in more effective, effcient, and economical operations. We trust this report will result in more effective, efficient, and economical operations. We 

express our appreciation to all of those who contributed to the preparation of this report. express our appreciation to all of those who contributed to the preparation of this report. 

av~ iLL (J~i~ Anne L. Richards Anne L. Richards 

Assistant Inspector General for Audits Assistant Inspector General for Audits 
 

Table of Contents/Abbreviations 

Executive Summary .............................................................................................................1 
 

Background..........................................................................................................................2
 


Results of Audit ...................................................................................................................5 
 

DHS Did Not Ensure That Amtrak Directed Grant 
 

Funds to Highest Known Rail Station Vulnerabilities...................................................5 
 

Grant Recipient Coordination.....................................................................................5 
 

Rail Station Vulnerabilities Remain ...........................................................................6 


 Corrective Action Planning.........................................................................................8 
 

Lower Priority Projects Approved..............................................................................9 
 

TSA Grant Project Decision and Approval Process Not Documented .....................10 
 

Limited TSGP Funds Expended on High-Risk Mitigation ......................................11 
 

Other Challenges Impacting Rail Station Vulnerabilities .........................................14 
 

Conclusion ................................................................................................................14 
 

Recommendations..............................................................................................................15
 


Management Comments and OIG Analysis ......................................................................15 
 

Appendices 

Appendix A: Purpose, Scope, and Methodology.......................................................18 
 

Appendix B: Management Comments to the Draft Report .......................................20 
 

Appendix C: Photos of Some Remaining Vulnerabilities .........................................25 
 

Appendix D: Major Contributors to this Report........................................................26 
 

Appendix E: Report Distribution ..............................................................................27 
 

Abbreviations 

DHS Department of Homeland Security 
 

FEMA Federal Emergency Management Agency 
 

GAO U.S. Government Accountability Office 
 

IPRP Intercity Passenger Rail Program 
 

OMB Office of Management and Budget 
 

OIG Office of Inspector General 
 

SAIC Science Applications International Corporation 
 

TSA Transportation Security Administration 
 

TSGP Transit Security Grant Program
 

OIG
 


Department of Homeland Security 

Office of Inspector General 

Executive Summary 

Amtrak provides passenger rail service over approximately 22,000 

miles in 46 states and the District of Columbia. Amtrak operates 

more than 500 stations and transports about 27 million passengers 

every year, using infrastructure including tunnels, bridges, and 

major rail stations. Passenger rail stations are attractive terrorist 

targets because of the large number of people in a concentrated 

area. We determined whether the Department of Homeland 

Security ensures that recipients of the Transit Security Grant 

Program mitigate high-priority security vulnerabilities at Amtrak 

rail stations and whether they coordinate risk mitigation projects to 

prevent duplication and avoid uneconomical use of grant funds. 

Grant recipients, such as Amtrak, transit agencies, and state and 

local authorities, coordinate risk mitigation projects at high-risk 

rail stations. However, Amtrak is not always using grant funds to 

implement mitigation strategies at highest risk rail stations, in 

terms of casualties and economic impact. Amtrak has not 

mitigated critical vulnerabilities reported in risk assessments. 

These vulnerabilities remain because the Transportation Security 

Administration (TSA): 

�	 

�	 

�	 

Did not require Amtrak to develop a corrective action plan 

addressing its highest ranked vulnerabilities; 

Approved Amtrak investment justifications for lower risk 

vulnerabilities; and 

Did not document roles and responsibilities for the grant 

award process. 

As a result, some rail stations and the traveling public may be at 

risk to a potential terrorist attack. TSA concurred with our two 

recommendations and has initiated corrective actions. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 1 

�

�

�

�

Background 

Since 2004, bombings of the Madrid and Mumbai rail systems and 

the London subway have demonstrated the critical need to protect 

rail infrastructure from terrorist attacks. Passenger rail stations are 

especially attractive terrorist targets because of the large number of 

people in a concentrated area. The largest of America’s rail 

stations are intermodal transportation terminals with high 

passenger and cargo volumes. A terrorist attack at these facilities 

could lead to significant loss of life and economic disruption. 

The Rail Passenger Service Act of 1970, Public Law 91-518, 

established the National Railroad Passenger Corporation - Amtrak. 

Amtrak runs intercity passenger rail service over approximately 

22,000 miles in 46 states and the District of Columbia, operating 

more than 500 stations and transporting about 27 million 

passengers every year. While the Department of Transportation 

owns Amtrak, the majority of mass transit stations in this country 

are owned and operated by state and local government and private 

industry. Amtrak infrastructure consists of various critical assets 

and key resources, including tunnels, bridges, and several major 

rail stations. 

The Aviation and Transportation Security Act of 2001, Public Law 

107-71, designates the TSA responsible for security in all modes of 

transportation. It also makes TSA responsible for coordinating 

domestic transportation, including aviation, rail, and other surface 

transportation. The act identifies TSA as the lead federal agency 

for determining the security priorities eligible for federal grant 

funding and developing the criteria for evaluating applications. 

The Department of Homeland Security (DHS) has taken steps to 

manage risk and strengthen our Nation’s rail and transit systems 

by: 

Providing funding to state and local partners; 

Training and deploying manpower; 

Providing assets for high-risk areas; 

Developing and testing new technologies; and 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 2 

�	 Performing security assessments of systems across the 

country. 

