Passenger Rail Security: Consistent Incident Reporting and Analysis Needed to Achieve Program Objectives
Published: 2012-12-19T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Terrorist attacks on foreign passenger rail systems, which include rail transit and intercity rail, have underscored the importance of collecting and analyzing security incident information to identify potential vulnerabilities. Within the federal government, TSA is the primary agency responsible for overseeing and enhancing passenger rail security, and has several programs to fulfill this responsibility. In 2008, TSA issued a regulation requiring U.S. passenger rail agencies to report all potential threats and significant security concerns to TSA, among other things. GAO was asked to assess the extent to which (1) TSA has overseen and enforced this reporting requirement and (2) TSA has analyzed passenger rail security incident information to identify security trends. GAO reviewed TSA policy documents, guidance, and incident data from January 2011 through June 2012, and interviewed federal officials and security officials from 19 passenger rail agencies. GAO selected these agencies, in part, because of their ridership volume. The results of these interviews are not generalizable but provide insights.
section_title: What GAO Found
paragraphs: GAO recommends, among other things, that TSA (1) develop guidance on the types of incidents that should be reported, (2) enhance existing oversight mechanisms for compliance inspections and enforcement actions, (3) develop guidance to reduce errors from data entry problems, and (4) establish a process for regularly conducting trend analysis of incident data. TSA concurred and is taking actions in response.

section_title: Letter
paragraphs: Passenger rail systems are vital components of the nation’s  transportation infrastructure, encompassing rail mass transit (heavy rail  and light rail), commuter rail, and intercity rail. Terrorist attacks on  passenger rail systems around the world—such as the March 2010  subway bombings in Moscow, Russia, and the July 2006 passenger train  bombing in Mumbai, India, that resulted in 209 fatalities—highlight the  vulnerability of these systems and demonstrate that even when security  precautions are put into place, vulnerabilities remain. According to the  Mineta Transportation Institute (MTI), from September 12, 2001, through  December 31, 2011, there were 838 attacks worldwide on passenger rail  systems, resulting in over 1,370 fatalities.passenger rail systems have received heightened attention as several  alleged terrorists’ plots have been uncovered, including plots against rail  systems in the New York City and Washington, D.C., areas in 2009 and  2010, respectively. In addition, intelligence recovered from Osama bin  Laden’s compound indicates that U.S. rail systems were a suggested  target as recently as February 2010, although there has been no  indication of a specific or imminent threat to carry out such an attack.  While there have been no terrorist attacks against U.S. passenger rail  systems to date, the systems are vulnerable to attack in part because  they rely on an open architecture that is difficult to monitor and secure  because of its multiple access points; hubs serving multiple carriers; and,  in some cases, no barriers to access. For example, in May 2011, an  individual was able to walk the length of an underwater train tunnel  between New York and New Jersey without being detected. Had this  individual been a terrorist, he could have executed a disruptive and  potentially damaging attack on this rail tunnel. Given the continued threat  to passenger rail systems, such security breaches underscore the  importance of tracking and analyzing security incident information to  identify possible indicators or precursors of terrorist activity, as well as  information on security vulnerabilities.
In the United States,  Securing the nation’s passenger rail systems is a shared responsibility  requiring coordinated action on the part of federal, state, and local  governments; the private sector; and passengers who ride these systems.  Day-to-day responsibility for securing passenger rail systems falls on  passenger rail agencies themselves, local law enforcement, and often  state and local governments that own a significant portion of the  infrastructure. Within the federal government, the Department of  Homeland Security’s (DHS) Transportation Security Administration (TSA)  is the primary federal agency responsible for overseeing security for  these systems and for implementing programs to enhance their security.
We have previously reported on federal and industry efforts to secure  passenger rail systems and have made recommendations for  strengthening these efforts. DHS generally agreed with these  recommendations and has taken actions to implement them. For  example, in June 2009, we reported that TSA had taken some actions to  implement a risk management approach but had not conducted a  comprehensive risk assessment for mass transit and passenger rail that  integrates threat, vulnerability, and consequence. We recommended that  TSA conduct a risk assessment that combines these three elements,  which the agency could use to inform its security strategy. In response to  our recommendation, in June 2010, TSA produced the Transportation  Sector Security Risk Assessment, which assessed risk within and across  the various aviation and surface transportation modes, including rail, and  incorporated threat, vulnerability, and consequence assessments.
A key component of this shared responsibility for passenger rail security  is ensuring that information on rail security threats and incidents is  collected and analyzed effectively. As part of its rail security  responsibilities, in 2008 TSA issued a regulation requiring U.S. passenger  rail systems to report all potential threats and significant security concerns  to TSA’s Transportation Security Operations Center (TSOC), among  other things. The TSOC is a 24/7 operations center that serves as TSA’s main point of contact for monitoring security-related incidents or crises in  all modes of transportation. TSA’s regulation is intended to provide the  agency with essential information on passenger rail security incidents so  that TSA can conduct comprehensive intelligence analysis, threat  assessment, and allocation of security resources, among other things.  According to the regulation, potential threats and significant security  concerns that must be reported to the TSOC encompass a variety of  incidents and suspicious activities including bomb threats, indications of  tampering with railcars, and other security breaches.
You requested that we evaluate TSA’s passenger rail security incident  reporting process. Accordingly, this report addresses the following  questions:
To what extent has TSA overseen and enforced the passenger rail  security incident reporting requirement?
To what extent has TSA analyzed passenger rail security incident  information to identify security trends and potential threats against  passenger rail systems?
Appendix I of this report also includes information on how selected rail  agencies applied lessons learned from foreign rail attacks to enhance  their rail security measures. Appendix II includes information on key  mechanisms rail agencies use to obtain rail security-related information.
To address these questions, we examined TSA’s rail security incident  reporting process. We reviewed the notice of proposed rulemaking and  final rule that describe the purpose and justification of the incident  reporting requirement, as well as relevant TSA policy documents,  manuals, and guidance. To obtain rail industry perspectives on the rail  security incident reporting process, we conducted visits at, or  teleconferences with, 19 of the top 50 passenger rail systems across the  nation, by passenger rail ridership. See appendix III for a list of the 19  rail agencies we interviewed through our visits and teleconferences. We  selected these 19 passenger rail systems to reflect varied levels of  ridership and geographic dispersion. Because we selected a  nonprobability sample of passenger rail agencies, the information  obtained from these visits and interviews cannot be generalized to all rail  agencies nationwide, but provided illustrative examples of the  perspectives of passenger rail stakeholders about the rail security  incident reporting process, and corroborated information we gathered  through other means. Further, we interviewed rail industry representatives  from the American Public Transportation Association and the  Association of American Railroads to obtain their perspectives on rail  security issues. We selected these associations because they represent  the majority of the passenger and freight rail systems in the United  States.
To assess the extent to which TSA has overseen and enforced the rail  security reporting requirement, we interviewed officials from the selected  rail systems discussed earlier on how they have implemented this  requirement, including the guidance they have received from TSA. We  interviewed TSA headquarters officials from the Compliance Programs  Division within the Office of Security Operations and local TSA inspection  officials from five TSA field offices regarding the guidance they provide to  rail agencies on incident reporting and how they ensure rail agencies’  compliance with the regulation. We selected these five field office  locations because they had oversight responsibility for many of the rail  agencies included in our scope. Because we selected a nonprobability  sample of TSA’s field offices and officials, the results from these  interviews cannot be generalized to all field offices; however, the  information we obtained provided us with an overview of the role of TSA  surface inspectors in the rail incident reporting process and corroborated  information we obtained through other sources. We also examined  documentation on TSA’s inspection processes for monitoring rail systems’  compliance with the incident reporting requirement, including the  Transportation Security Inspector Inspections Handbook, the National  Investigations and Enforcement Manual, and the Compliance Work Plan  for Transportation Security Inspectors.
