Transportation Security: Key Actions Have Been Taken to Enhance Mass Transit and Passenger Rail Security, but Opportunities Exist to Strengthen Federal Strategy and Programs
Published: 2009-06-24T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Terrorist incidents worldwide have highlighted the need for securing mass transit and passenger rail systems. The Department of Homeland Security's (DHS) Transportation Security Administration (TSA) is the primary federal entity responsible for securing these systems. GAO was asked to assess (1) the extent to which federal and industry stakeholders have assessed risks to these systems since 2004, and how TSA has used this information to inform its security strategy; (2) key actions federal and industry stakeholders have taken since 2004 and the extent to which federal actions are consistent with TSA's security strategy, and the challenges TSA faces in implementing them; and (3) TSA's reported status in implementing 9/11 Commission Act provisions for mass transit and passenger rail security. GAO reviewed documents including TSA's mass transit and passenger rail strategic plan, and interviewed federal officials and industry stakeholders from 30 systems and Amtrak--representing 75 percent of U.S. mass transit and passenger rail ridership.
section_title: What GAO Found
paragraphs: Since 2004, federal and industry stakeholders have conducted assessments of individual elements of risk--threat, vulnerability and consequence--for mass transit and passenger rail systems and this information has informed TSA's security strategy; however, TSA has not combined information from these three elements to conduct a risk assessment of these transportation systems. By completing a risk assessment, TSA would have reasonable assurance that it is directing its resources toward the highest priority needs. Further, while TSA's mass transit and passenger rail security strategy contains some information, such as goals and objectives, that is consistent with GAO's prior work on characteristics of a successful national strategy, it could be strengthened by including performance measures to help TSA track progress in securing these systems, among other things. Federal and industry stakeholders have taken several key actions to strengthen the security of mass transit and passenger rail systems since 2004, and while federal actions have been generally consistent with TSA's security strategy, TSA faces coordination challenges, and opportunities exist to strengthen some programs. TSA has deployed surface inspectors to assess industry security programs and worked with DHS to develop security technologies, among other actions. Mass transit and passenger rail systems, including Amtrak, also reported taking actions to increase security, such as implementing passenger and baggage screening programs. Although TSA has taken steps to enhance its efforts, it can further strengthen security programs by, for example, expanding its efforts to obtain and share security technology information with industry. By improving information sharing with industry, TSA can help to ensure that its and industry's limited resources are used more productively to secure mass transit and passenger rail systems. As of March 2009, TSA reported implementing some of the 9/11 Commission Act provisions related to securing mass transit and passenger rail such as developing a strategy for securing transportation, but had missed deadlines, for example, for issuing new regulatory requirements for mass-transit and passenger-rail employee security training. In addition, TSA's progress reports that track its implementation of 9/11 Act provisions lack milestones to guide this effort as called for by project management best practices. Additionally, in some cases, TSA progress reports identify challenges to meeting 9/11 Act provisions, but these reports do not include a plan for addressing these challenges. Until TSA develops a plan with milestones, it will be difficult for TSA to provide reasonable assurance that the act's provisions are being implemented and that a plan is in place for overcoming challenges that arise. Additionally, officials from almost half of the mass transit and passenger rail systems GAO visited reported concerns with the potential costs and the feasibility of implementing pending employee security training requirements.

section_title: Letter
paragraphs: Mass transit and passenger rail systems are vital components of the  nation’s transportation infrastructure, encompassing rail transit (heavy  rail, commuter rail, and light rail), intercity rail, and transit bus systems.   In the United States, mass transit and passenger rail systems provide  approximately 34 million passenger trips each weekday, and commuters  rely on these systems to provide efficient, reliable and safe  transportation. However, terrorist attacks on mass transit and passeng er  rail systems around the world—such as the 2006 passenger train bombing  ty  in Mumbai, India that resulted in 209 fatalities—highlight the vulnerabili m  of these systems and the need for an increased focus on securing the from terrorism. While there have been no terrorist attacks against U.S.  mass transit and passenger rail systems to date, the systems are vulnerab to attack in part because they rely on an open architecture that is difficult  to monitor and secure due to its multiple access points, hubs serving  multiple carriers, and, in some cases, no barriers to access. Further, an  le  attack on these systems could potentially lead to significant casualties d to the high number of daily transit passengers, especially during peak  commuting hours.
While several entities play a role in helping to fund and secure U.S. mass  transit and passenger rail systems, the Department of Homeland Security’s  (DHS) Transportation Security Administration (TSA) is the primary  federal agency responsible for overseeing security for these systems and  for developing a national strategy and implementing programs to enhance  their security. Additionally, several DHS components––with assistance  from the Department of Transportation’s (DOT) Federal Transit  Administration (FTA) and Federal Railroad Administration (FRA)––are to  conduct threat and vulnerability assessments of mass transit and  passenger rail systems, research and develop security technologies for  these systems, and develop security training programs for mass transit and  passenger rail employees. Day-to-day responsibility for securing mass  transit and passenger rail systems falls on mass transit and passenger rail  agencies themselves, local law enforcement, and often state and local  governments that own a significant portion of the infrastructure. The  partnership of federal and non-federal mass transit and passenger rail  stakeholders was strengthened following the terrorist attacks of  September 11th, in part, by collaborating to implement a variety of security  programs. In addition, the passage of the Implementing Recommendations  of the 9/11 Commission Act (9/11 Commission Act) in August 2007 requires  DHS to further expand its roles and responsibilities for securing mass  transit and passenger rail in several areas, such as by conducting and  updating security assessments and issuing new regulations that will  establish new security requirements for mass transit and passenger rail  agencies to implement.
You requested that we evaluate TSA’s mass transit and passenger rail  security strategy and supporting programs and activities, as well as TSA’s  efforts to assess the impact of these initiatives on U.S. mass transit and  passenger rail systems since TSA’s issuance of passenger rail security  directives in 2004. Specifically, this report addresses the following  questions:     To what extent have federal and industry stakeholders assessed or  supported assessments of the security risks to mass transit and  passenger rail since 2004, and how, if at all, has TSA used risk  assessment information to inform and update its security strategy?
What key actions, if any, have federal and industry stakeholders  implemented or initiated, since 2004, to strengthen the security of  mass transit and passenger rail systems; to what extent are federal  actions consistent with TSA’s security strategy; and what challenges, if  any, does TSA face in implementing them?
What is TSA’s reported status in implementing provisions of the  Implementing Recommendations of the 9/11 Commission Act of 2007  related to mass transit and passenger rail security, and what  challenges, if any, does TSA and mass transit and passenger rail  industry face in implementing the actions required by the act?
To determine the extent to which federal and industry stakeholders  assessed security risks to mass transit and passenger rail systems since  2004, we analyzed various assessment reports from DHS component  agencies, including TSA, DHS’s Office of Infrastructure Protection within  the National Protection and Programs Directorate (NPPD), and the  Homeland Infrastructure Threat Reporting and Analysis Center (HITRAC),  as well as FTA and stakeholders outside of the federal government.  Because of the scope of our work, we relied on TSA to identify its  assessment activities but did not assess the extent to which its assessment  activities meet the National Infrastructure Protection Plan (NIPP) criteria  for threat, vulnerability, and consequence assessments. In addition, we  analyzed TSA’s security strategy for the mass transit and passenger rail  systems—the Mass Transit Modal Annex—to determine the extent to  which it addressed the threats, vulnerabilities, and consequences  identified in the assessments we reviewed. We also analyzed requirements  pertaining to mass transit and passenger rail security assessments and  strategy including Executive Order 13416: Strengthening Surface  Transportation Security, to determine the extent to which TSA’s security  strategy conformed to requirements. We analyzed executive guidance  including the NIPP and the Transportation Systems-Sector Specific Plan  (TS-SSP) to determine the best practices for effectively implementing a  risk management framework and associated best practices for conducting  risk assessments. We also reviewed guidance on strategic planning that  GAO developed in a previous report.
To determine key actions federal and industry stakeholders have initiated  or implemented since 2004 to strengthen mass transit and passenger rail  security, we analyzed documentation on DHS and DOT mass transit and  passenger rail security programs, including the Mass Transit Modal Annex,  after action reports of TSA security operations, and security technology  information on DHS’s Homeland Security Information Network (HSIN)  Public Transit Portal. We also interviewed federal stakeholders, including  DHS representatives from TSA, the DHS Science and Technology  Directorate (DHS S&T), and HITRAC, and DOT representatives from FTA  and FRA. Additionally, we analyzed federal actions against the objectives  outlined in TSA’s security strategy—the Mass Transit Modal Annex—to  determine whether these actions were consistent with the strategy. To  identify implementation challenges with these actions, we interviewed  federal and transit agency stakeholders involved in either developing or  participating in these programs. We conducted site visits, or held  teleconferences with, security and management officials from 30 mass  transit and passenger rail agencies across the nation. Additionally, we met  with officials from two regional transit authorities and Amtrak officials  responsible for overall systems security as well as individual station  security personnel. The entities we interviewed represent 75 percent of the  nation’s total mass transit and passenger rail ridership based on  information we obtained from the Federal Transit Administration’s  National Transit Database and the American Public Transportation  Association. Because we selected a non-probability sample of mass transit  and passenger rail agencies, the results from these visits and  teleconferences cannot be generalized to all mass transit and passenger  rail agencies; however, information we obtained provided us with an  broad overview of the types of key actions taken to strengthen security.