DHS distributes billions of dollars to states, territories, urban areas, 

and transportation authorities, including Amtrak, under grant 

programs to strengthen national preparedness capabilities and 

protect critical infrastructure. The purpose of the DHS Transit 

Security Grant Program (TSGP) is to create a sustainable, riskbased effort to protect critical surface transportation infrastructure 

and the traveling public from acts of terrorism, major disasters, and 

other emergencies. A subcomponent of the TSGP is the Intercity 

Passenger Rail Program (IPRP), a security grant program designed 

exclusively for Amtrak. 

Since 2005, the TSGP has provided more than $1 billion in grant 

funding to Amtrak and passenger rail transit agencies to protect 

critical transportation infrastructure, including Amtrak rail stations. 

Specifically, the TSGP including the IPRP provided $97 million to 

Amtrak and $1.4 billion to transit agencies. As part of Amtrak 

grants, the IPRP funded several risk assessments of Amtrak 

facilities, including rail stations and other infrastructure. The 

assessments provided Amtrak with countermeasures that could 

reduce risks to the stations. 

Between 2005 and 2008, the Science Applications International 

Corporation (SAIC) conducted risk assessments of Amtrak 

facilities, assets, and infrastructure. SAIC documented the 

vulnerabilities of Amtrak infrastructure including rail stations and 

recommended mitigation actions. SAIC charged about 

$2.3 million for these assessments. 

Amtrak is spending an additional $5.5 million to corroborate 

subassessments to the SAIC findings. The Lawrence Livermore 

National Laboratory and OceanIT conducted site-specific analyses 

of infrastructure vulnerabilities. These included blast analyses of 

high-risk stations and analyses of the effects of a chemical or 

biological attack on heating, ventilation, and air conditioning 

systems. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 3 

TSA and the Federal Emergency Management Agency (FEMA) 

are responsible for administering and overseeing the TSGP and 

IPRP. These two agencies work together to develop the annual 

TSGP guidance and application kits. These kits provide Amtrak 

and transit agencies with formal guidance and application materials 

to apply for funding under the TSGP and IPRP. The kits also 

describe the TSA and FEMA program management roles and 

responsibilities: 

�	 

�	 

TSA provides rail system subject matter expertise within 

DHS and determines the primary security planning for the 

TSGP and IPRP. TSA is the lead agency in crafting all 

selection criteria associated with the application review 

process. 

FEMA is the lead for designing and operating the 

administrative mechanisms to manage the department’s 

core grant programs, including the TSGP and IPRP. 

FEMA is also responsible for ensuring compliance with all 

relevant federal grant management requirements and 

providing grant management tools and controls to support 

the TSGP and IPRP. 

TSA and FEMA use a cooperative agreement approach to approve 

grant projects funded through the TSGP and IPRP. As part of the 

cooperative agreement process, Amtrak meets with TSA and 

FEMA representatives to develop Investment Justifications that 

align with TSGP and IPRP priorities. According to TSGP grant 

guidance, the cooperative agreement process is valuable because it 

provides greater flexibility and allows TSA to work directly with 

transit agencies to quickly adapt to changes as situations arise 

during the grant cycle. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 4 

Results of Audit 
 

DHS Did Not Ensure That Amtrak Directed Grant 


Funds to Highest Known Rail Station Vulnerabilities 


DHS grant recipients, such as Amtrak, transit agencies, and state and local 

authorities, coordinate risk mitigation projects at Amtrak high-risk rail 

stations to prevent duplication and avoid uneconomical use of grant funds. 

However, at the four rail stations we visited, Amtrak did not mitigate 

critical vulnerabilities reported in DHS-funded risk assessments. 

Although many factors contributed to Amtrak’s unaddressed station 

vulnerabilities, the primary causes were that TSA: 

�	 

�	 

�	 

Did not require Amtrak to develop a formal corrective 

action plan documenting how it would address its highest 

ranked identified vulnerabilities, 

Approved Amtrak investment justifications for lower risk 

vulnerabilities, and 

Did not document roles and responsibilities for the grant 

project approval process. 

As a result, some rail stations and the traveling public may be at a greater 

risk to a potential terrorist attack. 

Grant Recipient Coordination 

Grant recipients have demonstrated coordination activities to 

ensure economical use of grant funds. For example, DHS 

encourages high-risk regions to form Regional Transit Security 

Working Groups. These working groups include eligible transit 

agencies, law enforcement agencies, and Amtrak, if stations exist 

in the region. The Regional Transit Security Working Groups 

work with each other and with TSA to identify projects that DHS 

grants can fund. 

At the station level, Amtrak employs Station Action Teams 

comprising of Amtrak Police, local Amtrak managers, local 

property management, adjacent facility owners, and transit and 

local police. The Station Action Team Coordinator facilitates the 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 5 

formulation of strategies to minimize the effects of a threat to that 

station in conjunction with other team members, including those 

receiving DHS grant funds. 

Rail Station Vulnerabilities Remain 

TSA and FEMA did not ensure that Amtrak used TSGP funds to 

implement the more critical countermeasures the DHS-funded 

assessments recommended. Between 2005 and 2008, IPRP funded 

$7.8 million in assessments to help Amtrak strengthen rail security. 

TSA and FEMA explained that Amtrak uses these assessments to 

propose security projects for the IPRP. However, we visited four 

high-risk rail stations and observed that Amtrak did not take 

actions to mitigate some of the more critical vulnerabilities the 

assessments identified as early as 2006. 

For example, at one station (see Figure 1), we observed that a 

terrorist could access

 The 2006 assessment recommended that 

Amtrak to mitigate this risk. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 6 

Figure 1: 

At another station (see Figure 2), access to 

 An assessment recommended that Amtrak replace the 

 to mitigate this 

risk. 