In addition, we analyzed incident data from the TSOC’s incident  management database, known as WebEOC, for the period January 2011  through June 2012, to determine the number and types of passenger rail  security incidents reported to the TSOC by rail agencies. On the basis  of information from and discussions with TSA officials related to the  controls in place to maintain the integrity of TSA’s incident data, we  determined that the information in WebEOC was sufficiently reliable for  the purposes of providing information on differences in the number and  types of rail security incidents reported by selected rail agencies to the  TSOC. However, we identified issues with data entry and data quality,  which are discussed later in this report. In addition, we analyzed data  from TSA’s Performance and Results Information System (PARIS) for  January 2011 through June 2012 on TSA’s compliance inspections and  all records related to enforcement actions taken under the passenger rail  security incident reporting requirement. We also evaluated TSA’s efforts  to oversee and enforce the incident reporting requirement against criteria  in GAO’s Standards for Internal Control in the Federal Government.
To assess the extent to which TSA has analyzed rail security incident  information, we interviewed TSA officials from the TSOC, the Office of  Intelligence and Analysis, the Office of Security Operations, and the  Office of Security Policy and Industry Engagement regarding their roles  and responsibilities. We reviewed TSA documentation and analyses  containing rail security incident information. We also examined the  WebEOC incident management database to identify any database  limitations that could present challenges for analyzing the incident  information, and we discussed these limitations with TSA officials. We  also interviewed officials from the rail agencies noted earlier about their  views on the information and analyses they receive from TSA on rail  security incidents.
To determine how selected rail agencies applied lessons learned from  foreign rail attacks to enhance their rail security measures and how rail  agencies obtain and share passenger rail security-related information,  including information on lessons learned from foreign rail attacks, we  interviewed security officials from selected passenger rail systems. During  visits to passenger rail systems, we toured stations and other facilities  such as control centers, and observed security practices. We also  reviewed our prior reports on passenger rail security and information  sharing as well as studies and reports conducted by outside organizations  related to passenger rail, such as the DHS Office of the Inspector  General. Appendix III provides more details on our objectives, scope, and  methodology, including a list of the rail agencies we interviewed.
We conducted this performance audit from January 2012 through  December 2012 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: As previously stated, TSA’s 2008 regulation requires passenger rail  agencies to report potential threats and significant security concerns to  the TSOC. According to the regulation, potential threats and significant  security concerns (rail security incidents) include, but are not limited to,  the following:  1) interference with the train or transit vehicle crew;  2)  bomb threats, specific and non-specific;  3) reports or discovery of suspicious items that result in the disruption  of rail operations;  4) suspicious activity occurring onboard a train or transit vehicle or  inside the facility of a passenger railroad carrier or rail transit system  that results in a disruption of rail operations;  5) suspicious activity observed at or around rail cars or transit vehicles,  facilities, or infrastructure used in the operation of the passenger  railroad carrier or rail transit system;  6)  discharge, discovery, or seizure of a firearm or other deadly weapon  on a train or transit vehicle or in a station, terminal, facility, or storage  yard, or other location used in the operation of the passenger  railroad carrier or rail transit system;  7) indications of tampering with passenger rail cars or rail transit  vehicles;  8) information relating to the possible surveillance of a passenger train  or rail transit vehicle or facility, storage yard, or other location used in  the operation of the passenger railroad carrier or rail transit system;  9) correspondence received by the passenger railroad carrier or rail  transit system indicating a potential threat to rail transportation; and  10)  other incidents involving breaches of the security of the passenger  railroad carrier or the rail transit system operations or facilities.
The regulation also authorizes TSA officials to view, inspect, and copy rail  agencies’ records as necessary to enforce the rail security incident  reporting requirements. This regulatory authority is supported by TSA  policies and guidance, including the Transportation Security Inspector  Inspections Handbook, the National Investigations and Enforcement  Manual, and the Compliance Work Plan for Transportation Security  Inspectors.
Within TSA, different offices have responsibilities related to implementing  and enforcing the rail security incident reporting requirement. The TSOC,  managed by TSA’s Office of Law Enforcement/Federal Air Marshal  Service, is the TSA entity primarily responsible for collecting and  disseminating information about rail security incidents. Once notified of a  rail security incident, TSOC officials are responsible for inputting the  incident information into their incident management database known as  WebEOC, and for disseminating incident reports that they deem high  priority or significant to select TSA officials; other federal, state, and local  government officials; and select rail agencies’ law enforcement officials.  TSA’s Office of Intelligence and Analysis is responsible for analyzing  threat information for all modes of transportation, including information  related to passenger rail. TSA’s Office of Security Policy and Industry  Engagement is responsible for using incident reports and analyses,  among other things, to develop strategies, policies, and programs for rail  security, including operational security activities, training exercises, public  awareness, and technology. Figure 1 shows the intended steps and  responsibilities of TSA components involved in the rail security incident  reporting process.
TSA’s Office of Security Operations is responsible for overseeing and  enforcing the incident reporting requirement. Responsible for managing  TSA’s inspection program for the aviation and surface modes of  transportation, the Office of Security Operations’ Surface Compliance  Branch deploys approximately 400 transportation security inspectors- surface (TSI-S) nationwide.clarification to rail agencies regarding the incident reporting process  highlighted in figure 1, and for overseeing rail agencies’ compliance with  the reporting requirement by conducting inspections to ensure that  incidents were properly reported to the TSOC. TSI-Ss also conduct  assessments of surface transportation systems, including passenger rail  systems, and oversee compliance with other applicable transportation  security policies, directives, standards, and agreements. At the  headquarters level within the Office of Security Operations, the  Compliance Programs Division is responsible for assisting TSA  management and surface inspection officials in the field by providing  guidance and subject matter expertise in ensuring compliance by   The TSI-Ss are responsible for providing  regulated entities with security requirements. Six regional security  inspectors-surface (RSI-S) within the Compliance Programs Division are  responsible for providing national oversight of local surface inspection,  assessment, and operational activities.
section_title: TSA Has Provided Inconsistent Oversight and Enforcement of the Passenger Rail Security Incident Reporting Requirement
paragraphs: TSA has not provided consistent oversight of the implementation of the  passenger rail security reporting requirement, leading to considerable  variation in the types and number of rail security incidents reported. This  variation is compounded by inconsistency in compliance inspections and  enforcement actions, due in part to limited utilization of oversight  mechanisms at the headquarters level.
subsections: section_title: Variation in Implementation of the Reporting Requirement
paragraphs: Since the rail security incident reporting regulation went into effect in  December 2008, local TSA inspection officials, who are the primary TSA  points of contact for rail agencies, have not received clarifying guidance  from TSA headquarters regarding how rail agencies should implement the  reporting regulation. Although the regulation identifies 10 broad types of  rail security incidents that must be reported to the TSOC, 7 of the 19 rail  agencies we spoke with noted that there are several grey areas within  these incident types that can be open to interpretation. In the absence  of clarifying guidance from TSA headquarters, local TSA inspection  officials have provided rail agencies with inconsistent interpretations of  the regulation’s reporting requirements. Some variation is expected in the  number of rail security incidents that rail agencies reported because of  differences in agency size, geographic location, and ridership. For  example, we analyzed incident data for 7 of the 19 rail agencies included  in our review, and found that the number of incidents reported per million  riders ranged from 0.25 to 23.15. Inconsistent interpretation of the  regulation by local TSA inspection officials has contributed to this  variation. For example, officials from one rail agency we spoke with had  been told by their local TSA inspection officials that they were required to  report all instances in which a person was hit by a train, because an  individual cannot be struck by a train in the right of way without  trespassing or breaching security. In contrast, officials from another rail  agency told us that their agency does not report all of these incidents  because they are most often intentional suicides that are unrelated to  terrorism. The local TSA inspection officials responsible for this agency  agreed with this interpretation, noting that suicides generally have no  nexus to terrorism.
