(12) STATE.—The term ‘‘State’’ means any one 
of the 50 States, the District of Columbia, Puerto 
Rico, the Northern Mariana Islands, the Virgin Is-
lands, Guam, American Samoa, and any other terri-
tory or possession of the United States. 
(13) TERRORISM.—The term ‘‘terrorism’’ has 
the meaning that term has in section 2 of the Home-
land Security Act of 2002 (6 U.S.C. 101). 
(14) TRANSPORTATION.—The term ‘‘transpor-
tation’’, as used with respect to an over-the-road-
bus, means the movement of passengers or property 
by an over-the-road-bus—
(A) in the jurisdiction of the United States 
between a place in a State and a place outside 
the State (including a place outside the United 
States); or 
(B) in a State that affects trade, traffic, 
and transportation described in subparagraph 
(A). 
(15) UNITED
STATES.—The term ‘‘United 
States’’ means the 50 States, the District of Colum-
bia, Puerto Rico, the Northern Mariana Islands, the 
Virgin Islands, Guam, American Samoa, and any 
other territory or possession of the United States.
SEC. 3. NO PREEMPTION OF STATE LAW. 
(a) NO PREEMPTION OF STATE LAW.—Nothing in 
section 20106 of title 49, United States Code, preempts 
a State cause of action, or any damages recoverable in 
such an action, including negligence, recklessness, and in-
tentional misconduct claims, unless compliance with State 
law would make compliance with Federal requirements im-
possible. Nothing in section 20106 of title 49, United 
States Code, confers Federal jurisdiction of a question for 
such a cause of action. 
(b) SECRETARIAL POWER.—Section 20106 of title 
49, United States Code, preempts only positive laws, regu-
lations, or orders by executive or legislative branch offi-
cials that expressly address railroad safety or security. 
The Secretary and the Secretary of Transportation have 
the power to preempt such positive enactments by sub-
stantially subsuming the same subject matter, pursuant 
to proper administrative procedures. 
TITLE I—RAIL AND PUBLIC 
TRANSPORTATION SECURITY 
SEC. 101. NATIONAL STRATEGY FOR RAIL AND PUBLIC 
TRANSPORTATION SECURITY. 
(a) MODAL PLAN.—Not later than 6 months after 
the date of enactment of this Act, the Secretary shall de-
velop and implement the modal plan for covered transpor-
tation as required by section 114(t)(1)(B) of title 49,
United States Code. The modal plan shall be entitled the 
‘‘National Strategy for Rail and Public Transportation Se-
curity’’ and shall include, at a minimum—
(1) a description of the roles, responsibilities, 
and authorities of Federal, State, and local agencies, 
government sponsored entities, tribal governments, 
and appropriate stakeholders under the plan; 
(2) identification of, and a plan to address, 
gaps and unnecessary overlaps in the roles, respon-
sibilities, and authorities described in paragraph (1); 
(3) a methodology for how the Department will 
work with the entities described in paragraph (1), 
and make use of existing Federal expertise within 
the Department, the Department of Transportation, 
and other appropriate agencies; 
(4) a process for providing security clearances 
to facilitate intelligence and information sharing 
with the entities described in paragraph (1); 
(5) a description of—
(A) how the Department has reviewed ter-
rorist 
attacks 
on 
covered 
transportation 
throughout the world in the last 25 years; 
(B) the lessons learned from those reviews; 
and
(C) how those lessons are being used in 
current and future efforts to secure covered 
transportation; 
(6) a strategy and timeline for the Department, 
the Department of Transportation, other appro-
priate Federal agencies and private entities to re-
search and develop new technologies for securing 
covered transportation; 
(7) measurable goals, including objectives, 
mechanisms, and a schedule for enhancing the secu-
rity of covered transportation; 
(8) a framework for resuming the operation of 
covered transportation in the event of an act of ter-
rorism and prioritizing resumption of such oper-
ations; 
(9) a description of current and future public 
outreach and educational initiatives designed to in-
form the public on how to prevent, prepare for, re-
spond to, and recover from a terrorist attack on cov-
ered transportation; and 
(10) a process for coordinating covered trans-
portation security strategies and plans, including the 
National Infrastructure Protection Plan required by 
Homeland Security Presidential Directive 7; Execu-
tive Order: Strengthening Surface Transportation
Security dated December 5, 2006; the Memorandum 
of Understanding between the Department and the 
Department of Transportation on Roles and Respon-
sibilities dated September 28, 2004; the Annex to 
the Memorandum of Understanding between the De-
partment and the Department of Transportation on 
Roles and Responsibilities concerning railroad secu-
rity dated September 28, 2006, and the Annex to 
the Memorandum of Understanding between the De-
partment and the Department of Transportation on 
Roles and Responsibilities concerning Public Trans-
portation Security dated September 8, 2005. 