Figure 2: 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 7 

 

Corrective Action Planning 

TSA did not require Amtrak to develop a formal corrective action 

plan for mitigating station vulnerabilities identified in the 

assessments. TSA set funding priorities in the annual grant 

guidance1

 but did not require Amtrak to create a corrective action 

plan that would prioritize mitigating the identified high-risk station 

vulnerabilities, establish milestones, or estimate project costs. 

Office of Management and Budget (OMB) Circular A-123, 

Management's Responsibility for Internal Control, directs 

management to establish and maintain internal controls, including 

policies and procedures, to achieve the objectives of effective and 

efficient operations. Further, U.S. Government Accountability 

Office (GAO) guidance indicates that a strategic plan should 

include clear and concise goals and objectives that identify 

resource issues. The plan should also address risk-related issues 

that are central to the agency’s overall mission.2 

Amtrak developed a project prioritization list, known as the 

“quilt,” and a general strategy to reduce risk at its top 16 stations. 

The quilt incorporates the SAIC assessment rankings of Amtrak’s 

assets, such as rail stations, bridges, and tunnels. The quilt does 

not incorporate specific corrective measures the assessments 

recommended. Rather, it captures broad categories of remediation. 

For example, the quilt lists categories such as “Hardening Tool Kit 

(Fencing/Lighting)” and “Bollards/Planters,” but does not specify 

where Amtrak should place the bollards or planters. 

Amtrak’s general strategy for risk reduction directed resources 

toward combating the highest risk facilities. Amtrak expanded the 

strategy, known as its “16+1 Station Strategy,” to 16 stations after 

SAIC completed assessments of Amtrak’s West Coast operations.3 

Like the quilt, the Station Strategy does not provide the specific 

mitigation efforts to be taken at the 16 high-risk stations. It also 

1

 TSA did not become involved in TSGP and the IPRP until 2006. TSA did not participate in the 

development of the 2005 guidance. 

2

 GAO testimony – 07-583T, Federal Strategy and Enhanced Coordination Needed to Prioritize and Guide 

Security Efforts, March 7, 2007 3

 The “+1” refers to other Amtrak assets such as electrical stations, bridges, and tunnels. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 

Page 8 
does not include cost estimates, timeframes, or alternatives to 

mitigation obstacles beyond Amtrak’s control. 

The TSGP grant guidance kits did not require Amtrak to mitigate 

the assessment vulnerabilities as a top priority. The 2005 guidance 

kit indicates that up to 30% of fiscal year 2005 funds would be 

available to assist Amtrak with its most pressing security needs in 

its Northeast Corridor and Chicago “as identified through 

previously conducted site-specific assessments.” Up to 50% of the 

fiscal year 2006 funds were available for the same purpose and 

expanded to “high priority projects” identified in assessments of its 

West Coast service area. However, neither guidance kit required 

Amtrak to expend funds on the identified vulnerabilities. 

Beginning with fiscal year 2007, the kits include a section titled 

“Funding Priorities,” which identify DHS’s specific priorities for 

that grant year. However, there is no indication of which are the 

highest priorities. From fiscal years 2007 through 2010, the 

guidance identified a funding priority which was “Protection of 

other high risk/high consequence assets and systems that have been 

identified through system wide risk assessments.” 

Lower Priority Projects Approved 

Amtrak faces obstacles beyond its control when undertaking some 

security projects. For example, some of the recommendations in 

the risk assessments require Amtrak to make modifications in or 

around a station. Amtrak does not own all of its stations and must 

obtain permission from other parties to make the modification. 

Amtrak cannot always obtain permission to make the 

modifications. Projects may also require environmental and 

historic approvals or are subject to American with Disability Act 

restrictions. 

When addressing these obstacles, TSA’s cooperative agreement 

approach permits Amtrak to use IPRP funds on projects that may 

not be the highest priority but are easier to complete. Beginning 

with the 2007 grant cycle, TSA began to use a cooperative 

agreement approach to approve TSGP and IPRP projects. This 

approach allows Amtrak to focus on remediation projects over 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 9 

which it has control. For example, the Lawrence Livermore 

National Laboratories analysis recommended hardening the air 

intake vents at one station because the heating ventilation and air 

conditioning system is vulnerable. The station’s landlord 

prevented Amtrak from implementing remediation to the vents. 

Using the cooperative agreement approach, TSA allowed Amtrak 

to use IPRP funds for other projects at the station, such as 

upgrading the closed-circuit television system. 

TSA Grant Project Decision and Approval Process Not 

Documented 

TSA has limited internal procedures documenting how it manages 

the TSGP and IPRP project decision and approval process. OMB 

Circular A-123 says that policies and procedures are tools to help 

managers achieve results and safeguard the integrity of their 

programs. According to GAO’s Standards for Internal Controls,4 

an agency’s internal control activities should include appropriate 

policies and procedures governing each of its activities. 

Additionally, control activities should include written 

documentation that covers an agency’s significant transactions and 

events. Further, they should identify its activities in documents 

such as management directives and administrative policies. 

TSA officials said the following two documents contain the only 

documented procedures that describe how the agency prioritizes 

and approves projects the TSGP and IPRP funds: 

�	 

�	 

The annual grant guidance and application kits provide an 

overview of the grant program and the required application 

materials. The guidance is intended for grant recipients and 

does not formally document TSA’s internal policies and 

procedures for setting grant priorities or evaluating 

investment justifications. 