Similarly, rail agencies may have received inconsistent feedback from  their local TSA inspection officials about reporting incidents involving  weapons. The regulation requires that rail agencies report incidents that  involve the “discharge, discovery, or seizure of a firearm or other deadly  weapon on a train or transit vehicle or in a station, terminal, facility, or  storage yard, or other location used in the operation of the passenger  railroad carrier or rail transit system.” However, officials from one rail  agency stated that if an individual is stopped for fare evasion and is  subsequently found to be in possession of an illegal firearm, they would  not report the incident to the TSOC because it is a local criminal incident  unrelated to terrorism. These officials explained that they would report  only incidents that could have a nexus to terrorism, in part because  reporting incidents that are unrelated to terrorism could reduce the quality  of the data TSA collects. The local TSA inspection officials responsible for  this agency have never found it to be in noncompliance for not reporting a  weapon, tacitly approving of the agency’s interpretation of the regulation.  In contrast, officials at another rail agency said that they report all  incidents related to weapons—regardless of their possible nexus to  terrorism—because their local TSA inspection officials have instructed  them that any firearm found in the system has to be reported. However,  these officials stated that because of local gun laws, handguns are seized  during the course of routine law enforcement activities, and are generally  incidental to the original criminal offense. While they do report these local  criminal incidents to the TSOC as directed by their local TSA inspection  officials, the rail agency officials stated that it is unclear to them why it is  necessary to do so if they have no nexus to terrorism. Clarification about  which incidents should be reported could help address the confusion  among rail agencies, and improve consistency in incident reporting.
Before the final rule was issued in November 2008, rail stakeholders  raised concerns about the types of incidents required to be reported in  commenting on the notice of proposed rulemaking. Specifically, some rail  stakeholders noted when commenting on the proposed rule that the  regulation’s definition of reportable events was too broad and would result  in an overload of information that would divert attention from truly  significant threats and dilute the effectiveness of the reporting system.  Rail stakeholders requested that TSA clarify the reporting requirements,  but in the preamble to the final rule, TSA stated that the agency would not  further define or limit the scope of the reporting requirement, because  doing so would reduce the data that TSA received, which could be used  for broader trend analyses in order to anticipate or prevent an attack.  TSA has maintained this position, and as a result, has not developed  clarifying guidance at the headquarters level regarding the reporting  requirement.
However, local TSA inspection officials, headquarters level compliance  officials, and rail agency officials that we interviewed stated that additional  written guidance could help ensure that the regulation is implemented  more consistently. According to Standards for Internal Control in the  Federal Government, information should be communicated in a way that  allows officials to carry out their responsibilities. In October 2011, we  also reported that providing officials with guidance that contains specific  criteria and definitions would provide greater assurance that decisions are  made consistently. For the aviation mode, TSA has established written  guidance for reporting security incidents. TSA’s operational directive for  reporting aviation security incidents includes attachments that, among  other things, identify the types of incidents that are to be reported, based  on the immediate security threat of different types of incidents. With  regard to passenger rail, however, TSA has maintained the agency’s  position as detailed in the preamble to the final rule, as described above,  and has not taken actions to develop clarifying guidance regarding the  types of incidents that should be reported under the regulation. Providing  similar guidance to local TSA inspection officials responsible for rail  agencies could help to ensure that these officials are interpreting the  regulation consistently across different field offices. These actions could  also better position TSA to consistently collect rail security incident  information, which may facilitate its efforts to conduct trend analysis and  also help TSA to “connect the dots” to identify potential threats to  passenger rail systems.
section_title: Inconsistent Compliance and Enforcement
paragraphs: TSA monitors passenger rail agency compliance with incident reporting  requirements through compliance inspections and related enforcement  activities at the local level, but TSA has not utilized its limited oversight  mechanisms at the headquarters level as intended for ensuring  consistency in these activities. Local TSA inspection officials conduct  inspections of rail agencies to ensure compliance with the incident  reporting requirement—that is, to ensure that rail agencies are properly  reporting significant security concerns to the TSOC. In addition to  monitoring compliance, inspections offer local TSA officials opportunities  to provide rail agencies with feedback regarding their implementation of  the regulation. TSA inspection officials also may take enforcement action  against a rail agency that TSA finds to be not in compliance. Within TSA  headquarters, the Compliance Programs Division within the Office of  Security Operations is responsible for ensuring consistency in the  application of all regulatory priorities that are to be implemented by the  field and for monitoring and overseeing operational and field activities  intended to support TSA’s national rail security programs and objectives.
Our analysis of TSA’s inspection data from January 1, 2011, through  June 30, 2012, shows that the frequency of local TSA inspections of  compliance with the reporting regulation varies among rail agencies.  TSA’s rail security inspection policies and guidance do not specify how  often inspections should be conducted, instead recommending that  inspections be driven by reportable events, with local discretion used to  ensure a reasonable number of inspections are performed. According to  senior TSA compliance officials, this means that inspections can be  initiated in response to a particular incident that local TSA officials  become aware of, as opposed to being scheduled at regular intervals.  According to PARIS data, from January 1, 2011, through June 30, 2012,  of the 19 rail agencies we spoke with, 7 agencies had been inspected at  least 18 times, or an average of once per month. However, 3 agencies  had not been inspected, including a large metropolitan rail agency.  Information in the text box below provides an example of this rail agency’s  experience with TSA compliance activities. Average monthly inspections  for this time period ranged from about eight inspections to no inspections,  and there was also variation in the regularity with which inspections  occur. For example, although 1 agency was inspected 4 times during the  time period we reviewed, 3 of these inspections were conducted on the  same day. In contrast, another agency was inspected a total of 11  times, with each inspection occurring in a different month.
TSA Had Not Inspected a Major Rail Agency  On the basis of our review of the TSOC’s database, we found that one major  rail agency had not reported any incidents to the TSOC from January 1, 2011  through June 30, 2012. According to officials from this rail agency, the agency  did not report any incidents because the rail agency had not clearly identified  who in the agency was responsible for reporting incidents to the TSOC. Further,  the local TSA inspectors responsible for this rail system had not conducted any  compliance inspections to determine whether the system was meeting its  requirement to report rail security incidents, according to PARIS inspection  records. The regulation requires rail agencies to allow TSA inspectors to  conduct inspections, copy records, and perform tests to ensure that rail  agencies are meeting their rail security incident reporting responsibilities. Local  TSA inspection officials told us, however, they did not have sufficient access to  the rail agency’s police records and personnel to complete these inspection  activities and therefore were unable to determine whether rail security incidents  have actually occurred in the system. Given the passenger volume of this rail  system, the local TSA officials stated that it was highly unlikely that no rail  security incidents had occurred. According to local news sources, several  security incidents had occurred on the system during 2011 that, according to  the regulation, should have been reported to the TSOC. For example, an  Internet search we conducted in September 2012 indicated that in 2011, local  news reported on a suspicious item found in one of the rail system’s stations  that resulted in a delay of service. Local TSA inspection officials stated that they  did not pursue enforcement action against the rail system for incidents that  should have been reported, nor did they request assistance from TSA’s Surface  Compliance Branch in obtaining access to the rail system’s incident  documentation. These local TSA inspection officials also explained that they are  working on improving their relationship with the rail agency and their access to  the agency’s incident records.