To determine TSA’s reported status in implementing mass transit and  passenger rail provisions of the 9/11 Commission Act and challenges TSA  and industry stakeholders may face in implementing actions required by  the act, we analyzed TSA documentation outlining the agency’s status in  fulfilling various requirements and documentation on TSA’s Surface  Transportation Security Inspection Program. We also interviewed officials  from TSA’s Surface Transportation Security Inspection Program, including  headquarters officials, and inspectors from 13 of 54 field office locations,  including 11 of 12 Assistant Federal Security Directors for Surface  (supervisors for primary field offices) regarding how the 9/11 Commission  Act requirements may affect their job responsibilities.  We interviewed  officials from all inspection program field locations that have oversight  responsibility for the mass transit and passenger rail agencies we  interviewed. Because we selected a non-probability sample of TSA’s  Surface Transportation Security Inspection Program field offices, the  results from these interviews cannot be generalized to all Surface  Transportation Security Inspection Program field offices; however,  information we obtained provided us with an overview of the potential  impact of the 9/11 Commission Act on field operations.
We conducted this performance audit from September 2007 through June  2009 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Overview of U.S. Mass Transit and Passenger Rail Systems
paragraphs: Mass transit and passenger rail systems provided 10.7 billion passenger  trips in the United States in fiscal year 2008. The nation’s mass transit and  passenger rail systems include all multiple-occupancy vehicle services  designed to transport customers on local and regional routes, such as  transit buses, heavy rail, commuter rail, and light rail services, and the  interconnected facilities and vehicles feeding into the transit systems.  Buses are the most widely used form of transit, providing almost two- thirds of all passenger trips. Heavy rail systems––subway systems like  New York City’s transit system and Washington, D.C.’s Metro—typically  operate on fixed rail lines within a metropolitan area and have the  capacity for a heavy volume of traffic. Commuter rail systems typically  operate on railroad tracks and provide regional service (e.g., between a  central city and adjacent suburbs). Light rail systems are typically  characterized by lightweight passenger rail cars that operate on track that  is not separated from vehicular traffic for much of the way. Mass transit  and passenger rail systems in the United States are typically owned and  operated by public sector entities, such as state and regional  transportation authorities.
Amtrak, which reported that it provided 25.8 million passenger trips in  fiscal year 2007, operates the nation’s primary intercity passenger rail and  serves more than 500 stations in 46 states and the District of Columbia.  Amtrak operates over a 22,000 mile network, primarily over leased freight  railroad tracks. In addition to leased tracks, Amtrak owns about 650 miles  of track, primarily on the “Northeast Corridor” between Boston and  Washington, D.C., which carries about two-thirds of Amtrak’s total  ridership. Stations are owned by Amtrak, freight carriers, municipalities,  and some private entities. Amtrak also operates commuter rail services in  certain jurisdictions on behalf of state and regional transportation  authorities.  Figure 1 identifies the geographic distribution of rail transit  systems and Amtrak within the United States. Though not indicated on the  map, all of these cities also have bus transit systems.
section_title: Mass Transit and Passenger Rail Systems Are Inherently Vulnerable to Terrorist Attacks
paragraphs: To date, U.S. mass transit and passenger rail systems have not been  attacked by terrorists. However, these systems have received heightened  attention as several alleged terrorists’ plots have been uncovered,  including multiple plots involving systems in the New York City area.  Worldwide, mass transit and passenger rail systems have been the  frequent target of terrorist attacks. According to the Worldwide Incidents  Tracking System maintained by the National Counter-Terrorism Center,  from January 2004 to July 2008, there were 530 terrorist attacks worldwide  against mass transit and passenger rail targets, resulting in over 2,000  deaths and over 9,000 injuries. Terrorist attacks include a 2007 attack on a  passenger train in India (68 fatalities and over 13 injuries); the 2005 attack  on London’s underground rail and bus systems (52 fatalities and over 700  injuries); and the 2004 attack on commuter rail trains in Madrid (191  fatalities and over 1,800 injuries). In January 2008, Spanish authorities  arrested 14 suspected terrorists who were allegedly connected to a plot to  conduct terrorist attacks in Spain, Portugal, Germany, and the United  Kingdom, including an attack on the Barcelona metro subway system. The  most common means of attack against mass transit and passenger rail  systems has been improvised explosive devices (IED), with many of these  attacks delivered by suicide bombers.
According to transit agency officials, certain characteristics of mass transit  and passenger rail systems make them inherently vulnerable to terrorist  attacks and therefore difficult to secure. By design, mass transit and  passenger rail systems are open (i.e., have multiple access points, hubs  serving multiple carriers, and, in some cases, no barriers to access) so that  they can move large numbers of people quickly. The openness of these  systems can leave them vulnerable because operator personnel cannot  completely monitor or control who enters or leaves the systems. In  addition, other characteristics of mass transit and passenger rail  systems—high ridership, expensive infrastructure (more so for passenger  rail than bus), economic importance, and location in large metropolitan  areas or tourist destinations––also make them attractive targets for  terrorists because of the potential for mass casualties, economic damage  and disruption. Moreover, some of these same characteristics make them  difficult to secure. For example, the number of riders passing through a  subway system––especially during peak hours—may make the sustained  use of some security measures, such as airport style passenger screening  checkpoints, difficult because the measures could disrupt scheduled  service. In addition, multiple access points along extended routes may  make securing each location difficult because of the costs associated with  such actions. Balancing the potential economic impacts of security  enhancements with the benefits of such measures is a difficult challenge.
section_title: Multiple Stakeholders Share Responsibility for Securing Mass Transit and Passenger Rail Systems
paragraphs: Securing the nation’s mass transit and passenger rail systems is a shared  responsibility requiring coordinated action on the part of federal, state,  and local governments; the private sector; and passengers who ride these  systems. Since the September 11, 2001 attacks, the role of federal agencies  in securing the nation’s transportation systems has continued to evolve. In  response to the September 11th  terrorist attacks, Congress passed the  Aviation and Transportation Security Act of 2001, which created TSA  within DOT and conferred to the agency broad responsibility for  overseeing the security of all modes of transportation, including mass  transit and passenger rail. In 2002, Congress passed the Homeland  Security Act, which established DHS, transferred TSA from DOT to DHS,  and assigned DHS responsibility for protecting the nation from terrorism,  including securing the nation’s transportation systems.  Within TSA, the  office of Transportation Sector Network Management (TSNM) leads the  unified effort to protect and secure the nation’s intermodal transportation  systems, with divisions dedicated to each transportation mode, including  mass transit and passenger rail. Within TSA’s Office of Security  Operations, the Office of Multi-modal Oversight manages the Surface  Transportation Security Inspection Program which coordinates with  TSNM to develop and implement security programs, including strategies  for conducting and implementing assessments and other actions in mass  transit and passenger rail. In addition, TSA’s Office of Intelligence (TSA- OI) is responsible for collecting and analyzing threat information related  to the transportation network, which includes all modes of transportation.  TSA is supported in these efforts by other DHS entities such as the NPPD  and the Federal Emergency Management Agency’s (FEMA) Grant  Programs Directorate and Planning and Assistance Branch. The NPPD is  responsible for coordinating efforts to protect the nation’s most critical  assets across all 18 industry sectors, including surface transportation.
FEMA’s Grant Programs Directorate is responsible for managing DHS  grants for mass transit.  FEMA’s Planning and Assistance Branch is  responsible for assisting transit agencies with how to conduct risk  assessments.
TSA has issued requirements related to the security of mass transit and  passenger rail systems. Specifically, in May 2004, TSA issued security  directives that mandated passenger rail agencies and Amtrak to implement  certain security measures, such as periodically inspecting passenger rail  cars for suspicious or unattended items and reporting potential threats or  significant security concerns to appropriate law enforcement authorities  and TSA.  In addition to these requirements, in August 2007, the 9/11  Commission Act was signed into law, which included provisions that task  TSA with security actions related to mass transit and passenger rail  security. Among other things, these provisions include mandates for  developing and issuing reports on TSA’s strategy for securing public  transportation, conducting and updating security assessments of mass  transit systems, and establishing a program for conducting security  exercises for transit and rail agencies.
While TSA is the lead federal agency for overseeing the security of all  transportation modes, DOT continues to play a key supporting role in  securing mass transit and passenger rail systems. In a 2004 memorandum  of understanding (MOU) and a 2005 annex to the MOU, TSA and FTA  agreed that the two agencies would coordinate their programs and  services, with FTA playing a supporting role by providing technical  assistance and assisting DHS with implementation of its security policies,  including collaborating in developing regulations affecting transportation  security. In particular, FTA has played a role in coordinating and funding  security training programs for mass transit and passenger rail employees,  and provided dedicated funding to three federal training providers to  implement mass transit and passenger rail employee training programs.  Additionally, FTA administers the State Safety Oversight program and may  withhold federal funding for states’ noncompliance with regulations  governing state safety oversight agencies. As part of this program, state  safety oversight agencies are responsible for reviewing and approving rail  transit agencies’ safety and security plans, among other activities. FTA  also promotes mass transit and passenger rail safety and security by  providing funding for research, technical assistance, and technology  demonstration projects. In addition to FTA, DOT’s FRA also has regulatory  authority over commuter rail operators and Amtrak and employs over 400  inspectors who periodically monitor the implementation of safety and  security plans at these systems. FRA regulations require railroads that  operate intercity or commuter passenger train service or that host the  operation of that service to adopt and comply with a written emergency  preparedness plan approved by FRA.