(b) ADEQUACY OF EXISTING PLANS AND STRATE-
GIES.—Nothing in this section shall prevent the Secretary 
from using existing plans and strategies, including those 
developed or implemented pursuant to section 114(t) of 
title 49, United States Code, or Homeland Security Presi-
dential Directive–7, in meeting the requirements of sub-
section (a). 
SEC. 102. ASSIGNMENT OF PROVIDERS OF COVERED 
TRANSPORTATION TO RISK-BASED TIERS. 
(a) ASSIGNMENT.—The Secretary shall assign each 
provider of covered transportation to one of the not less 
than three risk-based tiers established by the Secretary.
(b) PROVISION
OF INFORMATION.—The Secretary 
may request, and the provider of covered transportation 
shall provide, information necessary for the Secretary to 
assign a provider of covered transportation to the appro-
priate tier under subsection (a). 
(c) NOTIFICATION.—Not later than 60 days after the 
date a provider of covered transportation is assigned to 
a tier under this section, the Secretary shall notify the 
provider of the tier to which the provider is assigned and 
the reasons for such assignment. 
(d) HIGH- AND MEDIUM-RISK TIERS.—At least two 
of the tiers established by the Secretary under this section 
shall be tiers designated for high- and medium-risk pro-
viders of covered transportation. 
SEC. 103. RAIL AND PUBLIC TRANSPORTATION ASSESS-
MENTS AND PLANS. 
(a) IN GENERAL.—Not later than 12 months after 
the date of enactment of this Act, the Secretary shall issue 
regulations that—
(1) require each provider of covered transpor-
tation assigned to a high- or medium-risk tier under 
section 102—
(A) to conduct a vulnerability assessment 
in accordance with subsections (b) and (c); and
(B) to prepare, submit to the Secretary for 
approval, and implement a security plan in ac-
cordance with this section that addresses secu-
rity performance requirements under subsection 
(f); and 
(2) establish standards, and guidelines for vul-
nerability assessments under subsection (c) and se-
curity plans under subsection (d) and for developing 
and implementing such security plans. 
(3) establish a security program for providers of 
covered transportation not assigned to a high or me-
dium-risk tier under section 102, including a process 
for providers to conduct vulnerability assessments 
and prepare and implement security plans, as deter-
mined appropriate by the Secretary. 
(b) DEADLINE FOR SUBMISSION.—Not later than 6 
months after the date of issuance of the regulations under 
subsection (a), the vulnerability assessments and security 
plans required by such regulations for a provider of cov-
ered transportation assigned to a high- or medium-risk 
tier shall be completed and submitted to the Secretary for 
review and approval. 
(c) VULNERABILITY ASSESSMENTS.—
(1) REQUIREMENTS.—The Secretary shall pro-
vide technical assistance and guidance to providers
of covered transportation in conducting vulnerability 
assessments under this section and shall require that 
each vulnerability assessment of a provider of cov-
ered transportation assigned to a high- or medium-
risk tier under section 102 include, at a minimum—
(A) identification and evaluation of critical 
covered transportation assets and infrastruc-
tures of the provider, including platforms, sta-
tions, bus and intermodal terminals, tunnels, 
bridges, switching and storage areas, and infor-
mation systems; 
(B) identification of the threats to those 
assets and infrastructures; 
(C) identification of the security weak-
nesses of the covered transportation in—
(i) physical security; 
(ii) passenger and cargo security; 
(iii) programmable electronic devices, 
computers, or other automated systems 
which are used in providing the transpor-
tation; 
(iv) alarms, cameras, and other pro-
tection systems; 
(v) communications systems, including 
dispatching services and mobile service
equipment systems, to provide access to 
emergency services in underground fixed 
guideway systems; 
(vi) utilities; 
(vii) emergency response planning; 
(viii) employee training; and 
(ix) such other matters as the Sec-
retary determines appropriate; and 
(D) identification of redundant and backup 
systems required to ensure the continued oper-
ations of critical elements of the covered trans-
portation in the event of an attack or other in-
cident, including disruption of commercial elec-
tric power or communications network. 
(2) THREAT INFORMATION.—A provider of cov-
ered transportation conducting a vulnerability as-
sessment under this section shall incorporate in the 
assessment any threat information provided by the 
Secretary and other sources. 