TSA’s policies also describe a variety of activities that may constitute an  inspection. According to senior TSA compliance officials, these broad  policies on how to conduct inspections contribute to inconsistent  approaches across TSA field offices. For example, according to TSA  policy, inspections could range from a phone call to the rail agency to  inquire whether the agency reported a specific incident to more rigorous,  regularly scheduled, on-site inspections of rail agencies’ internal incident  management systems. However, for an inspection official to inquire about  whether an agency reported a specific incident by phone, that official  must first become aware of the incident through other means, such as a  media report, whereas on-site inspections could allow TSA inspection  officials to identify incidents that did not result in media reports, but should  have been reported to the TSOC under the regulation. Further, senior  TSA compliance officials told us that some local TSA inspectors may be  hesitant to conduct regular on-site inspections or find rail agencies not in  compliance for incident reporting because doing so could make rail  agencies less willing to participate in other important voluntary security  activities, such as TSA’s Baseline Assessment for Security Enhancement  (BASE) and the TSA-led Visible Intermodal Prevention and Response  Program. However, variations in the rigor and frequency of inspections  highlight the need for enhanced oversight of these activities at the  headquarters level to help ensure that rail agencies are reporting security  incidents as required by the regulation.
In addition, TSA has inconsistently applied enforcement actions against  rail agencies for not complying with the regulation. TSA’s progressive  enforcement policy includes the following steps, in order of severity,  following a finding of not in compliance: (1) on-the-spot counseling, (2)  administrative action—notice of noncompliance, and (3) civil penalty  action.compliance that resulted in on-the-spot counseling or a notice of  noncompliance for failing to report certain types of incidents that other  agencies may not report as a matter of standard practice, such as  weapons discovered during the course of routine criminal activity. For  example, one rail agency received a notice of noncompliance for failing to  report an incident involving a knife that was discovered in an individual’s  possession after law enforcement officials intervened in a verbal  altercation on a train. In contrast, as discussed above, officials from  another rail agency said that they would not report routine criminal  incidents involving weapons, including firearms and other deadly  weapons such as knives, and had discussed this policy with their local  TSA inspection officials. While the agency had been inspected, the local  TSA officials had never issued a finding of noncompliance related to not  reporting incidents involving weapons. TSA inspection officials have also  taken an enforcement action against a rail agency for failing to report an  incident that was not required to be reported. Specifically, one rail agency  received a notice of noncompliance for failing to report a suspicious item  discovered in the public area of one of its bus garages. However,  according to a senior TSA compliance official, rail agencies are not  required to report incidents involving buses or bus facilities, and therefore  TSA officials should not take enforcement actions against rail agencies  for failing to report bus incidents.
In some cases, rail agencies have received a finding of not in  According to senior TSA compliance officials, inconsistent inspection and  enforcement actions occur, in part because TSA has limited oversight  mechanisms at the headquarters level, and has not utilized them as  intended to monitor or oversee the rail security compliance and inspection  activities in the field. Standards for Internal Control in the Federal  Government provides that internal controls should be designed to ensure  that ongoing monitoring occurs in the course of normal operations. TSA  established the regional security inspector-surface (RSI-S) position as a  primary oversight mechanism at the headquarters level for monitoring  compliance inspections and enforcement actions to help ensure  consistency across field offices. However, according to TSA officials, the  RSI-S is not part of the formal inspection process and has no authority to  ensure that inspections are conducted consistently. The RSI-S also has  limited visibility over when and where inspections are completed or  enforcement actions are taken because TSA lacks a process to  systematically provide the RSI-S with this information during the course of  normal operations. As a result, TSA has limited assurance that the RSI-S  will be able to provide oversight of local passenger rail inspection and  enforcement activities. For example, with regard to the situation  discussed in the text box above, the RSI-S responsible for that rail  agency was not aware that the agency had not reported any incidents to  the TSOC and had never been inspected by the local TSA inspection  officials. The text box below provides another example of the challenges  that TSA faces in ensuring consistency across local TSA offices.
TSA Efforts to Streamline Amtrak’s Compliance Activities Face  Challenges  In 2010, Amtrak worked with an RSI-S to streamline the reporting and  inspection process, but TSA has faced challenges implementing this process  across all its field offices. As the only nationwide passenger rail agency,  Amtrak has been regularly inspected by multiple TSA field offices in locations  that Amtrak services. According to Amtrak and TSA officials, these  inspections are duplicative and cause confusion because incidents may be  inspected for compliance by multiple TSA field offices, each with potentially  different interpretations of the regulatory requirement. For example, one local  TSA office found Amtrak to be not-in-compliance for not reporting an incident  that another TSA office had told Amtrak did not need to be reported. To ensure  that that the regulation was being applied consistently throughout its  operations, Amtrak notified the RSI-S of these inconsistencies between  different field offices, and worked with the RSI-S to establish a centralized  incident reporting and inspection process. Under this new process, according  to Amtrak and TSA officials, all rail security incidents occurring on Amtrak  nationwide should be reported to TSOC by Amtrak’s National Communications  Center in Philadelphia, Pennsylvania, rather than by the local Amtrak officials  where the incident occurred. In addition, according to Amtrak and TSA  officials, all TSA compliance inspections should be conducted by the local TSA  field office in Philadelphia. According to these officials, the centralized  reporting and inspection process has been implemented effectively by the  Philadelphia field office. Specifically, between one and three times per month,  a TSA official from the Philadelphia office checks compliance by randomly  selecting security incidents from Amtrak’s centralized incident monitoring  system to determine whether they have been properly reported to the TSOC.  However, although Amtrak and the RSI-S have implemented this reporting  approach with the Philadelphia TSA office, other local TSA offices have  continued to conduct compliance inspections of Amtrak. According to PARIS  data, from January 2011 through July 2012, Amtrak was inspected 145 times.  Of these, 116 were carried out by local TSA offices other than the Philadelphia  office. According to senior TSA compliance officials, TSA headquarters has not  taken actions to ensure that other field offices adhere to this centralized  inspection approach, and TSA’s mechanisms to monitor or oversee the rail  security compliance and inspection activities in the field are limited.
In the absence of a process to systematically monitor the inspection and  enforcement activities of TSA field offices, it is unlikely that the RSI-Ss or  compliance officials at the headquarters level would become aware of  inconsistencies in compliance and enforcement activities in the field,  unless the inconsistencies were specifically brought to their attention.  However, even when compliance officials have become aware of issues  related to inconsistent application of compliance or enforcement  measures in the field, according to senior TSA compliance officials, no  action has been taken by the Office of Security Operations at the  headquarters level to ensure consistency among field offices. TSA  inspection and compliance officials agreed that TSA could take steps to  ensure more consistent application of compliance inspections and  enforcement actions among TSA surface inspectors. By enhancing the  existing oversight mechanisms at the headquarters level to systematically  monitor and oversee compliance inspections and enforcement actions, as  intended, TSA could improve its visibility over activities in the field,  helping to ensure that local TSA inspection officials are consistently  overseeing the regulatory reporting requirement. Such actions could  further reduce inconsistency in the number and type of incidents that rail  agencies report to the TSOC, which could improve TSA’s ability to use  the incident information for trend analysis to identify potential threats, as  discussed below.
section_title: Incident Data and Process Limitations Hinder Trend Analysis
paragraphs: TSA’s incident management data system, known as WebEOC, has  incomplete information, is prone to data entry errors, and has other  limitations which inhibit TSA’s ability to search and extract basic  information. These weaknesses in WebEOC hinder TSA’s ability to use  rail security incident data to identify security trends or potential threats. In  addition to these data weaknesses, TSA has conducted limited analysis  of rail security incident information, in part because TSA does not have a  systematic process for identifying trends or patterns in rail security  incident information.