TSA’s presentation dated March 2007, “FY 2007 Transit 

Security Grant Program: Tier I Cooperative Agreement 

Approach,” describes the process as a series of meetings, 

4

 GAO-01-1008G, Internal Control Management and Evaluation Tool, August 2001. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 

Page 10 
 

�	 which typically result in a proposed project concept list. 

This is not official TSA policy that would hold the agency 

accountable for the process. 

Neither the guidance kits nor the presentation specifies how TSA 

sets grant priorities or how it will ensure that it approves only 

projects that address stated priorities. 

Limited TSGP Funds Expended on High-Risk Mitigation 

As of December 31, 2010, Amtrak had expended only 16% of 

IPRP funds TSA approved to address some of the more critical 

vulnerabilities the assessments identified. TSA’s cooperative 

agreement approach and factors outside of Amtrak’s control5

 have 

delayed Amtrak’s ability to spend these funds. Amtrak cannot 

expend IPRP funds on projects until it receives TSA’s and 

FEMA’s approval. However, a significant amount of time can 

pass between the grant award and project approval dates under the 

cooperative agreement approach. Therefore, funds that could 

address some of the more critical vulnerabilities at high-risk 

stations remain unexpended. 

Station-hardening measures are more critical mitigation efforts 

because they can prevent or mitigate the impact of terrorist attacks, 

especially from vehicle-borne improvised explosive devices. They 

can also protect Amtrak passengers, employees, and critical 

infrastructure assets integral to the safety and stability of the 

national passenger rail system. These measures include bollards, 

fixed and/or retractable barriers, planters, gate checkpoints, 

lighting and fencing, and closed circuit television systems. 

From 2005 to 2010, TSA and FEMA approved 56 IPRP projects 

for Amtrak. Nine of the 56 projects totaling $29.5 million 

implement station-hardening measures. The remaining 47 

projects, accounting for $67.5 million, are for security initiatives 

that include employee training, expansion of canine teams, bridge 

5

 Amtrak may need to obtain approval from a State Homeland Preservation Office in order to comply with 

FEMA’s Office of Environmental and Historical Preservation project review. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 11 

 

 

 

hardening, and further assessments of station vulnerabilities. See 

Figure 3 for the types of approved security IPRP projects. 

Figure 3: Approved Amtrak Security Projects, FY 2005-2010 

Rail Station Hardening, 

$29,486,265 Other Infrastructure 

Hardening, $12,164,000 

SAT Tool Kits, $13,539,062 

Training & Public 

Awareness, $10,158,780 

Canine, $6,423,472 

Equipment, $4,829,145 

Intelligence, $4,254,115 

Drills or Exercises, 

$3,652,328 

Planning & Assessments, 

$4,225,000 

Management & 

Administration, $423,329 

Interoperability, $3,653,555 

Other, $4,217,091 

As of December 31, 2010, Amtrak had expended only $4.9 million 

(16%) of the $29.5 million approved for rail station-hardening 

projects. Most of the unexpended funds are for six projects: two 

each from fiscal years 2008 and 2009, and one each from fiscal 

years 2007 and 2010. Table 1 lists the status of funds for the nine 

rail station-hardening projects. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 12 

 

 

 

 

 

 

Grant 

Year 

Investment Justification 

Project Description 

Amount 

Approved 

Amount 

Expended 

2005 Technical Support Working 

Group 

$ 873,765 $ 873,765 

2007 Camera Consolidation and 

Video Management 3,000,000 2,873,943 

2007 CCTV

 1,000,000 782,966 

2007 

Hardening 1,350,000 67,900 

2008 Access Control 1,125,000 0 

2008 CCTV and Communications 

 3,787,500 257,128 

2009 CCTV and Video Analytics 

 4,800,000 0 

2009 Station and Facility 

Hardening 5,350,000 0 

2010 Infrastructure Protection 

 8,200,000 0 

Total $29,486,265 $4,855,702 

Table 1: Funds Allocated to Rail Station Hardening Projects 

TSA’s cooperative agreement approach contributed to significant 

delays in approving rail station-hardening projects. GAO 

reported6 the cooperative agreement process was a factor for wh y 

transit agencies expended only 3% of 2006 to 2008 TSGP funds. 

FEMA awarded the 2009 IPRP grant to Amtrak on July 31, 2009; 

however, TSA did not approve the investment justifications for the 

two rail station projects until July 29, 2010. The approach requires 

a back-and-forth discussion between Amtrak and TSA officials 

that can take many months to complete. TSA officials explained 

outside factors affected approval of this particular investment 

justification. For example, Amtrak pulled approved projects back 

as a result of changes in security priorities and leadership. The 

TSA officials indicated that the approval process for the two 

station projects was timely once they received a final investment 

justification from Amtrak. 

6

 GAO-09-491 Transit Security Grant Program – DHS Allocates Grants Based on Risk, but Its Risk 

Methodology, Management Controls, and Grant Oversight Can Be Strengthened, June 2009. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 

Page 13 
Other Challenges Impacting Rail Station Vulnerabilities 

During the course of audit fieldwork, TSA and FEMA had not 

finalized a memorandum of understanding for managing the TSGP 

and IPRP. Both GAO and the OIG had previously recommended 

that TSA and FEMA finalize such a memorandum. As discussed 

earlier, TSA does not have documented procedures for its role in 

the grant award process. Such procedures would help the agency 

with closing prior GAO and OIG recommendations7

 for TSA and 

FEMA to finalize a memorandum of understanding or similar 

document defining their roles and responsibilities for awarding and 

managing grants. According to a 2009 GAO report on TSGP, 

“Articulating roles and responsibilities for managing the 

TSGP could strengthen TSA and FEMA’s ability to ensure 

that activities, processes, and resources are aligned to 

achieve a common outcome and ensure smooth 

coordination during the grant process.”8 

TSA and FEMA finalized a memorandum of understanding for the 

TSGP program in March 2011. This memorandum should help to 

strengthen the implementation, administration, oversight, and 

internal controls of the TSGP. 