State and local governments, mass transit and passenger rail operators,  and private industry are also important stakeholders in the nation’s mass  transit and passenger rail security efforts. State and local governments, in  some cases, own or operate a significant portion of mass transit and  passenger rail systems. Consequently, the responsibility for responding to  emergencies involving systems that run through their jurisdictions often  falls to state and local governments. Although all levels of government are  involved in mass transit and passenger rail security, the primary  responsibility for securing the systems rests with the mass transit and  passenger rail operators. These operators, which can be public or private  entities, are responsible for administering and managing transit activities  and services, including security. They can also directly operate the  security service provided or contract for all or part of the total service. We  discuss security actions taken by federal agencies and mass transit and  passenger rail system operators later in this report.
section_title: A Risk-Based Approach to Mass Transit and Passenger Rail Security
paragraphs: In recent years, we, along with the Congress, the executive branch, and  the 9/11 Commission have recommended that federal agencies with  homeland security responsibilities utilize a risk management approach to  help ensure that finite national resources are dedicated to assets or  activities considered to have the highest security priority. We have  concluded that without a risk management approach, there is limited  assurance that programs designed to combat terrorism would be properly  prioritized and focused. Thus, risk management, as applied in the  homeland security context, can help to more effectively and efficiently  prepare defenses against acts of terrorism and other threats.
Homeland Security Presidential Directive 7 (HSPD-7) directed the  Secretary of Homeland Security to establish uniform policies, approaches,  guidelines, and methodologies for integrating federal infrastructure  protection and risk management activities. Recognizing that each sector  possesses its own unique characteristics and risk landscape, HSPD-7  designates federal government sector specific agencies (SSA) for each of  the critical infrastructure sectors that are to work with DHS to improve  critical infrastructure security. On June 30, 2006, DHS released the  National Infrastructure Protection Plan (NIPP), which created—in  accordance with HSPD-7—a risk-based framework for the development of  SSA strategic plans. As the SSA for transportation, TSA developed the  Transportation Systems—Sector Specific Plan (TS-SSP) in 2007 to  document the process to be used in carrying out the national strategic  priorities outlined in the NIPP and the National Strategy for  Transportation Security (NSTS). The TS-SSP contains supporting modal  implementation plans for each transportation mode, including mass transit  and passenger rail, which provides information on current efforts to  secure mass transit and passenger rail, as well as TSA’s overall goals and  objectives related to mass transit and passenger rail security.
The NIPP defines roles and responsibilities for security partners in  carrying out critical infrastructure and key resource (CI/KR) protection  activities through the application of risk management principles. Figure 2  illustrates the several interrelated activities of the risk management  framework as defined by the NIPP. The NIPP requires that federal  agencies use this information to inform the selection of risk-based  priorities and the continuous improvement of security strategies and  programs to protect people and critical infrastructure by reducing the risk  of acts of terrorism.
Within the risk management framework, the NIPP also establishes  baseline criteria for conducting risk assessments. According to the NIPP,  risk assessments are a qualitative and/or quantitative determination of the  likelihood of an adverse event occurring and are a critical element of the  NIPP risk management framework. Risk assessments can also help  decision makers identify and evaluate potential risks so that  countermeasures can be designed and implemented to prevent or mitigate  the potential effects of the risks.
The NIPP characterizes risk assessment as a function of three elements:    Threat: The likelihood that a particular asset, system, or network will  suffer an attack or an incident. In the context of risk associated with a  terrorist attack, the estimate of threat is based on the analysis of the  intent and the capability of an adversary; in the context of a natural  disaster or accident, the likelihood is based on the probability of  occurrence.
Vulnerability: The likelihood that a characteristic of, or flaw in, an  asset, system, or network’s design, location, security posture, process,  or operation renders it susceptible to destruction, incapacitation, or  exploitation by terrorist or other intentional acts, mechanical failures,  and natural hazards.
Consequence: The negative effects on public health and safety, the  economy, public confidence in institutions, and the functioning of  government, both direct and indirect, that can be expected if an asset,  system, or network is damaged, destroyed, or disrupted by a terrorist  attack, natural disaster, or other incident.
Information from the three elements that assess risk—threat, vulnerability  and consequence—can lead to a risk characterization and provide input  for prioritizing security goals.
section_title: Federal and Industry Stakeholders Have Assessed Individual Elements of Risk, Which Have Informed TSA’s Security Strategy, but TSA Could Strengthen Its Approach by Conducting a Risk Assessment and Updating Its Security Strategy
paragraphs: Since 2004, federal and industry stakeholders have conducted assessments  of individual elements of risk—threat, vulnerability and consequence— and this information has informed TSA’s mass transit and passenger rail  security strategy. However, TSA could strengthen its approach by using  and combining this information to conduct a risk assessment of the mass  transit and passenger rail system and by updating its strategy to include  characteristics that we identified as desirable practices for successful  national strategies and to more fully address elements that are outlined in  Executive Order 13416: Strengthening Surface Transportation Security.
subsections: section_title: Federal and Industry Stakeholders Have Conducted Assessments of Individual Elements of Risk, but TSA Could Strengthen Its Approach by Conducting a Risk Assessment
paragraphs: While federal and industry stakeholders have conducted assessments of  individual elements of risk—threat, vulnerability, and consequence—TSA  could strengthen its security approach by using and combining this  information to conduct a risk assessment of the mass transit and  passenger rail system.  A risk assessment, as required by the NIPP,  involves assessing each of the three elements of risk and then combining  them together into a single analysis. Since 2004, federal agencies have  conducted a range of assessment activities related to the individual  elements of risk to help determine their strategy for securing mass transit  and passenger rail systems, and provided guidance to mass transit and  passenger rail agencies on how to conduct assessments of individual  elements of risk.  For example, DHS’s threat assessments considered  potential threats to the mass transit and passenger rail system, while  vulnerability assessments focused on mass transit and passenger rail  systems’ security conditions or specific infrastructure such as tunnels.  In  addition to DHS assessments, DOT provided assistance to mass transit and  passenger rail agencies on how to conduct threat and vulnerability  assessments, and transit agencies have reported conducting risk  assessments for their own systems or assets. See table 1 for a summary of  federal and industry stakeholders’ assessment activities related to  individual elements of risk.
As table 1 shows, DHS developed the Strategic Homeland Infrastructure  Risk Assessment (SHIRA) that assessed risk across 18 CI/KR sectors.  To  develop SHIRA, DHS collaborated with members of the intelligence  community to determine threats against various systems and assets in the  18 CI/KR sectors. TSA then assessed the vulnerabilities and consequences  that resulted from these threat scenarios and provided this information to  HITRAC.  Although TSA contributed to DHS’s risk assessment effort, it has  not conducted its own risk assessment of mass transit and passenger rail  systems.   TSA officials explained that the threat scenarios that SHIRA  provided were general and not specific to mass transit and passenger rail.   TSA could, however, use the information it provided for SHIRA to support  a risk assessment.
Table 1 also shows that mass transit and passenger rail agencies, including  Amtrak, have reported conducting risk assessments of their own systems.   Officials from 26 of 30 of the transit systems we visited stated that they  had conducted their own assessments of their systems, including risk  assessments.  For example, one transit agency official stated that the  agency had conducted risk assessments of its stations since 2003 and had  updated them every 2 years.  The official explained that his agency uses  the risk assessment results to conduct cost benefit analyses that the  agency uses before instituting new programs or purchasing equipment for  its system.  He also said that the assessments help the agency track risk  reduction as a result of its security investments.  Additionally, Amtrak  officials stated that they conducted a risk assessment of all of their  systems. As part of the assessment, Amtrak contracted with a private  consulting firm to provide a scientific basis for identifying critical points at  stations that might be vulnerable to IED attacks or that are structurally  weak.  Amtrak officials also stated that they gather and analyze threat  information obtained from various classified and unclassified sources  such as DHS, TSA, and the Federal Bureau of Investigation’s Joint  Terrorism Task Force. Transit agencies have also received assistance in  the form of either guidance or actual risk assessments from several federal  and industry stakeholders.  Table 2 identifies the various assistance  programs available to transit agencies for risk assessment efforts.