subsections: section_title: Incomplete Information
paragraphs: When TSA learns about an incident that may not have been properly  reported to the TSOC (through a compliance inspection or other means),  there is no established process to ensure that WebEOC is updated to  include that incident. As a result, WebEOC has incomplete incident  information, which hinders TSA’s ability to identify security trends and  patterns. For example, over the course of 19 months, five similar  incidents involving a suspicious item occurred in different stations of one  rail agency. Although the rail agency did not report these incidents to the  TSOC, the rail agency’s internal intelligence group recognized a pattern,  and developed an intelligence brief that it then disseminated to relevant  rail stakeholders, including TSA. Upon receipt of this intelligence brief,  local TSA inspection officials responsible for this rail agency issued a  notice of noncompliance to the agency for not reporting two incidents  highlighted in the brief. In this case, the local TSA inspection official  responsible for the agency reported these two incidents to the TSOC, but  did not subsequently report the other three related incidents for inclusion  in WebEOC. Similarly, of the 18 findings of noncompliance that were a  result of failure to report an incident, 13 were not subsequently reported  to the TSOC. Because TSA has no established process to help ensure  TSA inspection officials or rail agencies notify the TSOC or update  WebEOC with incident information that was not properly reported,  WebEOC does not contain a record of these unreported rail security  incidents. Standards for Internal Control in the Federal Government calls  for agencies to take actions to help ensure that data are complete and  accurate. Developing a process for ensuring the inclusion of incidents  discovered during compliance inspections that were not immediately  reported to the TSOC could provide TSA with a more comprehensive  picture of security incidents to better position it to identify any trends or  patterns.
section_title: Data Entry Errors and Limitations
paragraphs: In addition, we identified data entry errors and limitations in WebEOC,  which inhibit TSA’s ability to search and extract certain information.  Further, the guidance provided to officials responsible for entering  incident information does not help prevent these errors because it allows  for variation in the WebEOC data and assumes that the official  responsible for entering the data fully understands the data entry options.  As a result, the TSOC could not provide us with certain information about  the rail security incident data, such as the number of incidents reported by  incident type (e.g., suspicious item or bomb threat) or the total number of  rail security incidents that have been reported to the TSOC. Without the  ability to identify this information on the number of incidents by type or the  total number of incidents, TSA faces challenges determining if patterns or  trends exist in the data, as the reporting system is intended to do.  Additionally, because WebEOC does not contain a specific data field to  identify the agency affected by the incident, TSA could not provide us with  the total number of incidents reported by a particular agency.TSOC officials agreed with our findings and noted that these errors and  limitations in WebEOC have complicated TSA’s ability to use the data to  identify security trends or potential threats. For example, TSA attempted  to analyze the frequency of rail tunnel breaches occurring in the U.S. rail  system, as directed by the conference report accompanying the DHS   Senior  appropriations act for fiscal year 2012.TSA intelligence analyst, the rail security incident information from  WebEOC was inadequate for conducting this analysis, and as a result,  TSA had to request information from rail agencies and industry  associations to complete the analysis.
However, according to a senior  We also found that WebEOC data entry errors occur, in part, because of  problems in the data entry process and limitations in WebEOC, including  inaccurate categorization of incident characteristics in key data fields,  such as the “Incident Type” and “Type of Entry” fields. For example, we  analyzed 1 month of the data provided by TSA, which included a total of  152 passenger rail security incidents. We reviewed the “Incident Type”  data field for these incidents, and found that 106 (70 percent) were  characterized as “Not Applicable” or “Other Rail Incidents.” While this  alone does not indicate that these incidents were mischaracterized, we  found that 25 of these incidents should have been characterized under  other available options, including “Firearm or Deadly Weapon,” “Bomb  Threat,” or “Suspicious Activity,” among others. TSA officials agreed that  the options for the “Incident Type” data field could often result in errors,  and that these errors contributed to TSA’s inability to provide the number  of security incidents reported by incident type.
With regard to the “Type of Entry” data field, TSA provided data extracted  from WebEOC using the “Mass Transit” and “Rail” categories within this  data field in response to our request for all of the passenger rail incidents  reported from January 2011 through June 2012. However, because the  WebEOC data entry options did not distinguish between passenger rail  and freight rail, TSA could not provide a dataset that included only  incidents reported by passenger rail agencies. Further, because TSA  officials responsible for entering the incident data were not provided  guidance that included definitions of the data entry options, incidents  reported by the passenger rail agencies in our scope were sometimes  categorized as “Mass Transit” and other times as “Rail.” As a result of  our review, TSOC officials recognized that the options available under the  “Type of Entry” data field were a key limitation of the WebEOC system  resulting in data entry errors. In July 2012, officials at TSOC removed  “Rail” as an option within “Type of Entry,” and replaced it with two  options—“Passenger Rail” and “Freight Rail.” TSOC officials also  developed additional guidance for the individuals responsible for entering  the data, which can be accessed directly from WebEOC. This guidance  addresses the data entry options for the “Type of Entry” data field,  providing definitions of each of the surface transportation modes included  as options.
TSA’s actions to create new data entry options and guidance for the  “Type of Entry” data field are positive steps toward improving the  categorization of rail security incident data. However, TSOC officials have  not taken similar actions to address issues that exist with other data fields  in WebEOC, including the “Incident Type” data field. The WebEOC data  entry guidance that TSA has provided officials in the TSOC for data fields  other than “Type of Entry” does not help prevent data entry errors from  occurring because it allows for variation in the WebEOC data and  assumes that the official responsible for entering the data fully  understands the data entry options. For example, the stated purpose of  the guidance is to ensure that all necessary elements of an incident are  captured “while maintaining each  unique style.” Further, the  guidance states that the data fields such as “Incident Type” are “self- explanatory” and provides no additional information on how to enter the  data or choose among different options.
We have previously reported on the importance of clear data entry  guidance to help ensure that TSA is collecting consistent data that will  allow the agency to better “connect the dots” with regard to potential  terror threats to U.S. transportation systems. Further, Standards for  Internal Control in the Federal Government states that information should  be communicated to officials within an agency in a way that allows them  to carry out their responsibilities. Additional guidance that contains clear  definitions of data entry options could help TSA to reduce data entry  errors in other data fields and improve users’ ability to search and extract  basic information from the system, ultimately improving TSA’s ability to  analyze the rail security incident information.
section_title: Limited Use of Incident Information
paragraphs: The weaknesses in the incident information notwithstanding, TSA has  made limited use of the rail security incident information it has collected  from rail agencies, in part because it does not have a systematic process  for conducting trend analysis. As a result, TSA is missing an opportunity  to identify potential security trends and patterns in the incident  information, and develop recommended security measures to mitigate  threats, as intended. Although TSA does not have a systematic process  for identifying trends and patterns using the WebEOC rail security  incident information, opportunities exist to identify trends from the  information, despite the data weaknesses discussed above. In one  example, the freight rail industry, through the Railway Alert Network— which is managed by the Association of American Railroads, a rail  industry group—identified a trend where individuals were reportedly  impersonating federal officials. In coordination with TSA and FRA, the  Railway Alert Network subsequently issued guidance to its member  organizations designed to increase awareness among freight rail  employees and provide descriptive information on steps to take in  response. The Railway Alert Network identified this trend through analysis  of incident reporting from multiple freight railroads. In each case, the  incident had been reported by a railroad employee. These incidents had  also been reported to the TSOC.