Conclusion 

Each year, DHS provides millions of dollars to Amtrak and transit 

agencies to reduce risk and strengthen the Nation’s rail and transit 

systems. TSA can do more to ensure that Amtrak uses grant funds 

to protect rail stations from terrorism. TSA should work with 

Amtrak to develop a corrective action plan to mitigate potential 

gaps in security at Amtrak’s high-risk rail stations. Without a 

comprehensive plan for addressing identified vulnerabilities and 

documented internal procedures for awarding TSGP and IPRP 

grants and approving projects, the traveling public remains at risk 

for a potential terrorist attack at Amtrak’s high-risk stations. 

7

Ibid.; OIG-10-69, Efficacy of DHS Grant Programs, March 22, 2010. 

8

 GAO-09-491, Transit Security Grant Program: DHS Allocates Grants Based on Risk, but Its Risk 

Methodology, Management Controls, and Grant Oversight Can Be Strengthened, June 2009, p. 25. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 14 

Recommendations 

We recommend that the Assistant Administrator, Transportation 

Security Network Management: 

Recommendation #1: Require the Transportation Sector Network 

Management, Mass Transit and Passenger Rail Division, to work 

closely with Amtrak to establish a corrective action plan that 

ensures decisions to fund Amtrak rail station remediation projects 

focus on mitigating the highest vulnerabilities identified by 

previous risk assessments. The plan should include the following: 

�	 

�	 

�	 

Preliminary strategies and designs specifying the 

identification and commitment of all interested parties, to 

be presented during the grant application process to 

facilitate prompt mitigation efforts, 

Details on the amount of funding needed to address the 

most critical vulnerabilities, and 

Milestones for the timely approval of mitigation projects. 

Recommendation #2: Ensure that the Transportation Sector 

Network Management, Mass Transit and Passenger Rail Division, 

creates and reports internal procedures that describe how the 

agency will carry out its roles and responsibilities in the grant 

award process for ensuring that Amtrak and other grant recipients 

address the highest priority security vulnerabilities. 

Management Comments and OIG Analysis 

DHS concurred with both recommendations in the report and TSA 

has already begun to implement actions to address the 

recommendations. We consider the recommendations unresolved 

and open. A summary of the agency’s response follows. 

TSA Comments to Recommendation #1: 

TSA Concurs: DHS advised the OIG that forthcoming regulations 

will require Amtrak to develop a formal security plan with 

corrective actions. TSA’s Office of Transportation Sector 

Network Management, Mass Transit and Passenger Rail Security 

Division, is currently engaged with Amtrak to develop a 

comprehensive security plan including corrective actions. The 

regulation, required by the Implementing Recommendations of the 

9/11 Commission Act of 2007 (Public Law 110-53), will serve as 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 

Page 15 
the basis for DHS’s coordination with Amtrak in developing their 

system wide security plan. TSA will also include, as part of our 

internal procedures, performance metrics to ensure the timely 

approval of Amtrak security projects. 

Until the regulation is finalized, DHS will review critical 

vulnerabilities with Amtrak throughout each grant cycle to 

determine their feasibility for funding, including reviewing and 

discussing mitigation options for the assets on Amtrak’s security 

“quilt.” Also, TSA began conducting a Baseline Assessment for 

Security Enhancement review for the entire system in March 2011. 

Through this review, DHS will engage in strategic planning and 

corrective action discussions with Amtrak for mitigating critical 

vulnerabilities. 

OIG Analysis: 

The OIG recognizes TSA’s efforts to issue a security plan 

regulation to assist the coordination with Amtrak in developing 

their system wide security plan. TSA’s new performance metrics 

should also help the timely approval of Amtrak security projects. 

The OIG needs to obtain and review the requirements for 

corrective action plans to ensure decisions to fund Amtrak rail 

station remediation projects focus on mitigating the highest 

vulnerabilities identified by previous risk assessments. This 

recommendation will remain unresolved until we receive the 

corrective action plan and identification of the responsible 

officials. The recommendation will remain open until we receive 

all additional information on the formal security plan with 

corrective actions, future requirements, and performance metrics to 

ensure the timely approval of Amtrak security projects. 

TSA Comments to Recommendation #2: 

TSA Concurs: FEMA and TSA finalized a Memorandum of 

Agreement in March 2011, outlining the roles and responsibilities 

of each agency in managing surface transportation grant programs. 

TSA will use the Memorandum of Agreement as a starting point in 

creating internal procedures to clearly document how TSA will 

carry out its roles and responsibilities. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 16 

OIG Analysis: 

FEMA and TSA will identify and document how the agencies will 

carry out its roles and responsibilities in the grant award process. 

This will assist both agencies for ensuring that Amtrak and other 

grant recipients address the highest priority security vulnerabilities. 

This recommendation will remain unresolved until we receive and 

review the corrective action plan for internal procedures to clearly 

document how TSA will carry out its roles and responsibilities. 

We will close the recommendation once the roles and 

responsibilities are documented sufficiently to address the areas of 

concern identified in this report. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 17 

Appendix A 

Purpose, Scope, and Methodology 

The objective of our audit was to determine whether DHS ensures 

that recipients of the TSGP and IPRP mitigate high-priority 

security vulnerabilities at Amtrak rail stations and whether they 

coordinate risk mitigation projects to prevent duplication and avoid 

uneconomical use of grant funds. 