(d) SECURITY PLANS.—
(1) REQUIREMENTS.—The Secretary shall pro-
vide technical assistance and guidance to providers 
of covered transportation in preparing and imple-
menting security plans under this section and shall 
require that each security plan of each provider of
covered transportation assigned a high- or medium-
risk under section 102 include, at a minimum—
(A) identification of a security coordinator 
having authority—
(i) to implement security actions 
under the plan; 
(ii) to coordinate security improve-
ments described in sections 105, 106, and 
107; and 
(iii) to receive immediate communica-
tions from appropriate Federal officials re-
garding covered transportation security; 
(B) plans for periodic exercises under sec-
tion 110 that include participation by local law 
enforcement agencies and emergency responders 
as appropriate; 
(C) a list of needed capital and operational 
improvements such as those described in sec-
tions 105, 106, and 107; 
(D) procedures to be implemented or used 
by the provider in response to a terrorist at-
tack, including evacuation and passenger com-
munication plans that include individuals with 
disabilities;
(E) identification of steps taken with State 
and local law enforcement agencies, emergency 
responders, and Federal officials to coordinate 
security measures and plans for response to a 
terrorist attack; 
(F) a strategy and timeline for conducting 
training under section 109, including recurrent 
training and periodic unannounced exercises for 
employees of the provider to be carried out 
under the plan to prevent, prepare for, or re-
spond to a terrorist attack; 
(G) enhanced security measures to be 
taken by the provider when the Secretary de-
clares a period of heightened security risk; 
(H) plans for redundant and backup sys-
tems required to ensure the continued operation 
of critical covered transportation elements of 
the provider in the event of a terrorist attack 
or other incident; 
(I) plans for locating, including by covert 
electronic devices, shipments of railroad cars 
transporting security sensitive materials or nu-
clear waste so that, if the assets are lost or sto-
len, the provider or law enforcement authorities 
may locate, track, and recover the assets;
(J) a strategy for implementing enhanced 
security for shipments of security sensitive ma-
terials under section 124; and 
(K) such other actions or procedures as 
the Secretary determines are appropriate to ad-
dress the covered transportation security of the 
provider to a terrorist attack. 
(2) SECURITY COORDINATOR REQUIREMENTS.—
The Secretary shall require that the individual serv-
ing as the security coordinator identified in para-
graph (1)(A) is a citizen of the United States. The 
Secretary may waive this requirement with respect 
to an individual if the Secretary determines that it 
is appropriate to do so based on a background check 
of the individual and a review of terrorist watch lists 
to ensure that the individual is not identified on any 
such terrorist watch list. 
(3) CONSISTENCY
WITH
OTHER
PLANS.—The 
Secretary shall ensure that each security plan under 
this section is consistent with the requirements of 
the National Strategy for Rail and Public Transpor-
tation Security described in section 101. 
(e) PROVIDED BY SECRETARY.—The Secretary shall 
provide, in a timely manner to the maximum extent prac-
ticable under applicable authority and in the interest of
national security, to the provider of the covered transpor-
tation threat information that is relevant to the provider 
when preparing and submitting a vulnerability assessment 
and security plan, including an assessment of the most 
likely method that could be used by terrorists to exploit 
weaknesses in the covered transportation security and the 
likelihood of success by such terrorists. 
(f) SECURITY PERFORMANCE REQUIREMENTS.—The 
Secretary shall, by regulation, establish security perform-
ance requirements for the security plans required for pro-
viders of covered transportation. The regulations shall—
(1) require separate and increasingly stringent 
security performance requirements for security plans 
as the level of risk associated with the tier increases; 
and 
(2) permit each provider of covered transpor-
tation submitting a security plan to select a com-
bination of security measures that satisfy the secu-
rity performance requirements established by the 
Secretary under this subsection. 
(g) DEADLINE FOR REVIEW PROCESS.—Not later 
than 12 months after the date of the issuance of the regu-
lations under subsection (a), the Secretary shall—
(1) review each vulnerability assessment and se-
curity plan submitted to the Secretary in accordance 
with subsection (b); 
(2) require amendments to any security plan 
that does not meet the requirements of this section, 
including the regulations issued under subsection 
(a); 
(3) approve any vulnerability assessment or se-
curity plan that meets the requirements of this sec-
tion, including such regulations; and 
(4) review each security plan periodically there-
after. 