Similarly, in response to a specific request from freight rail stakeholders,  TSA’s Office of Intelligence and Analysis, which is responsible for  analyzing threat information, used WebEOC incident information to  identify the frequency and timing of shootings at freight trains. However,  other products developed by the Office of Intelligence and Analysis and  other DHS components that address domestic rail security incidents do  not contain trend analysis of reported rail security incidents and are  instead generally limited to descriptions of specific incidents. For  example, TSA produces a series of periodic reports called the Global and  Regional Intelligence Digest that provides descriptive reports of select  transportation security incidents (for all transportation modes), with  minimal accompanying analysis. Similarly, other products may contain  intelligence information designed to inform rail stakeholders, but are  based on sources other than the rail security incident data reported by rail  agencies to the TSOC. Senior TSA intelligence officials we spoke with  agreed that TSA does not have a systematic process for analyzing the rail  security incident information, and is not using the information to conduct  long-term trend analysis, though agency officials said they would like to  do so in the future.
In the absence of a systematic process for conducting trend analysis,  TSA officials said that the agency primarily relies on internal TSA officials  to notice trends when they receive daily incident report summaries from  the TSOC, which are detailed summaries of the most significant incidents  reported each day, across all modes of transportation. However, TSA  officials said that the agency has not identified any trends in passenger  rail incidents as a result of these summaries. As a result, officials from rail  agencies we spoke with generally found little value in the reporting  process, because it was unclear to them how, if at all, the information was  being used by TSA to identify trends or threats that could help TSA and  rail agencies develop appropriate security measures. The notice of  proposed rulemaking, final rule, and the Privacy Impact Assessment  associated with collecting the incident information in WebEOC state that  TSA’s purpose for collecting and maintaining the incident information is to  help TSA “connect the dots.” In these documents, the agency said it  would “connect the dots” by pulling together seemingly disconnected or  disparate reports of suspicious or unusual rail security incidents through  trend analysis that may allow TSA to anticipate and prevent an attack,  and determine whether to encourage or require rail agencies to  implement particular security measures. Without a process for  systematically conducting trend analysis of the rail security incident data,  it will be difficult for TSA to use the incident data it collects from agencies.  As a result, TSA may continue to miss opportunities to identify security  trends, such as the freight rail security trend identified by the Railway  Alert Network, or to develop recommended security measures.
section_title: Conclusions
paragraphs: The foiled terrorist plots against the New York and Washington, D.C.,  passenger rail systems in 2009 and 2010, respectively, show the  continued threat to passenger rail security and underscore the importance  of tracking and analyzing security incident information to identify possible  indicators or precursors of terrorist activity. TSA’s incident reporting  regulation, issued in 2008, was intended to allow TSA to “connect the  dots” to identify significant incidents, and discern rail security threats and  trends. However, TSA has not used the incident information as it was  intended. Using the incident information to conduct trend analysis would  better position TSA to anticipate a future attack, and encourage or require  rail agencies to implement more targeted security measures. Key to the  effectiveness of this effort is collecting consistent, accurate, and complete  incident information from rail agencies. While some variation is expected  among rail agencies in the number and types of rail security incidents  reported, written guidance disseminated to rail agencies and local TSA  inspection officials—clarifying the types of incidents that should be  reported to the TSOC—and enhanced mechanisms for oversight of  compliance and enforcement activities could help ensure that the  regulation is implemented consistently. Such actions could also help  improve consistency in TSA’s compliance activities, thereby improving the  reporting process and facilitating TSA’s ability to use the incident  information for trend analysis that may identify potential threats.
In addition, incomplete information, data entry errors, and limitations in  WebEOC hinder TSA’s ability to use rail security incident data to identify  security trends or potential threats. TSA has taken some steps toward  addressing some of the weaknesses in WebEOC, but additional actions  could improve the completeness and accuracy of the information in the  database. A process for updating the database when incidents that had  not previously been reported are discovered through compliance activities  and additional guidance for TSOC officials who enter the information  would help TSA to reduce data entry errors and improve users’ ability to  search and extract information from the system, ultimately improving  TSA’s ability to analyze the rail security incident information. The  weaknesses in the incident information notwithstanding, without a  systematic process in place for regularly conducting trend analysis, TSA  has missed opportunities to use the data in its incident reporting system  as it was intended—to identify trends or patterns in the incident  information that could help TSA and rail agencies develop targeted  security measures that could strengthen rail security.
section_title: Recommendations for Executive Action
paragraphs: To help ensure that the rail security incident reporting process is  consistently implemented and enforced, we recommend that the  Administrator of TSA take the following two actions: develop and disseminate written guidance for local TSA inspection  officials and rail agencies that clarifies the types of incidents that  should be reported to the TSOC, and enhance and utilize existing oversight mechanisms at the  headquarters level, as intended, to provide management oversight of  local compliance inspections and enforcement actions.
To help fulfill TSA’s stated purpose for collecting rail security incident  information and improve the accuracy and completeness of the incident  data in TSA’s incident management system, WebEOC, we recommend  that the Administrator of TSA take the following three actions: establish a process for updating the database when incidents that had  not previously been reported are discovered through compliance  activities; develop guidance for TSOC officials that includes definitions of data  entry options to reduce errors resulting from data entry problems; and establish a systematic process for regularly conducting trend analysis  of the rail security incident data, in an effort to identify potential  security trends that could help the agency anticipate or prevent an  attack against passenger rail and develop recommended security  measures.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS for comment. In written  comments received December 4, 2012, DHS concurred with the  recommendations and identified actions taken, planned, or under way to  implement the recommendations. DHS’s written comments are  summarized below and reproduced in appendix V. The Department of  Transportation’s Director of Audit Relations stated in an e-mail received  on December 6, 2012, that the department had no comments on the  report. Amtrak’s audit liaison stated in an email received on November  16, 2012, that Amtrak had no comments on the report.
In its written comments, DHS concurred with our recommendation that  TSA develop and disseminate written guidance for local TSA inspection  officials and rail agencies that clarifies the types of incidents that should  be reported to the TSOC. DHS stated that TSA’s Office of Security  Operations and its Office of Security Policy and Industry Engagement will  work together to develop written guidance for passenger rail agencies  clarifying the types of incidents that should be reported to the TSOC. TSA  plans to disseminate the guidance to passenger rail agencies. If  implemented, these actions would address our recommendation and  could help reduce confusion among rail agencies and improve  consistency in incident reporting.
In response to our recommendation that TSA enhance and utilize existing  oversight mechanisms at the headquarters level, as intended, DHS  concurred with the recommendation and stated that while several  mechanisms and layers are in place for oversight and management of  local inspection and enforcement actions, TSA recognizes that there are  opportunities for improving oversight. According to DHS, existing  oversight mechanisms include RSI-Ss, who serve as technical specialists,  oversee and implement transportation security policy and programs, and  conduct field office audits and visits, among other things. DHS also stated  that its Office of Chief Counsel coordinates enforcement actions with RSI- Ss, local field offices, TSA’s Office of Compliance Programs, and TSA’s  Office of Security Policy and Industry Engagement. DHS stated that to  improve headquarters oversight, RSI-Ss have recently been granted case  review privileges in PARIS—which is used to record all TSA inspection  activities—along with any findings and actions taken. DHS stated that this  will allow the RSI-Ss greater visibility on all surface inspections,  investigations, and recommendations for enforcement actions entered  into PARIS by enabling the RSI-Ss to provide written recommendations in  PARIS prior to inspection approval. Because RSI-Ss have recently been  granted this access, it is too soon to determine the extent to which this  action will address our recommendation.
In response to our recommendation that TSA establish a process for  updating its WebEOC database when incidents that had not been  previously reported are discovered through compliance activities, DHS  concurred and stated that TSA is currently establishing a business  process to ensure the relevant databases are complete.  According to  DHS, the WebEOC system will be adjusted to permit inputting of records  that are discovered through compliance activities. We will continue to  monitor the agency’s efforts to implement our recommendation.