We reviewed federal legislation impacting the TSGP and IPRP, 

including the Aviation and Transportation Security Act of 2001, 

the Homeland Security Act of 2002, and the Implementing 

Recommendations of the 9/11 Commission Act of 2007. We 

reviewed GAO and DHS OIG reports and testimony to identify 

prior findings and recommendations related to the TSGP and IPRP. 

To determine whether the TSA and FEMA implemented the TSGP 

and IPRP in accordance with policies and procedures, we reviewed 

Amtrak's decision meeting minutes and approved project 

investment justifications, and compared them with Amtrak’s 

project prioritization list. We determined the amounts of IPRP 

funds expended for Amtrak’s fiscal years 2005-2010 IPRP projects 

as of December 31, 2010 by obtaining and reviewing Categorical 

Assistance Progress Reports for fiscal years 2005-2010, and 

Federal Railroad Administration drawdown data for fiscal years 

2008-2010. 

To determine whether grant recipients coordinate, we interviewed 

representatives from the State Administrative Agencies for New 

York City and the National Capitol Region, and attended a 

Philadelphia Regional Transit Security Working Group meeting in 

Camden, NJ. We reviewed grant project descriptions for fiscal 

years 2007-2008 for the State Homeland Security Program, Urban 

Areas Security Initiative Program, and the TSGP, and compared 

the projects with Amtrak’s projects to identify duplicative efforts 

funded by the various grant programs. 

We interviewed officials from Amtrak’s Police Department and 

Financial Planning Office to obtain their perspective on the TSGP 

grant application, award, and oversight process. We identified 

their procedures for coordinating efforts with state and local grant 

recipients and the DHS agencies. We also identified the 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 18 

Appendix A 

Purpose, Scope, and Methodology 

challenges Amtrak faces in prioritizing how to use grant funds to 

secure rail stations. 

To identify roles and responsibilities in the grant award process, 

we interviewed personnel from TSA’s Transportation Sector 

Network Management and FEMA’s Grant Programs Directorate. 

We reviewed TSA and FEMA policies, procedures, and guidance 

related to evaluating, awarding, and monitoring grant programs to 

determine how the agencies manage the TSGP and IPRP. We 

reviewed DHS annual grant guidance and application kits for fiscal 

years 2005-2010 to determine if TSA and FEMA provided clear 

guidance to Amtrak on the purpose and priority for use of IPRP 

grant funds. 

We obtained and reviewed analyses that the Science Applications 

International Corporation performed during 2005 to 2008 on 

Amtrak’s assets. We obtained a briefing on the results of 

Lawrence Livermore National Laboratories assessments conducted 

at the four locations we visited: 

 We used the assessment results to identify the 

vulnerabilities and recommendations for risk remediation at these 

four stations. The method of selecting our locations prevents us 

from projecting the findings on a national level, but one should not 

discount our findings since the rail stations visited are locations 

with a high number of travelers. 

We conducted this performance audit from September 2010 to 

February 2011 pursuant to the Inspector General Act of 1978, as 

amended, and according to generally accepted government 

auditing standards. Those standards require that we plan and 

perform the audit to obtain sufficient, appropriate evidence to 

provide a reasonable basis for our findings and conclusions based 

upon our audit objectives. We believe that the evidence obtained 

provides a reasonable basis for our findings and conclusions based 

upon our audit objectives. 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 19 

It.S. Dt:pllrlrncnt or HurncllilmJ St:curity

Wllshinglun. DC 20528

Homeland

Security JUN 0B 2011

MEMORANDUM FOR: Anne L. Richards

Assistant Inspector General for Audits

U.S. Department of Homeland Security (DHS)

FROM:

c~S. Pistol () 11 /;- , . inistrat 'P~~

1 ranspon Ion Security Administration

iflJ) Craig Fugate

~dministrator Federal Emergency Management Agency

SUBJECT: Response to Draft Report, DHS Grants Used

for Mitigating Risks to Amtrak Rail Stations

This memorandum constitutes the Transportation Security Administration's (TSA) and the

Federal Emergency Management Agency's (FEMA) response to the DHS Office of the Inspector

General (OIG) draft report entitled DHS Grants Usedfor Mitigating Risks to Amtrak Rail

Stations, dated March 20 I I .

In July 2010, the OIG initiated a review to determine the effectiveness of DHS grants fOT

mitigating risks to Anntrak rail stations. The OIG's objective was to determine whether DHS

ensures that recipients of the Transit Security Grant Program (TSGP) and the Intercity Passenger

Rail Security Grant Program (lPRSGP), as a component of the TSGP, mitigate high-priority

security vulnerabilities at Amtrak rail stations and whether the grant recipients coordinate risk

mitigation projects to prevent duplication and avoid uneconomical use of grant funds.

The OlG concluded that grant recipients coordinate risk mitigation projects at high-risk rail

stations, thereby preventing duplication and avoiding uneconomical use offunds. However,OIG

also concluded that critical vulnerabilities cited in risk assessments conducted by Amtrak remain.