As table 2 shows, federal and industry stakeholders also provided  assistance to transit agencies on how to assess risk.  For example, FTA  provided on-site technical assistance to the nation’s 50 largest transit  agencies (i.e., those transit agencies with the highest ridership) on how to  conduct threat and vulnerability assessments, among other technical  assistance needs, through its Security and Emergency Management  Technical Assistance Program (SEMTAP).  According to FTA officials,  although FTA continues providing technical assistance to transit agencies,  the on-site SEMTAP program concluded in July 2006.  Furthermore, FTA  officials stated that on-site technical assistance was transferred to TSA  when TSA became the lead agency on security matters for mass transit  and passenger rail.  Also, from 2004 though 2007, the former DHS Office of  Domestic Preparedness (ODP), through a private consulting firm, provided  assistance to transit agencies on how to conduct risk assessments through  the Mass Transit Technical Assistance Program. Within this program, ODP  developed a Transit Risk Assessment Methodology (TRAM) tool kit that  provided transit agencies with an instrument to compare relative risks of  terrorism against critical assets to better identify and prioritize security  enhancements to reduce those risks. We reported in 2005 that officials  from transit agencies participating in the Mass Transit Technical  Assistance Program valued it and stated that the program was successful  in helping them to devise risk-reduction strategies to guide security-related  investments.  Subsequently, since the restructuring of ODP in 2007, this  program has been transferred to FEMA’s Planning and Assistance Branch  where it has continued assisting transit agencies with risk assessments.   However, according to FEMA’s Chief of the Planning and Assistance  Branch, because of the high cost of the program—$300,000 to $600,000 per  transit agency—the rate of assistance to transit agencies has decreased  annually.  Also, FEMA is trying to convert the focus of the program from  technical assistance to training.  As such, FEMA plans to educate transit  agencies on how to conduct risk assessments.  Additionally, the same  FEMA official reported that FEMA is also in the process of conducting a  pilot project with one transit agency to evolve the program and the tool kit  to an all hazards focus.  Furthermore, recognizing the value of this  program, officials from four of the 30 transit agencies we interviewed have  since contracted with the same private consulting firm that ODP and  FEMA used to update security plans or conduct a cost-benefit analysis of  new programs or equipment.
subsections: section_title: Multiple Potential Threats to Mass Transit and Passenger Rail Have Been Identified
paragraphs: TSA has reported conducting annual threat assessments of the mass  transit and passenger rail systems, and these assessments have provided  TSA with an array of information about potential threats to the systems.  TSA is responsible for conducting and issuing an annual threat assessment  report for the mass transit and passenger rail systems.  While it has been  widely reported that no specific threats to the mass transit and passenger  rail systems currently exist, it has been noted that terrorists tend to target  these systems, as overseas attacks on mass transit and passenger rail  systems have demonstrated. TSA’s Mass Transit Modal Annex identified  numerous potential threats to mass transit, including placing a vehicle  bomb near a station or track or introducing an IED or lower-yield  explosive in a station, train, or bus, or laying explosives on a track.  Deploying conventional or improvised explosives would likely result in  scores of casualties. Since IEDs were used in the majority of the recent  overseas attacks against mass transit and passenger rail systems, TSA and  other experts are concerned that extremists may be motivated to employ  similar tactics to target mass transit and passenger rail systems.  In its  Modal Annex, TSA also noted that the threat to heavy and commuter rail  (i.e., underground, subway, elevated, rapid rail, or metro) is higher than  the threat to buses and light rail (i.e., street cars, trolley) because of the  accessibility of the large numbers of people typically found in the confined  spaces of a rail system.
section_title: DHS Components, Including TSA, Conducted Several Vulnerability and Consequence Assessments That Identified Areas for Security Improvements
paragraphs: Several DHS components, including TSA, conducted assessments related  to vulnerability and consequence since 2004, which have highlighted areas  for security improvement.  For example, DHS S&T conducted vulnerability  assessments of transit tunnels as well as assessments of the potential  consequences that various types of explosives threats would have on  tunnel structures (which showed that improving evacuation plans and  emergency response efforts, among other things, would improve public  safety). Additionally, TSA has gathered vulnerability data through such  programs as the Baseline Assessment for Security Enhancement (BASE).   TSA officials reported that the BASE assesses the security posture of a  mass transit or passenger rail system against the Security and Emergency  Management Action Items and is TSA’s primary source of vulnerability  information. For example, through initial assessments of the BASE  program, TSA officials identified the need for increased security training at  mass transit and passenger rail systems. Furthermore, FEMA has  calculated consequence information for mass transit and passenger rail by  using proxy data, such as population and national infrastructure indices.   This information has been incorporated into the Transit Security Grant  Program (TSGP). TSA officials also reported using population density  and ridership data as information for consequence assessments for mass  transit and passenger rail systems and stated that they consider the  number of potential casualties when determining consequence, and as a  result, have chosen to focus their security efforts on the mass transit and  passenger rail systems carrying the most passengers. Officials also  mentioned that other factors such as the nature of the infrastructure  (underground, underwater tunnels), time of day, and number of mass  transit and passenger rail lines are also considered when assessing  consequence.
section_title: TSA Reported Using Existing Assessments to Inform Its Security Strategy, but Its Approach Could Be Strengthened by Conducting a Risk Assessment
paragraphs: TSA has used these various threat, vulnerability, and consequence  assessments to inform its security strategy for mass transit and passenger  rail—the Mass Transit Modal Annex. TSA reported that its efforts to  inform its strategy included using information from TSA-OI’s annual mass  transit threat assessment report to, for example, highlight the greater  threats to underground and underwater passenger rail segments within a  transit system. TSA also reported incorporating into its strategy  information identified through its BASE reviews, such as the need for  increased security training at mass transit and passenger rail systems.
While TSA reported using these various assessments to inform its mass  transit and passenger rail security strategy, it could further strengthen its  approach for securing these systems by combining the results from these  assessments to conduct a risk assessment of the mass transit and  passenger rail systems.  Both the NIPP and TS-SSP establish a risk  management framework that includes a process for considering threat,  vulnerability, and consequence assessments together to determine the  likelihood of a terrorist attack and the severity of its impact.  The NIPP  states that after the three elements of risk have been assessed, they are  factored numerically and combined mathematically to provide an estimate  of the expected loss considering the likelihood of an attack or other  incident.  It also states that when numerical values are not practical, scales  could be used to estimate threat, vulnerability, and consequence.  Thus,  risk can be measured either quantitatively (i.e., numerically) or  qualitatively (i.e., descriptively). However, rather than using the  methodology established in the NIPP for assessing risk, TSA officials  stated that the agency uses an intelligence-driven approach to make  strategic investment decisions across the transportation system. Within  this intelligence-driven approach for the sector, TSA also developed a  tactical, threat-based process known as Objectively Measured Risk  Reduction (OMRR) at the program level to help each of its individual  divisions manage their day-to-day security operations. These approaches  differ from the NIPP in part because they rely primarily on intelligence  information to identify threats, prioritize tactics, and guide long-term  investments, rather than systematically assessing the vulnerabilities and  consequences of a range of threat scenarios.
In March 2009, we recommended that TSA work with DHS to validate its  risk management approach by establishing a plan and time frame for  assessing the appropriateness of TSA’s intelligence-driven risk  management approach for managing risk and document the results of this  review once completed.  TSA concurred with this recommendation.  TSA  officials stated that they plan to revise and reissue the TS-SSP, as required  by DHS, to reflect the adoption of their intelligence-driven methodology.  As on June 2009, TSA reported that the update of the TS-SSP is ongoing,  with the goal of completing the effort in 2009. Until TSA works with DHS  to validate its risk management approach, TSA lacks assurance that its  approach provides the agency and DHS with the information needed to  guide investment decisions to ensure resources are allocated to the  highest risks.
Moreover, as we reported in March 2009, although intelligence is  necessary to inform threat assessments, it does not provide all of the  information needed to assess risk, in particular information related to  vulnerability and consequence assessments. In addition, the intelligence- driven approach that TSA uses may be limited because, in contrast with  practices adopted by the intelligence community, TSA officials do not plan  to assign uncertainty or confidence levels to the intelligence information it  uses to identify threats and guide long-range planning and strategic  investment. Both Congress and the administration have recognized the  uncertainty inherent in intelligence analysis and have required analytic  products within the intelligence community to properly caveat and  express uncertainties or confidence in analytic judgments. Furthermore,  while intelligence can and does help the U.S. security community on an  operational or tactical level, uncertainty in intelligence analysis limits its  utility for long-range planning and strategic investment. Without  expressing confidence levels in its analytic judgments, it will be difficult  for TSA to correctly prioritize its tactics and long-term investments based  on uncertain intelligence. In March 2009, we recommended that the  Assistant Secretary of TSA work with the Director of National Intelligence  to determine the best approach for assigning uncertainty or confidence  levels to analytic intelligence products and apply this approach to  intelligence products.
TSA officials agreed that they do not have a risk assessment and expressed  the desire to conduct one; however, they reported that a lack of resources  and other factors made completing a risk assessment challenging. For  example, TSA officials stated that comprehensive vulnerability and  consequence assessments are cost-prohibitive and time-intensive to  conduct.  Specifically, according to TSA officials, the Security Analysis and  Action Program conducted by surface inspectors, a program that  identifies, among other things, transit agencies’ vulnerabilities can take  days to complete resulting in a large resource investment. However, the  9/11 Commission Act requires TSA to use existing relevant assessments  developed by federal and industry stakeholders, as appropriate, to develop  a risk assessment for rail, including passenger rail.  Furthermore, as  suggested by the NIPP, agencies should consider existing risk measures  when assessing risk. In addition to using the information for SHIRA, TSA  could use other risk assessments, such as industry stakeholders’ risk  assessments and federal and industry stakeholders’ guidance on how to  conduct risk assessments, to potentially support a risk assessment of the  mass transit and passenger rail systems.