(h) INTERIM SECURITY MEASURES.—The Secretary 
shall require, during the period before the deadline estab-
lished under subsection (b), each provider of covered 
transportation required to submit a security plan under 
subsection (b) to implement any necessary interim security 
measures to deter, mitigate, and respond to, to the max-
imum extent practicable, a transportation security inci-
dent with respect to the covered transportation or a sub-
stantive threat of such an incident until the security plan 
of the provider is approved. 
(i) NONDISCLOSURE OF INFORMATION.—
(1) IN GENERAL.—Nothing in this Act shall be 
construed to require the disclosure of a vulnerability
assessment or a security plan of a provider of cov-
ered transportation to the extent that such informa-
tion is exempted from mandatory disclosure under 
section 552 of title 5, United States Code. 
(2) OTHER OBLIGATIONS UNAFFECTED.—Noth-
ing in this section shall affect any obligation of the 
provider of covered transportation to submit or 
make available information to covered transportation 
employees, nonprofit employee labor organizations, 
or a Federal, State, or local government agency 
under, or otherwise to comply with, any other law. 
(3) SUBMISSION
OF
INFORMATION
TO
CON-
GRESS.—Nothing in this section shall be construed 
as authorizing the withholding of any information 
from Congress. 
(4) DISCLOSURE
OF
INDEPENDENTLY
FUR-
NISHED
INFORMATION.—Nothing in this section 
shall be construed as affecting any authority or obli-
gation of a Federal agency to disclose any record or 
information that the Federal agency obtains from a 
provider of covered transportation under any other 
law. 
(j) PENALTIES.—
(1) ADMINISTRATIVE PENALTIES.—
(A) IN GENERAL.—The Secretary may im-
pose an administrative penalty of not more than 
$100,000 for failure to comply with this sec-
tion, including regulations issued under sub-
section (a). 
(B) NOTICE
AND
OPPORTUNITY
TO
RE-
QUEST HEARING.—Before imposing a penalty 
under subparagraph (A), the Secretary shall 
provide to the person against whom the penalty 
is to be imposed—
(i) written notice of the proposed pen-
alty; and 
(ii) the opportunity to request, not 
later than 30 days after the date on which 
the person receives the notice, a hearing on 
the proposed penalty. 
(C) REGULATIONS.—The Secretary may 
issue regulations establishing the procedures for 
administrative hearings and appropriate review 
of penalties imposed under this Act, including 
deadlines. 
(2) CIVIL PENALTIES.—
(A) IN
GENERAL.—The Secretary may 
bring an action in a United States district court 
against any provider of covered transportation
that violates or fails to comply with this Act, in-
cluding regulations issued under subsection (a), 
or a security plan approved by the Secretary 
under this section. 
(B) RELIEF.—In any action under this 
Act, a court may issue an order for injunctive 
relief and may impose a civil penalty of not 
more than $75,000 for each day on which a vio-
lation occurs or a failure to comply continues. 
(3) CRIMINAL PENALTIES.—A provider of cov-
ered transportation who intentionally violates this 
section, including regulations issued under sub-
section (a), shall be fined not more than $50,000 for 
each day of such violation, imprisoned for not more 
than 2 years, or both. 
(k) 
EXISTING
PROCEDURES, 
PROTOCOLS
AND 
STANDARDS.—
(1) DETERMINATION.—In response to a peti-
tion by a provider of covered transportation or at 
the discretion of the Secretary, the Secretary may 
recognize existing procedures, protocols, and stand-
ards of a provider of covered transportation that the 
Secretary determines to meet all or part of the re-
quirements of this section, including regulations
issued under subsection (a), regarding vulnerability 
assessments and security plans. 
(2) ELECTION.—Upon review and written de-
termination by the Secretary that existing proce-
dures, protocols, or standards of a provider of cov-
ered transportation satisfy all of the requirements of 
this section, including regulations issued under sub-
section (a), the provider may elect to comply with 
those procedures, protocols, or standards instead of 
the requirements of this section. 
(3) PARTIAL APPROVAL.—If the Secretary de-
termines that the existing procedures, protocols, or 
standards of a provider of covered transportation 
satisfy only part of the requirements of this section, 
including regulations issued under subsection (a), 
the Secretary may accept such submission, but shall 
require submission by the provider of any additional 
information relevant to the vulnerability assessment 
and security plan of the provider to ensure that the 
remaining requirements of this section are fulfilled. 
(4) NOTIFICATION.—If the Secretary deter-
mines that particular existing procedures, protocols, 
or standards of a provider of covered transportation 
under this subsection do not satisfy the require-
ments of this section, including regulations issued