As a result, the traveling puhlic may be at risk to a potential terrorist attack. The OIG stated that

vulnerabilities remain because of the following:

TSA not requiring Amtrak to develop a system-wide security plan addressing its highest

ranked vulnerabilities;

• TSA approving An1trak investment justifications for lower-risk vulnerabilities; and

Appendix B 

Management Comments to the Draft Report 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 
 

Page 20
 

• TSA not having internal roles and responsibilities documented for their role during the

award process (funding priority development and project approval)

The OIG audit team also recognized thatlhe cooperative agreement approach allows Amlrak to

use grant funds on lower priority projects at critical assets where Amtrak faces obstacles beyond

its control, and therefore cannot implement higher priority projects at those critical assets.

The draft report issued by OIG includes two recommendations:

I. Require the Transportation Sector Network Management, Mass Transit and Passenger

Rail Division, to work closely with Amtrak to establish a corrective action plan that

ensures decisions to fund Amtrak rail station remediation projects focus on mitigating the

highest vulnerabilities identified by previous risk assessments. The plan should include

the following:

• Preliminary strategies and designs specifying the identification and commitment

of all interesled parties, 10 be presented during Ihe grant application process to

facilitate prompt mitigation efforts:

• Details on the amount of funding needed to address the most critical

vulnerabilities~ and

• Milestones for Ihe timely approval of mitigation projects.

2.. Ensure that the Transportation Sector Network Management. Mass Transit and Passenger

Rail Division, creates and reports internal procedures that describe how the agency will

carry out its roles and responsibilities in the grant award process for ensuring that Amtrak

and other grant recipients address the highest priority security vulnerabilities.

DHS appreciates OIG's work in completing this audit and will use the infomlation in Ihe audit 10

assist our ongoing efforts to improve the efficiency and effectiveness ofthe grant programs.

DHS is already working to resolve the issues identified in the audit by implementing solutions

that address the recommendalions contained in the report. However, there are key points thatlhe

report does not discuss, which. without the proper context. could lead to incomplete conclusions.

Operational Activities are a Key Component of Layered Security Approach. DHS has worked

closely with Amtrak to enhance their operational activities to complement and/or supplement

capital projects. Operational activities include canine teams, mobile explosives detection

screening teams. training. and public awareness campaigns. The draft report asserts that station

hardening measures are "more critical" mitigation efforts because they can prevent or mitigate

the impact of terrorist attacks, but the role of operational measures is just as important in critical

infrastructure protection. 1n cases where capital projects cannot be undertaken or will take

several months to implement (including for the reasons mentioned below), operational activities,

including unpredictable deterrence measures. provide an effective deterrent and act as a

mitigating effort for critical asset~. Amtrak invests significant internal resources. as well as

1PRSGP resources, for operational activities including mobile screening teams. canine teams.

public awareness campaigns. intelligence gathering and analysis. and employee training.

Appendix B 

Management Comments to the Draft Report 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 
 

Page 21
 

Environmental and Historical Preservation Considerations. The report's primary concjusions

may lead to the inaccurate conclusion that DHS and Amtrak are intentionally funding lesser

vulnerabilities at the expense of more critical ones. As set forth above, the report provides three

primary reasons why Amtrak has not mitigated certain critical vulnerabilities. Because certain

critical vulnerabilities cannot be addressed (e.g. because Amtrak does not own all of their

stations), DHS and Amtrak believe it reasonable to use the funding to reduce other

vulnerabilities rather than leaving these-albeit lesser-vulnerabilities remaining by returning

the grant funding to the Treasury. In this way, DHS and Amtrak ensure that all grant funding is

used to reduce vulnerabilities, which makes the public more secure by using this process.

While acknowledging that Amtrak encounters obstacles in addressing critical vulnerabilities, the

report's primary conclusions do not consider that critical vulnerabilities have not been addressed

because of envirorunental and historic preservation considerations. Specifically, Amtrak requires

approval from Historic Preservation Offices and other related entities ifthe project requires

ground disturbance, or if it requires installation on historic/older assets. Ifthese approvals are not

provided for a project, Amtrak is statutorily precluded from funding the project.

DHS and Amtrak Engage in Security Planning and Corrective Action Discussions. Also, TSA

began conducting a Baseline Assessment for Security Enhancement (BASE) review for the entire

system in March 201 ). DHS and Amtrak have continuous discussions regarding security

planning and mitigation activities through grant-funded projects even though grant guidance did

not require Amtrak to develop a formal security plan or corrective action plan. Forthcoming

regulations will require Amtrak to develop a formal security plan with corrective actions.

Nonetheless, DHS still reviews critical vulnerabilities with Amtrak throughout each grant cycle

to determine their feasibility for funding, including reviewing and discussing mitigation options

for the assets on Amtrak's security "quilt." In these ways, DHS engages in strategic planning

and corrective action discussions with Amtrak for mitigating critical VUlnerabilities.

Cooperative Agreement Approach Enhances Security Discussions and Project Approvals. DHS

implemented, and has continued to use, the cooperative agreement (CA) approach for grantees in

the highest-risk regions, including Amtrak, since the fiscal year (F¥) 2007 grant process to

facilitate security and project discussions. The CA approach allows for continuous and open

dialogue between DHS and potential grantees, where a traditional grant limits federal agency

participation. When this approach was first implemented in 2007, DHS's review and approval of

projects did impact the performance period of the grant. TSA has since streamlined its processes

so that the CA process no longer affects the grant period ofperformance, provided the projects

are submitted for review in a timely manner. This streamlined CA approach has reduced the

time between formal submission of a proposed project and approval because it allows for open

and continuous discussion of the project before fannal submission. This open and continuous

dialogue ensures that a quality proposal is submitted the first time, thereby avoiding the timeconsuming review ofmultiple iterations through a formal "submit-review-feedback-resubmit"

process. This approach also allows DHS to be flexible when national or local priorities change

or new needs emerge, as was the case with the FY 2009 award. (After the FY 2009 award was

made, Amtrak's leadership revised its security priorities, which concomitantly adjusted its slate

of projects. While it took Amtrak until July 2010 to finalize its project submissions, TSA and

FEMA were able to review and approve them within a matter of days. Without the CA approach,

Appendix B 

Management Comments to the Draft Report 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 
 

Page 22
 

it would have been more difficult and time consuming for Amtrak to have been able to adjust

grant projects to meet changing priorities. In addition, DHS would have had difficulty in

maintaining close communication with Amtrak during this period, as the stipulations of a grant

versus a cooperative agreement prevent open, continuous dialogue between DHS and grantees.