Despite the challenges that TSA officials reported, it is important to note  that risk assessment is an accepted and required practice with a long  history of use in a wide variety of public and private sector organizations.  Completing a risk assessment would provide TSA greater assurance that it  is directing its resources toward mitigating the highest priority risks.   Moreover, other agencies conduct risk assessments based on threat,  vulnerability, and consequences and have overcome the challenges TSA  cited. For instance, within DHS, the U.S. Coast Guard, and FEMA use risk  assessment methodologies to inform resource allocation.
The U.S. Coast Guard, which is responsible for securing the maritime  transportation mode, conducts risk assessments using its Maritime  Security Risk Analysis Model (MSRAM). Coast Guard units use the  Maritime Security Risk Analysis Model to assess the risk of terrorist  attack based on scenarios—a combination of target and attack mode— in terms of threats, vulnerabilities, and consequences to more than  18,000 targets. The model combines these assessments and provides  analysis to identify security priorities and support risk management  decisions at the strategic, operational, and tactical levels. The tool’s  underlying methodology is designed to capture the security risks  facing different types of targets spanning every DHS CI/KR industry  sector, allowing comparison between different targets and geographic  areas at the local, regional, and national levels. In conducting  assessments, the Coast Guard Intelligence Coordination Center  quantifies threat as a function of intent (the likelihood of terrorists  seeking to attack), capability (the likelihood of terrorists having the  resources to attack), and presence (the likelihood of terrorists having  the personnel to attack). Intelligence Coordination Center officials  stated that the Coast Guard uses MSRAM to inform allocation  decisions, such as the local deployment of resources and grants.
In June 2008, we reported that FEMA used a reasonable risk  assessment methodology—based on a definition of risk as a function  of threat, vulnerability, and consequence—to determine grant funding  allocations under the Homeland Security Grant Program. We found  that this program utilized a reasonable methodology to assess risk and  allocate grants to states and urban areas even though its assessment of  vulnerability was limited. The risk assessment methodology used by  FEMA is based on assessments of the threat, vulnerability, and  consequence of a terrorist attack to each state and the largest urban  areas. FEMA’s methodology estimates the threat to geographic areas  based on terrorists’ capabilities and intentions, as determined by  intelligence community judgment and data on credible plots, and  planning and threats from international terrorist networks. Because  this threat information is recognized as uncertain, threat accounts for  20 percent of the total risk to a geographic area, while vulnerability  and consequence account for 80 percent.
Moreover, the NIPP states that implementing protective programs based  on risk assessment and prioritization enables DHS, sector-specific  agencies, and other security partners to enhance current CI/KR protection  programs and develop new programs where they will offer the greatest  benefit.  By conducting a risk assessment, TSA would be able to better  prioritize risks as well as more confidently assure that its programs are  directed toward the highest priority risks.
section_title: TSA’s Security Strategy Could Be Strengthened by Including Key Characteristics of a Successful National Strategy and More Fully Addressing Elements Outlined in Executive Order 13416
paragraphs: TSA’s Mass Transit Modal Annex contains some information that is  consistent with our prior work on characteristics of a successful national  strategy and that is called for by Executive Order 13416: Strengthening  Surface Transportation Security.  However, the Modal Annex could be  strengthened by including additional information that could help TSA and  other implementing parties better leverage their resources to achieve the  strategy’s vision of protecting mass transit and passenger rail systems  from terrorist attacks.  In February 2004, we identified six characteristics  of successful national strategies. Additionally, the Executive Order calls  for the Secretary of Homeland Security to develop modal annexes for each  transportation sector that includes certain elements, many of which are  similar to the national strategy characteristics.  Table 3 provides a brief  description of five of the national strategy characteristics and relevant  Executive Order elements that are discussed further below.
The Modal Annex contains information related to three of the  characteristics we identified as desirable characteristics for a successful  national strategy: (1) purpose, scope and methodology; (2) organizational  roles, responsibilities, and coordination; and (3) integration and  implementation. For example, the organizational roles, responsibilities,  and coordination characteristic, which is also an element in Executive  Order 13416, calls for agencies to identify which organizations are to  implement the strategy, their roles and responsibilities, and the  mechanisms for collaborating.  The Modal Annex generally addresses  this characteristic as it identifies relevant stakeholder roles and  responsibilities.  Specifically, the Modal Annex states that TSA has primary  responsibility for ensuring security for mass transit and passenger rail  while other federal and industry stakeholders, such as the FTA, FRA, FBI,  private sector, and transit labor representatives have partnership roles.   The Modal Annex also describes stakeholders’ collaboration efforts. For  example, it describes FTA, FRA, APTA, and transit operators’ involvement  in the development and implementation of security standards and  directives.  See appendix III for more information on the characteristics  the Modal Annex includes.
The Modal Annex, however, could be strengthened by addressing the  other two desirable characteristics of an effective national strategy: (1)  goals, subordinate objectives, activities, and performance measures and  (2) resources and investments.  Both of these could be useful in achieving  the vision articulated in the Modal Annex of securing the mass transit and  passenger rail systems.
subsections: section_title: Goals, Subordinate Objectives, Activities, and Performance Measures
paragraphs: In conformance with this characteristic, the Modal Annex identifies sector- wide goals that apply to all modes of transportation as well as subordinate  objectives specific to mass transit and passenger rail systems.  For  instance, one of TSA’s transportation sector goals is to enhance resiliency  of the U.S. transportation system and presents three subordinate  objectives to demonstrate how the agency intends to meet this goal.  Further, for each subordinate objective, TSA presents information to  explain what TSA, other federal components, or industry stakeholders are  doing to meet the subordinate objective.  For example, the agency  identifies its Explosives Detection Canine Teams as an activity to  accomplish assessing, managing, and reducing risk associated with key  modes, links, and flows within critical transportation systems.  Table 4  provides a complete list of the TSA’s goals and their subordinate  objectives for the mass transit and passenger rail systems.
While the Modal Annex identifies goals, objectives, and activities, it does  not contain measures or targets on the effectiveness of the operations of  the security programs identified in the Modal Annex.  For example, one of  TSA’s security programs listed in the Modal Annex—Security Technology  Deployment––aligns under one of the sector goals: prevent and deter acts  of terrorism using or against the transportation system.  However, the  Modal Annex contains no measures or targets to assess the effectiveness  of this program in achieving this goal. In August 2006, we reported that  performance measures are an important tool to communicate what a  program has accomplished and provide information for budget decisions.  Further, we noted that it is desirable for these measures to be as effective  as possible in helping to explain the relationship between resources  expended and results achieved because agencies that understand this  linkage are better positioned to allocate and manage their resources  effectively.
Although the Modal Annex does not contain specific measures or targets,  it does call for developing measures of effectiveness to evaluate mass  transit and passenger rail efforts to mitigate risk and increase the  resilience of systems and assets. TSA has developed performance  measures to track the progress that the surface transportation security  program has made in conducting activities to enhance the security of the  mass transit and passenger rail systems. Specifically, TSA’s Surface  Transportation Security Inspection Program fiscal year 2009 Annual  Inspection Plan identifies annual and quarterly performance metrics for  conducting mass transit and passenger rail-related assessments that TSA  plans nationwide:     number of inspections conducted per 1,000 inspector work hours on  mass transit, passenger rail, and freight rail systems and   number of BASE reviews conducted at the top 100 largest transit  agencies.
While these measures are useful in tracking activities or actions taken,  they are output measures that do not fully inform TSA about how various  actions have impacted the security of mass transit and passenger rail  systems’ goals and objectives.  For example, TSA has so far reported the  progress in its Visible Intermodal Prevention and Response (VIPR)  program in terms of the number of VIPR operations TSA conducted, but  has not yet developed measures or targets to report on the effectiveness of  the operations themselves. However, in June 2009, TSA program officials  reported that they are planning the introduction of additional performance  measures for no later than the first quarter of fiscal year 2010. These  measures would gather information on (1) interagency collaboration by  collecting performance feedback from federal, state and local security, law  enforcement, and transportation officials prior to and during VIPR  deployments; and (2) stakeholder views on the effectiveness and value of  the VIPR deployment.