DHS also concurred with our recommendation that TSA develop  guidance for TSOC officials that includes definitions of data entry options  to reduce errors resulting from data entry problems. DHS stated that the  TSOC had completed implementing this recommendation by updating the  guidance with respect to input options. However, the updated guidance  that TSA sent to us clarifies that incident logs in WebEOC need to  indicate that an incident was reported by phone. The guidance does not  provide definitions for data entry options, as we recommended, and we  therefore continue to believe that additional guidance is necessary for the  officials responsible for inputting the incident information into WebEOC.
In response to our recommendation that TSA establish a systematic  process for regularly conducting trend analysis of the rail security incident  data, in an effort to identify potential security trends, DHS concurred and  stated that TSA will develop a process to review suspicious activities and  incidents in the mass transit and passenger rail areas in order to identify  trends that might represent a threat to transportation. We will continue to  monitor the agency’s efforts to implement our recommendation.
We are sending copies of this report to the Secretaries of Homeland  Security and Transportation, the TSA Administrator, Amtrak, appropriate  congressional committees, and other interested parties. In addition, this  report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-4379 or lords@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are acknowledged in  appendix VI.
section_title: Appendix I: Influence of Foreign Attacks on Selected U.S. Rail Agencies’ Security Measures
paragraphs: Officials we met with from eight high-volume rail agencies generally  stated that foreign rail attacks (such as those described in appendix IV)  served as potent reminders of potential terror threats against rail, but they  did not lead the rail agencies to make significant changes in their security  measures. Nonetheless, agencies have used these incidents to inform  security enhancements. Specifically, these agencies reported making  changes to their security measures, in part as a result of lessons learned  from foreign attacks. These changes were related to:
Public awareness campaigns. These include publicity posters and  announcements over public address systems within rail stations that  alert passengers and rail agency employees to report suspicious  items or behaviors to police. For example, officials from one rail  agency we spoke with reported making changes to its public  awareness campaign following the attacks in Madrid and London.  These changes included instituting a regional transit security  awareness program, including periodic audio announcements  reminding passengers to be aware of potential threats, in coordination  with the Federal Transit Administration’s Transit Watch Program.  Other rail agencies reported that the attacks described in appendix IV  emphasized the importance of having informed riders that can act as  a “force multiplier” when it comes to noticing suspicious activity.
Armed mobile tactical teams. These are police teams similar to SWAT  teams that patrol rail systems or that are intended for rapid  deployment in the event of a terror attack or related incident. Officials  from one high-volume rail agency reported that the 2008 attack in  Mumbai led it to immediately increase training in responding to “active  shooter” scenarios by its existing mobile tactical teams. Officials from  other high-volume rail agencies we interviewed also reported that they  established mobile tactical teams or increased the training of their  existing patrols following the 2008 Mumbai attacks.
Motorized emergency response vehicles. These are small battery- operated vehicles intended to help first responders reach injured or  stranded passengers when they cannot be quickly reached by a  rescue train (if, for example, rails have been damaged by a terror  blast or electrical outage). Officials from one agency we interviewed  reported that it deployed these response vehicles directly in response  to lessons learned from the London attack, during which first  responders used such vehicles to rescue injured Underground rail  passengers.
Closed-circuit television (CCTV). CCTV refers to a visible or covert  video system intended for only a limited number of viewers. In CCTV,  the picture is viewed or recorded, but not broadcast. According to  officials from two high-volume rail agencies we interviewed, the July  2005 attacks in London demonstrated the utility of CCTV coverage for  forensic investigation. A United Kingdom government analysis  reported that the cameras helped police determine the identity of the  bombers. Officials from four high-volume rail agencies we interviewed  stated that while they increased the number of CCTV cameras in their  rail systems, this did not occur immediately following the London  attacks. Rather, the London attacks reinforced the importance of  CCTV camera coverage as a key security measure.
section_title: Appendix II: Selected Mechanisms Used to Gather Information on Lessons Learned from Passenger Rail Attacks and Share Rail Security Information
paragraphs: The Transportation Security Administration (TSA) and officials from eight  high-volume passenger rail agencies we interviewed identified several  different mechanisms they use to obtain and share passenger rail  security-related information, including information on lessons learned  from foreign rail attacks (such as those described in appendix IV) and  security measures implemented or considered by other U.S. rail  stakeholders. Many of these mechanisms have also been discussed in  our previous reports on information sharing and rail security issues. The  key mechanisms that officials from the eight high-volume rail agencies we  interviewed cited using to obtain and share passenger rail security-related  information are summarized in table 1.
section_title: Appendix III: Objectives, Scope, and Methodology
paragraphs: This report addresses the following questions:
To what extent has the Transportation Security Administration (TSA)  overseen and enforced the passenger rail security incident reporting  requirements?
To what extent has TSA analyzed passenger rail security incident  information to identify security trends and potential threats against  passenger rail systems?
Appendix I of this report also includes information on how selected rail  agencies applied lessons learned from foreign rail attacks to enhance  their rail security measures. Appendix II includes information on key  mechanisms rail agencies use to obtain rail security-related information.
To address these questions, we examined TSA’s rail security incident  reporting process. We focused on TSA’s regulation for rail security  incident reporting, which requires passenger rail agencies to report rail  security incidents to the Transportation Security Operations Center  (TSOC). We reviewed the notice of proposed rulemaking and final rule  that describe the purpose and justification of the incident reporting  requirement, as well as TSA policy documents, manuals, and guidance  concerning the rail security incident reporting process. We also  interviewed cognizant TSA officials at headquarters and in the field  regarding their roles in the incident reporting process. To obtain rail  industry perspectives on the rail security incident reporting process, we  conducted visits at, or teleconferences with, 19 of the top 50 passenger  rail systems across the nation, by passenger rail ridership. See table 2  for a list of passenger rail systems we interviewed. We selected these  passenger rail systems to reflect varied levels of ridership and geographic  dispersion. Because we selected a nonprobability sample of passenger  rail systems, the information obtained from these visits and interviews  cannot be generalized to all rail systems nationwide. However, we  determined that the selection of these rail systems was appropriate for  our design and objectives and that the selection would provide valid and  reliable evidence. The information we obtained provided illustrative  examples of the perspectives of various passenger rail stakeholders  about the rail security incident reporting process, and corroborated  information we gathered through other means. Further, we interviewed  rail industry representatives from the American Public Transportation  Association and the Association of American Railroads to obtain their  perspectives on rail security issues. We selected these associations  because they represent the majority of the passenger and freight rail  systems in the United States.
To assess the extent to which TSA has overseen and enforced the rail  security reporting requirement, we interviewed officials from the selected  rail systems discussed earlier on how they have implemented this  requirement, including the guidance they have received from TSA on the  types of incidents to report to the TSOC. We interviewed TSA headquarters  officials from the Compliance Programs Division within the Office of  Security Operations and local TSA officials from five field offices, including  transportation security inspectors-surface (TSI-S) and assistant federal  security directors-inspections (AFSD-I), regarding the guidance they  provide to rail agencies on incident reporting and how they ensure rail  agencies’ compliance with the regulation. We selected these five field office  locations because they had oversight responsibility for many of the rail  agencies included in our scope. We also interviewed one TSA regional  security inspector-surface (RSI-S) regarding his role in the rail security  incident reporting process. Because we selected a nonprobability sample  of TSA’s field offices and officials, the results from these interviews cannot  be generalized to all TSA field offices; however, the information we  obtained provided us with an overview of the role of TSA surface inspectors  in the rail incident reporting process and corroborated information we  obtained through other sources. We examined documentation on TSA’s  inspection processes for monitoring rail systems’ compliance with the  incident reporting requirement, including the Transportation Security  Inspector Inspections Handbook, the National Investigations and  Enforcement Manual, and the Compliance Work Plan for Transportation  Security Inspectors. We also reviewed a TSA operational directive related  to reporting aviation security incidents to TSA.