Therefore, in this situation, the CA process allowed for speedy project approvals once the final

project submission was received.)

FEMA is Responsible for All Fiduciary Activities and Management Oversight Related to the

Grant Programs. TSA provides the surface transportation security programmatic subject matter

expertise for the grant programs, but FEMA is responsible for administering grant awards and

ensuring compliance with all applicable laws, regulations, and policies, including Office of

Management & Budget circulars and financial management standards. FEMA has legal

responsibility to ensure that grants are awarded in alignment with the circulars and standards.

DHS appreciates OIG's efforts on ensuring security grants are coordinated efficiently and used

effectively to reduce vulnerabilities at critical assets identified through vulnerability assessments

and security plans, and, overall, believes OIG's recommendations will enhance these programs.

DHS has already begun to implement actions to address the recommendations contained in the

report. Our specific responses to the two recommendations follow.

Recommendation #1: Require the Transportation Sector Network Management, Mass

Transit and Passenger Rail Division, work closely with Amtrak to establish a corrective

action plan that ensures decisions to fund Amtrak rail station remediation projects focus

on mitigating the highest vulnerabilities identified by previous risk assessments. The plan

should include:

• Preliminary strategies and designs specifying the identification and

commitment of aU interested parties, to be presented during the grant

application process to facilitate prompt mitigation efforts,

• Details on the amount offunding needed to address the most critical

vulnerabilities,

• Milestones for the timely approval of mitigation projects.

DDS concurs with this recommendation. The TSA Office ofTransportation Sector Network

Management (TSNM), Mass Transit and Passenger Rail Security (MTPRS) Division is engaged

with Amtrak. to develop a comprehensive security plan including corrective actions.

TSA is actively working on issuing a security plan regulation, which would cover Amtrak, as

required by the Implementing Recommendations ofthe 9/11 Commission Act of2007 (public

Law 110-53). Once complete, this regulation will serve as the basis for DHS's coordination with

Amtrak in developing their system-wide security plan. In the interim, the TSNMlMTPRS

Division is already working closely with Amtrak in conducting a BASE review for the entire

system, which was initiated in March 2011. The plan is to conduct one regional assessment per

year, complete the entire system over a 3-year timeframe, and then reassess. This approach puts

Amtrak on the same 3-year cycle of BASE reviews as other agencies. The BASE review for the

Northeast Corridor has already begun. The BASE review, along with the foundation Amtrak has

already built through their prioritization "quilt" and previous site and system assessments, will

Appendix B 

Management Comments to the Draft Report 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 
 

Page 23
 

identify vulnerability gaps that need to be addressed. TSNMIMTPRS will work with Amtrak to

take the results of the BASE to infonn a comprehensive security plan that will include strategies,

designs, and costed mitigation efforts. Further, we will include, as part ofour internal

procedures (per recommendation #2 below), perfonnance metrics to ensure the timely approval

of Amtrak security projects.

Recommendation #2: Ensure the Transportation Sector Network Management, Mass

Transit and Passenger Rail Division, creates aod reports internal procedures that describe

how tbe ageDcy will carry ODt its roles aDd respoDsibilities in tbe graDt award process for

ensuring that Amtrak and otber graDt recipients address tbe bigbest priority security

vulnerabilities.

OHS concurs witb tbis recommendation. Work on this effort is already underway. FEMA and

TSA finalized a Memorandum of Agreement (MOA) in March 2011, outlining the roles and

responsibilities of each agency in managing surface transportation grant programs, including

TSGP and lPRSGP. TSNMlMTPRS will use the MOA as a starting point in creating internal

procedures to clearly document how TSA will carry Ollt its roles and responsibilities that are

outlined in the FEMNTSA MOA. including the development of funding priorities, project

selection criteria, and award recommendations. TSNMlMTPRS aims to have these procedures

complete for the FY 2012 grants cycle.

Appendix B 

Management Comments to the Draft Report 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 
 

Page 24
 

Appendix C 

Photos of Some Remaining Vulnerabilities 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 
 

Page 25
 

Appendix D 

Major Contributors to this Report 

Patrick O’Malley, Director 

Robert Ferrara, Audit Manager 

Elizabeth Clark, Auditor in Charge 

Christopher Byerly, Program Analyst 

Steffanie Moore, Program Analyst 

Kristine Odina, Program Analyst 

Barry Bruner, Independent Referencer 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 


Page 26 

Appendix E 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretariat 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

DHS Audit Liaison 

Transportation Security Administration 

OIG Audit Liaison 

Federal Emergency Management Agency 

Administrator 

OIG Audit Liaison 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 

appropriate 

DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 
 

Page 27
 

ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 

fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 

OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 

misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 

Attention: Office of Investigations - Hotline, 

245 Murray Drive, SW, Building 410, 

Washington, DC 20528. 

The OIG seeks to protect the identity of each writer and caller.