In February 2009, TSA reported plans to introduce its first outcome  measures for its mass transit and passenger rail security programs. For  example, TSA plans to introduce a performance measure for its BASE  review program.  TSA officials reported that they plan to calculate this  measure by comparing the results from the first and second round BASE  reviews for the nation’s top 100 largest transit mass transit and passenger  rail systems.  TSA also reported plans to introduce additional outcome  performance measures in the future, including an overall risk reduction  measure tied to the BASE program. Implementing these new performance  measures and including them in future updates of the Mass Transit Modal  Annex should better inform decision makers at TSA on the effect of its  programs in securing mass transit and passenger rail.
section_title: Resources and Investments
paragraphs: While the Modal Annex identifies how TSA has allocated funds available to  different transit agencies, the Modal Annex provides relatively few details  on how grant resources should be targeted.  Also, the Modal Annex  contains little information on resources and costs associated with mass  transit and passenger rail security programs.  For example, the Modal  Annex identifies as its third sector-goal, as shown on table 4, improve the  cost-effective use of resources for transportation security; however, it  provides few details on the costs, types, or levels of resources associated  with implementation of the security programs that are aligned with this  goal.  Furthermore, the Modal Annex describes risks to the mass transit  and passenger rail systems by discussing overseas attacks and the  potential consequences of such attacks in the United States.  However, the  Modal Annex does not provide information on the cost of the  consequences of such attacks and is silent on risk assessment efforts. TSA  officials acknowledged the lack of this information and the need to include  it in future updates of the Modal Annex. While providing cost estimates  may be difficult to do, including resources and costs, to the extent  possible, would help implementing parties allocate budgets according to  priorities and constraints, and would help stakeholders shift such  investments and resources as appropriate.
section_title: Federal and Industry Stakeholders Have Taken Key Actions to Strengthen Transit Security and Federal Actions Have Been Generally Consistent with TSA’s Strategy, but Opportunities Exist to Strengthen Some Programs
paragraphs: Since 2004, federal and industry stakeholders have implemented several  key actions to strengthen the security of the nation’s mass transit and  passenger rail systems and federal actions have generally been consistent  with TSA’s security strategy. However, federal efforts are largely in the  early stages and opportunities exist for TSA to strengthen some programs.
subsections: section_title: Federal Actions to Secure Mass Transit and Passenger Rail Have Been Varied and Generally Consistent with TSA’s Security Strategy
paragraphs: Since 2004, federal stakeholders have taken a number of key actions to  secure mass transit and passenger rail systems and TSA has been the  primary federal agency involved in implementing these actions.  In  general, these actions can be categorized into three areas: (1) deploying  surface inspectors and other personnel to conduct voluntary security  assessments and security operations at the nation’s largest mass transit  and passenger rail systems; (2) establishing and implementing  coordination mechanisms between federal entities and mass transit and  passenger rail industry stakeholders; and (3) coordinating with the DHS  Science and Technology Directorate (DHS S&T) to develop and test new  security technology appropriate for deployment in mass transit and  passenger rail systems.
Since 2004, TSA’s primary security activity for mass transit and passenger  rail has been conducting voluntary security assessments of the nation’s top  100 largest mass transit and passenger rail systems through its BASE  program. TSA has used the BASE results to inform the development of  security enhancement programs and to determine priorities for allocating  mass transit and passenger rail security grants. In addition, through its  VIPR program and its National Explosive Detection Canine Team Program  (NEDCTP), TSA has deployed personnel and explosive detection canine  teams to augment mass transit and passenger rail systems’ security forces  to conduct hundreds of random and event-based security operations as a  show of force to deter potential terrorist attacks at key mass transit and  passenger rail stations.
Federal agencies have taken other actions as well to strengthen security  by enhancing coordination with transit industry stakeholders. For  example, TSA established the monthly Transit Policing and Security Peer  Advisory Group (PAG) and FTA initiated the semi-annual Transit Safety  and Security Roundtables, both of which provide forums for TSA and mass  transit and passenger rail systems, including Amtrak, to share security  information and ideas. Additionally, FTA has enhanced mass transit and  passenger rail security by funding the development and delivery of  security training curriculum and programs for mass transit and passenger  rail system employees, and by developing a list of recommended security  and emergency action items for mass transit security programs, which it  later updated in collaboration with TSA. TSA also collaborates with DHS  S&T to pursue research, development, and testing of new security  technology appropriate for deployment in mass transit and passenger rail  systems. In 2006, DHS reorganized its security technology research and  development structure, and under the new structure, TSA is to identify  technology priorities to address security gaps and communicate these  priorities to DHS S&T, which in turn is to conduct technology research,  development, and testing. Table 5 provides descriptions of key federal  programs and activities, initiated since 2004, mostly by TSA and FTA, to  enhance mass transit and passenger rail system security. For a more  extensive list of federal programs and activities, see appendix IV.
Federal actions to secure mass transit and passenger rail systems  generally have been consistent with those that TSA outlined in its security  strategy for mass transit, the Mass Transit Modal Annex. The Modal Annex  describes TSA’s strategic objectives and associated federal programs and  activities to meet these objectives. For example, one objective calls for  conducting security readiness assessments, which TSA has been doing  since August 2006 through its BASE review program. Another objective  calls for a public awareness program, which TSA reported implementing  through its Employee Awareness Poster Program. See appendix V for a  list of all of the Modal Annex mass transit objectives and TSA’s reported  actions to achieve these objectives.
section_title: Mass Transit and Passenger Rail Systems Have Taken Key Actions to Enhance Security
paragraphs: Mass transit and passenger rail systems, including Amtrak, reported taking  key actions since 2004 to improve their security. Most systems reported  making operational enhancements to their security programs, such as  adding security personnel or transit police. Moreover, some of the largest  systems have implemented varying types of random passenger or baggage  inspection screening programs. These programs include deploying  security personnel at checkpoints to conduct visual observation of  passengers for suspicious behaviors as well as non-invasive baggage  checks.  Since 2004, Amtrak reported taking additional actions to secure  its system, focusing particularly on securing stations on its Northeast  Corridor. Among other things, Amtrak introduced new passenger and  baggage screening operations, increased its own explosive detection  canine capacity, and deployed an armed mobile tactical team to respond  to threats and conduct deterrent operations. Further, Amtrak provided  security training to all of its frontline employees and conducted additional  security risk assessments on its system as the baseline for developing its  corporate security strategy.
Officials from 24 of 25 passenger rail systems we interviewed and Amtrak  also reported taking actions to strengthen the security of their systems in  response to TSA’s 2004 passenger rail security directives. These actions  included removing trash receptacles from high-risk platform areas and  deploying explosive detection canine units to patrol their systems. Amtrak  also initiated identification checks for adult passengers. However, TSA’s  security directives contained limited requirements for passenger rail, and  TSA has not enforced their implementation. Additionally, TSA released a  report summarizing results of the BASE reviews it had conducted of mass  transit and passenger rail systems during fiscal year 2007. This report  showed that almost all transit agencies reported providing some type of  security training to their frontline employees; however, the extent of the  training provided varied greatly—with a majority providing an  introductory level of safety and security training for new hires, but not  refresher training.
Many mass transit and passenger rail agencies also reported making  capital improvements to secure their systems. For example, since 2004, 19  of the 30 transit agencies we interviewed had embarked on programs to  upgrade their existing security technology, including upgrading closed- circuit television at key station locations with video surveillance systems  that alert personnel to suspicious activities and abandoned packages and  installing chemical, biological, radiological, nuclear, and explosives  detection equipment and laser intrusion detection systems in critical areas.  For bus transit agencies, capital improvements have included installing  automatic vehicle location tracking, silent alarms, and engine disabling  systems to counter potential hijacking threats.
While mass transit and passenger rail systems as a whole have taken  actions to enhance their security, TSA’s BASE reviews indicated that rail  transit agencies were implementing a wider range of security programs  than bus only transit agencies. For example, according to TSA’s initial  findings from its BASE reviews of the 50 largest transit agencies,  conducted during fiscal year 2007, rail transit agencies implemented more  of the TSA/FTA security and emergency management action items than  bus-only systems. TSA officials attributed the differences to three factors.  First, passenger rail agencies have been required to comply with FTA’s  triennial State Safety Oversight audits that require passenger rail agencies  to have both a safety and security plan in place and TSA’s 2004 security  directives. In contrast, bus-only transit agencies have not been required to  implement such FTA security requirements, and no federal agency has  issued bus-specific security requirements or directives. Second, bus-only  transit agencies tend to be smaller than rail only or rail and bus transit  agencies and have fewer financial resources available to invest in security  activities. Finally, because passenger rail has been the target of recent high  profile terrorist attacks overseas and rail is considered a higher security  risk to terrorist attack than bus-only systems, passenger rail transit  security has received greater focus—both by the transit industry and the  federal government.
section_title: Opportunities Exist for TSA to Strengthen Management and Coordination of Three Mass Transit and Passenger Rail Security Programs
subsections: section_title: DHS is Exploring New Security Technologies, but Expanding Outreach and Improving Information Sharing Could Strengthen Future Research and Development Endeavors
paragraphs: As part of its research and development (R&D) strategy, DHS has been  exploring new explosive detection technologies, particularly those that  deter, detect, defeat, and protect against the use of IEDs in or around  transit infrastructure. Accordingly, DHS technology pilot projects for mass  transit and passenger rail have sought to identify and develop technologies  that can effectively detect explosive weapons or compounds while causing  minimal delays to passengers, such as fare card vending machines capable  of detecting explosive residue on passengers’ bodies or bags (see figure 3).  Although DHS has worked to develop some security technologies specific  to mass transit and passenger rail systems, most technologies that it has  pursued could work across different transportation modes, including  aviation, maritime, mass transit, and passenger rail. DHS has also pursued  several infrastructure protection projects that address the threat of IEDs,  with a particular focus on addressing the vulnerabilities of underground  and underwater transit tunnels. Unlike its role in commercial aviation,  TSA does not procure or deploy security technologies for mass transit and  passenger rail systems. Instead, TSA partners with mass transit and  passenger rail systems to conduct pilot projects and demonstrations of  commercially available technologies and technologies from DHS  laboratories. The mass transit and passenger rail systems themselves  determine which security technologies to procure and deploy. See  appendix VI for a list of ongoing and completed TSA and DHS mass transit  and passenger rail security-related technology pilot programs.