We chose January 2011 as the starting point for our analysis because it was 2 full years  after the regulation became effective, which would allow rail agencies and TSA a period of  adjustment. The regulation went into effect in December 2008. June 2012 was the end of  our data collection period.
WebEOC by conducting visits to the TSOC and interviewing TSOC  officials to discuss their role in incident reporting and the mechanisms in  place to ensure data quality. We also reviewed WebEOC documentation  to identify how passenger rail security incident data are collected and  managed, and how data quality is ensured. While we determined that the  information in WebEOC was sufficiently reliable for the purposes of  providing information on differences in the number and types of rail  security incidents reported by selected rail agencies to the TSOC, we  identified issues with data entry and data quality, which are discussed in  this report. In addition, we obtained data from TSA’s Performance and  Results Information System (PARIS) for January 2011 through June 2012  on TSA’s compliance inspections and all records related to enforcement  actions taken under the passenger rail security incident reporting  requirement. We analyzed the data to identify the content and frequency  of TSA inspections conducted and enforcement actions taken under the  incident reporting regulation. We ascertained the reliability of compliance  data derived from PARIS by interviewing TSA officials from the  Compliance Programs Division and reviewing documentation on controls  implemented to ensure the integrity of the data in PARIS, and found the  compliance data sufficiently reliable for our purposes. We also evaluated  TSA’s efforts to oversee and enforce the incident reporting requirement  against criteria in Standards for Internal Control in the Federal  Government.
To assess the extent to which TSA has analyzed rail security incident  information, we interviewed TSA officials from the TSOC, the Office of  Intelligence and Analysis, the Office of Security Operations, and the  Office of Security Policy and Industry Engagement regarding their roles  and responsibilities. We reviewed available documentation and analyses  that TSA prepared containing rail security incident information. We also  examined the WebEOC incident management database to identify any  limitations in the database that could present challenges for analyzing the  rail security incident data, and we discussed these limitations with  relevant TSA officials. We also interviewed officials from the rail agencies  noted earlier about their views on the information and analyses they  receive from TSA on rail security incidents.
We also obtained information on how selected rail agencies applied  lessons learned from foreign rail attacks to enhance their rail security  measures and how rail agencies obtain and share passenger rail security- related information, including information on lessons learned from foreign  rail attacks. To do this, we reviewed TSA documentation describing TSA’s  security strategy for the mass transit and passenger rail systems, such as  TSA’s Mass Transit and Passenger Rail Annex, and we discussed the rail  security actions outlined in the annex with TSA officials. In addition, we  reviewed rail security reports and interviewed an official from the Mineta  Transportation Institute (MTI). We met with MTI because the  organization’s database on attacks against surface transportation,  including passenger rail, was cited by TSA as the most comprehensive  and up-to-date of existing databases. On the basis of information we  obtained from MTI, and discussions with MTI and TSA officials, we found  the quality of the methods used to develop these reports sufficient for use  as a source in this report. We also interviewed security officials from  selected passenger rail systems regarding their key security measures.  During visits to passenger rail systems, we toured stations and other  facilities such as control centers, and observed security practices. We  also interviewed officials from other federal agencies including the Central  Intelligence Agency and the Department of Transportation’s Federal  Transit Administration and Federal Railroad Administration regarding their  roles in passenger rail security, and we interviewed government officials  involved with securing passenger rail in the United Kingdom. We also  reviewed our prior reports on passenger rail security and information  sharing as well as studies and reports conducted by outside organizations  related to passenger rail, such as the Department of Homeland Security  Office of the Inspector General.
section_title: Appendix IV: Summary of Recent Attacks against Foreign Passenger Rail Systems
paragraphs: According to the Mineta Transportation Institute (MTI), from September  12, 2001 through December 31, 2011, 838 attacks occurred worldwide  against passenger and commuter rail systems, resulting in 1,372  fatalities. Most of these attacks occurred in South Asia (Pakistan, India,  and Thailand) and Russia. For purposes of our review, we focused on  recent passenger rail attacks that occurred in the following locations:  Madrid, Spain; London, England; Mumbai, India; and Moscow, Russia. In  this section, we summarize the basic facts of these attacks, using reports  and information from the Department of Homeland Security (DHS), the  Transportation Security Administration (TSA), open source, MTI, and  others. Other attacks may have occurred at these locations, both before  and after those cited.
On March 11, 2004, 10 bombs exploded on three trains on Madrid’s  commuter rail system during the morning rush hour, killing 191 people  and wounding more than 1,500 others. The bombs were placed in  backpacks and detonated by cell phones. According to DHS’s report on  the attack, those responsible were from a terrorist group associated with  al-Qaeda. According to DHS, by the end of March 2004, authorities had  arrested 22 people in connection with the attack. The following month,  Madrid law enforcement located a safe house associated with the  suspected bombers. As authorities entered the apartment, the suspected  terrorists inside detonated explosives, killing themselves and a police  officer. Officers subsequently found backpacks filled with of explosives  and detonators in the wreckage.
On July 7, 2005, four suicide bombers detonated improvised explosive  devices during the London rush hour on three Underground (subway)  trains and on a double-decker bus, killing a total of 52 people and injuring  about 700. All four bombers were also killed in the attacks. The three  Underground attacks occurred within moments of one another and the  bus bombing occurred approximately 1 hour later. The bombers traveled  together from a commuter rail station north of London to the King’s Cross  Underground station, from which they departed to their respective attack  destinations. A second series of attacks was attempted 2 weeks later, on  July 21. However, the explosives failed to detonate. According to DHS, no  terrorist group has claimed responsibility. After a police investigation of  the attacks, three additional suspects were charged with conspiracy in the  identification and reconnaissance of potential terrorist targets in London.  However, all three were acquitted on those charges in April 2009.
On July 11, 2006, a series of seven explosions occurred on a single rail  line of Mumbai’s commuter railway. In all, 190 people were killed and 625  were injured across all the incidents. In September 2006, Indian police  said that the attacks were executed by Lashkar-e-Taiba.
Starting on November 26, 2008, and continuing for the next 2 days,  terrorists attacked various locations in the Mumbai area including a  passenger rail station and hotels catering to Western tourists. The  attackers used assault weapons, small arms, grenades, and explosives.  One of the first attacks occurred at the Chhatrapati Shivaji rail terminus,  one of the busiest train stations in the country. Two gunmen entered the  passenger hall and opened fire, killing 59 and injuring 104. The terrorists  then dispersed throughout the city attacking another eight locations,  killing at least an additional 129 and injuring more than 223 others.  According to DHS, like the attacks on July 11, 2006, the terrorists were  also from Lashkar-e-Taiba. Nine terrorists were killed during the course of  the attacks, while one was captured alive.
On March 29, 2010, two suicide bombers attacked trains at two stations  in the Moscow Metro during the morning rush hour, killing 40 and injuring  58 others. The first explosion occurred on a train as it pulled into  Lubyanka station. The second explosion occurred at the Park Kultury  station as passengers were boarding a train. Both the Lubyanka and Park  Kultury stations are transfer stations and may have been chosen by the  attackers in an effort to target the greatest number of people. Russian  officials attribute the attack to Chechen separatists.
section_title: Appendix V: Comments from the Department of Homeland Security
section_title: Appendix VI: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Stephen M. Lord, (202) 512-4379 or LordS@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Jessica Lucas-Judy (Assistant  Director), Eric Hauswirth, Adam Hoffman, Tracey King, Elizabeth  Kowalewski, Kelly Rubin, and Jonathan Tumin made key contributions to  this report.