Since 2007, TSA, like other DHS components, has been responsible for  articulating the technology needs of all transportation sector end-users— including mass transit and passenger rail agency operators—to DHS S&T  for development. TSA has taken some initial actions to reach out to mass  transit and passenger rail systems regarding their security R&D needs;  however, these efforts could be expanded and improved by more fully  leveraging existing forums to solicit a wider range of input.  This effort is  important because, as we reported in September 2004, stakeholders are  more likely to use research results if they are involved in the R&D process  from the beginning. The Mass Transit Modal Annex states that DHS S&T  and TSA will identify security technology needs in full partnership with the  mass transit community. To achieve this, TSA officials told us that TSA  leverages existing forums for communication, such as the semi-annual  Transit Security Roundtables, to identify technology capability gaps and to  solicit input and feedback on its technology priorities. Additionally, in  2008, TSA headquarters officials reported that they sought input from  transit industry representatives through the Transit Policing and Security  Peer Advisory Group and the Mass Transit Sector Coordinating Council  Security Technology Working Group. Nonetheless, in a September 2008  draft report, the Mass Transit Sector Coordinating Council Security  Technology Working Group reported that other than occasional telephone  discussions, there was no ongoing structure that brought the federal  government and transit industry together to discuss transit security  technology priorities, needs, and areas of potential interest for technology  advancement and research. In September 2004, we recommended that  DHS and TSA improve their outreach to the transportation industry  (including mass transit and passenger rail systems) to ensure that the  industry’s R&D security needs have been identified and considered. DHS  agreed that this recommendation was key to a successful R&D program  and since that time, DHS and TSA have made some preliminary efforts to  outreach on R&D security issues. However, by continuing to expand  these efforts and getting input early on in the project selection process,  TSA should be able to ensure that DHS has adequately considered and  addressed the full scope of the industry’s R&D needs.
TSA has taken initial actions to share information on available security  technologies, but could strengthen its approach by providing more  information to support transit agencies that are considering deploying new  security technologies. Consistent with a recommendation we made in  September 2005, TSA established the Public Transit Portal of DHS’s  Homeland Security Information Network (HSIN), a secure Web site that  serves as a clearinghouse of information on available security technologies  that have been tested and evaluated by DHS, in addition to providing  security alerts, advisories, and information bulletins.  In February 2009,  TSA reported that it had established HSIN accounts for 75 of the 100  largest mass transit and passenger rail systems. However, officials from 11  of 17 mass transit and passenger rail systems who discussed HSIN told us  that they did not use it for guidance on available security technologies  when considering security technology investments. These officials said  that they did not use HSIN when considering such investments because  HSIN did not contain product details that would support these decisions,  including details on product capabilities, maintenance, ease of use, and the  suitability of the products in a bus or rail venue. We reviewed HSIN and  found that for a given security product, TSA’s listing provides a categorical  definition (such as video motion analysis), a sub-category (such as  day/night camera), and the names of products within those categories.   However, HSIN neither provides nor indicates how transit agencies can  obtain information beyond the product’s name and function. A senior  program official with TSA’s TSNM mass transit division told us that mass  transit and passenger rail system officials would already know whom to  contact at TSA for more information on a product. However, the official  acknowledged that the product listing could be enhanced by including the  contact information of the TSA officials capable of providing that  information. In the absence of more detailed information on security- related technologies, officials from 19 of 30 mass transit and passenger rail  systems we interviewed told us that they either (1) asked other operators  about their experiences with a particular technology; (2) performed their  own research via the Internet or trade publications; or (3) performed their  own testing. Making the results of research testing available to industry  stakeholders could be a valuable use of federal resources by reducing the  need for multiple industry stakeholders to perform the same research and  testing.
The senior TSA program official with the TSNM mass transit division also  acknowledged that HSIN contained limited technology information but  noted that the site’s content was largely in the early stages of  development. The official attributed some of the limitations to TSA’s  reluctance to provide substantive details regarding any particular product,  since TSA officials did not want to be perceived as endorsing any  particular vendor. Nonetheless, TSA stated that its goal for HSIN was to  provide a way for transit agencies to share, receive, and find information  on security technology as well as to provide a technology database with  performance standards and product capabilities so that mass transit and  passenger rail agencies would be well prepared to interact with vendors.  Although TSA has set this goal for HSIN, there was no set deadline for the  content-related improvements.  By taking action to address mass transit  and passenger rail agencies’ need for more information, TSA could help  provide transit agencies with a consolidated source of information on  security technologies and help ensure that limited resources are not used  to duplicate research and testing efforts.
section_title: TSA Reported Taking Steps to Respond to Transit Industry Concerns and Improve the Effectiveness of its VIPR Program
paragraphs: In response to mass transit and passenger rail industry concerns about its  VIPR program, TSA reported taking steps to work with the industry to  improve the effectiveness of the program.  TSA conducts VIPR operations  as a way to introduce security measures (such as random bag searches) at  mass transit and passenger rail systems to deter potential terrorist threats,  augment local security forces, and promote the visibility of TSA  resources. TSA, to date, has conducted over 800 VIPR operations at mass  transit and passenger rail systems.  TSA also reported that almost all  operations were deployed on a random basis or to enhance security at  special events or on holidays, rather than in response to specific threat  information.
Mass transit and passenger rail system officials we interviewed had  varying opinions on the effectiveness of the VIPR operations that TSA had  conducted on their systems. For example, security and management  officials from 5 of the 30 mass transit and passenger rail systems we  visited told us that they generally welcomed the additional security  resources that the VIPRs provided. In contrast, officials from four other  mass transit and passenger rail systems reported that because they were  already deploying their own transit police and security personnel on their  systems on a daily basis, the addition of a largely unarmed VIPR team on a  single day did not add significant security value especially with the  additional planning and costs incurred by these operations.
In response to VIPR planning and implementation concerns raised by large  mass transit and passenger rail systems, in October 2007 TSA issued a  Concept of Operations (CONOPS) for its VIPR program that established  general guidelines for the planning and execution of a VIPR deployment.  TSA developed the guidance in coordination with members of the Transit  Policing and Security Peer Advisory Group and issued the guidance to  both its field personnel and the mass transit industry. The CONOPS  includes general guidelines for 10 core components of collaboration, such  as coordination, planning, and communications. In June 2008, the DHS  Inspector General (DHS-IG) reported on VIPR planning and  implementation concerns and noted that transit system officials reported  that TSA’s issuance of the VIPR guidance had led to improvements that  addressed many of the VIPR implementation concerns. Nevertheless, our  review of TSA after-action reports for 104 VIPR operations TSA conducted  from November 2007 through July 2008 on mass transit and passenger rail  systems—a nine month period after TSA issued the CONOPS guidance— identified insufficient interoperable radio communications as a key  challenge faced during many VIPR operations.
According to the after-action reports, TSA’s key challenge has been  ensuring that its VIPR teams have reliable interoperable radio  communications—both among TSA personnel and with local law  enforcement. According to the CONOPS, ensuring interoperable radio  communications between VIPR team members and local law enforcement  is essential to the safe and effective execution of VIPR programs, including  ensuring their ability to communicate information on potential threats  encountered during operations. However, in almost half of the after-action  reports we reviewed (49 of 104), VIPR participants reported that a lack of  reliable communications equipment had hindered their ability to conduct  real-time communications with local law enforcement. This challenge has  existed since TSA expanded the VIPR program into mass transit and  passenger rail systems, where cell phone or other communications  systems that previously worked in airports did not effectively operate in a  transit environment. In many cases, TSA field personnel reported requests  for new interoperable radio systems, but had not had those requests  fulfilled by TSA headquarters. These reports indicated the need for a more  comprehensive solution in which TSA procures communications systems  capable of real time interoperability with security partners in mass transit  and passenger rail systems.
TSA managers of the VIPR program acknowledged the challenges that the  VIPR program had experienced since it expanded into mass transit and  passenger rail systems and stated that the agency was taking actions to  address them. Examples include:     Communications Improvements: TSA reported deploying additional  communications equipment to field locations and working with DHS  S&T to test new technologies for enhancing communications  capability and interoperability in a mass transit or passenger rail  environment.
Coordination and Awareness: TSA reported that it developed and  made available to mass transit and passenger rail systems a brochure  with information on scheduling and deploying VIPR operations,  including a description of the different options available for systems in  utilizing VIPR teams and the planning and operational roles and  responsibilities of participating TSA personnel. Further, to improve  nationwide coordination of VIPR operations, TSA established a  coordination center dedicated solely to VIPR operations and has  established dedicated mobile VIPR teams in 10 cities.  TSA has  reported that it plans to expand the number of these teams nationwide  by 2010.
Training TSA Personnel: TSA reported in February 2009 that the  agency had begun requiring VIPR team personnel to participate in  system orientation and safety training from mass transit and passenger  rail systems where they deploy in order to familiarize VIPR team  members with both the transit agency’s physical structure and  operating procedures. TSA also reported offering additional training  on surface-based law enforcement tactics and legal authorities.
Because TSA plans to further expand the VIPR program in 2009, effectively  implementing these actions should better ensure that TSA uses its limited  security resources to maximize the security benefit of VIPR operations in  mass transit and passenger rail.
section_title: TSA Established a Program to Expand Security Training for Mass Transit and Passenger Rail Employees, but Opportunities Exist to Strengthen It
paragraphs: In February 2007, TSA established a training program to assist mass transit  and passenger rail agencies in expanding security training for their  frontline transit employees. However, opportunities exist for TSA to  strengthen its process for ensuring consistency in the performance of non- federal training vendors that mass transit and passenger rail agencies use  to obtain training through the program. After TSA’s initial BASE reviews  revealed wide variations in the extent of training that transit agencies were  providing to their employees, including limited recurrent training, TSA  established a Mass Transit Security Training program to provide  curriculum guidelines for basic and follow-on security training areas— training programs and courses largely developed and funded by FTA. It  also specified areas in which particular categories of employees should  receive recurrent training as well as a matrix tool to enable transit  agencies to determine the costs and timelines for implementing the  training. To support delivery of the training courses, TSA aligned the  program with the DHS Transit Security Grant Program. The Transit  Security Grant Program has made transit agency grant funding for security  training a top priority and offers mass transit and passenger rail agencies  the option of using grant funding to cover costs for training to employees  that is supplied by either (1) training providers that are federally funded or  sponsored or (2) other training providers.
While TSA has reported that the Mass Transit Security Training Program is  providing opportunities for mass transit and passenger rail systems to  expand security training to their employees, senior officials from FTA’s  Safety and Security Office expressed concern that TSA had not established  the necessary criteria to effectively manage the program. According to  TSA’s Mass Transit Security Training Program guidance, TSA allows  transit systems to obtain DHS grant funding to contract with private  security training vendors if TSA has determined that the performance of  the vendors’ training curriculum and delivery services is equal to those of  the federally sponsored providers. As a result, TSA assumed new  responsibility for evaluating whether these security training vendors met  the performance standards of federally sponsored training providers and  whether they could be used by transit agencies for training under the  Transit Security Grant Program. However, opportunities exist for TSA to  strengthen its process for making this evaluation. According to TSA,  transit agency requests to use non-federally funded or sponsored training  vendors under the Transit Security Grant Program are reviewed by TSA’s  mass transit training specialist and by FEMA’s Grants Program Directorate  for approval. This review includes an analysis of course documentation,  such as a description of the course syllabus, cost estimate, and  justification for why the course was the preferred solution. However, both  FTA and TSA officials acknowledged that additional criteria are needed  for TSA to properly evaluate the selection of the training vendors.  As the  lead federal agency for developing and implementing mass transit  employee safety training programs since 1971, FTA is in the process of  issuing guidance that could be relevant to TSA’s evaluation of training  vendors. According to FTA’s 2009 Training Curriculum Development  Guidelines, scheduled for release in 2009, criteria for evaluating the quality  of training services should include, among other things, a review of the  credentials of the instructors who would deliver the training course, the  training vendor’s experience in providing the security course, and any  performance evaluations or feedback obtained from organizations and  students who previously received training from the vendor. Additionally,  as we reported in March 2004, agencies should try to develop clear criteria  when determining whether to contract with vendors for training. We  identified factors that agencies should consider include the prior  experience, capability, and stability of the vendors offering the training.
Since implementing the Mass Transit Security Training Program in 2007,  TSA reported that about 50 mass transit and passenger rail systems had  applied for Transit Security Grant Program funding for employee security  training, including one agency that applied to use training vendors that are  not federally funded or sponsored. However, more applications for this  option are expected as additional grant funding for training becomes  available.  TSA and FTA officials both noted their preference for transit  agencies to use federally-sponsored training providers and expressed  concerns that increased demands on the providers may make scheduling  training with federally funded or sponsored providers more difficult.  Enhancing criteria for evaluating the quality of training services could  strengthen DHS’s ability to ensure that the grant money DHS is awarding  to mass transit and passenger rail agencies is consistently funding sound  and valid security training programs for these employees. In October 2005,  we reported that collaborating agencies can identify opportunities to  leverage each other’s resources, thus obtaining additional benefits that  would not be available by working separately. By coordinating the  enhancement of these criteria with other agencies conducting similar  efforts, such as FTA, TSA could also leverage the expertise of other  agencies to better ensure its efforts result in sound criteria.
section_title: TSA Reported Implementing Some 9/11 Commission Act Provisions for Mass Transit and Passenger Rail Security, but Implementing New Regulations May Pose Challenges for TSA and Industry Stakeholders
paragraphs: In March 2009, TSA reported that it had implemented some of the 9/11  Commission Act’s provisions related to mass transit and passenger rail  security. While most mass transit and passenger rail industry security  actions have been voluntary to date, the 9/11 Commission Act sets forth  mandatory requirements for federal and industry stakeholders, and  implementing those requirements may pose challenges for TSA and  industry stakeholders, particularly for TSA’s Surface Transportation  Security Inspection Program. TSA has more than doubled the size of its  Surface Transportation Security Inspection Program over the past year,  but has not completed a workforce plan to address current and future  program needs, and surface inspectors have reported concerns with  organizational changes that TSA has made to the program that may affect  implementation of new responsibilities. Additionally, officials from the  mass transit and passenger rail industry have reported concerns with the  cost and feasibility of implementing pending 9/11 Commission Act  regulations.
subsections: section_title: TSA Reported Implementing Some Provisions of the 9/11 Commission Act for Mass Transit and Passenger Rail Security
paragraphs: The 9/11 Commission Act, enacted in August 2007, contains many  provisions that task TSA with implementing various actions related to  surface transportation, including mass transit and passenger rail security.  Among other things, these provisions identify mandates for developing  and issuing reports on TSA’s strategy for securing public transportation,  conducting and updating security assessments of mass transit systems,  and establishing a program for conducting security exercises for transit  and rail agencies. In March 2009, TSA reported that it had satisfied some  provisions of the 9/11 Commission Act pertaining to mass transit and  passenger rail, including some through actions that had been taken prior  to the enactment of the 9/11 Commission Act. For example, TSA reported  that it had issued a report on the transportation security enforcement  process and that its Mass Transit Modal Annex satisfied the requirement to  develop a strategy for securing public transportation. However, TSA also  reported that it had not yet implemented a number of other 9/11  Commission Act provisions, including several requiring TSA to issue  regulations that would place new requirements on the mass transit and  passenger rail industry.
The 9/11 Commission Act requires TSA to develop and issue several  different regulations for mass transit and passenger rail, including  regulations for employee security training programs and requiring high- risk rail carriers to develop and implement security plans. TSA reported  that it was in the process of developing these regulations and that for  some required regulations it had sought feedback from the transit industry  as it developed new regulations. However, as of March  2009, TSA had  missed several legislative deadlines for issuing the required mass transit  and passenger rail regulations, and in some cases had not established time  frames for when it would ultimately do so. For example, TSA was required  to issue interim regulations outlining requirements for a mass transit  employee security training program by November  2007, with final  regulations due by August  2008. TSA was also required to issue  regulations by August 2008 requiring high-risk rail carriers to develop and  implement security plans. However, TSA did not meet these deadlines.   TSA reported that deadlines in the act for developing and issuing new  regulations have been difficult to meet because of different factors,  including the comprehensive scope of the requirements, the need to  coordinate them with various entities, and a lack of resources for  completing certain tasks.  See table 6 below for a list of key selected 9/11  Commission Act mass transit and passenger rail provisions mandating  actions by TSA, along with TSA’s reported status in doing so, as of March  2009.
Develop and implement the National  Strategy for Public Transportation  Security.
TSA reported that the Mass Transit Modal  Annex to the Transportation System -Sector  Specific Plan meets this requirement.
Establish a task force to complete (by Feb.  2008) a risk assessment of a terrorist  attack on railroad carriers, and based on  the assessment, develop and implement  the National Strategy for Railroad  Transportation Security.
TSA reported that the task force has been  established and that the National Strategy for  Railroad Transportation Security is under  development. For passenger rail, TSA  reported that the Mass Transit Modal Annex  to the Transportation System -Sector Specific  Plan meets. the requirement to develop and  implement a security strategy.
Review and update FTA security  assessments of high-risk public  transportation agencies, require high-risk  public transportation agencies to develop  security plans and review, amend as  necessary, and approve the security  plans.
TSA reported that FTA security assessments  were provided to TSA and that TSA used the  BASE program to update the assessments.  TSA stated that it will use the BASE results in  developing regulations implementing this  requirement. TSA reported that a regulatory  project has been initiated.
Conduct security assessments to  determine the specific needs of local bus- only transportation systems.
TSA reported that the assessments have  been completed and that information is being  prepared for use by the transportation system  operators.
Issue regulations (by Aug. 2008) that  require each railroad carrier, including  passenger rail carriers, determined to be  high-risk to conduct a vulnerability  assessment and to prepare, submit for  approval, and implement a security plan.
TSA reported that a regulatory project has  been initiated.
Establish a program for conducting  security exercises for public transportation  agencies and for railroad carriers.  Establish a program for conducting  security exercises for railroad carriers,  including passenger rail carriers.
TSA reported that its Intermodal Security  Training and Exercise Program meets this  requirement. The agency further reported a  multi-phased, multi-jurisdictional pilot of this  exercise program was held in the National  Capitol Region from January through June  2008, northern New Jersey in September  2008, and Los Angeles from February to  June 2009.
Issue interim (by Nov. 2007) and final  regulations (by Aug. 2008) for a public  transportation security training program  and issue regulations (by Feb. 2008) for a  security training program for frontline  railroad, including passenger railroad,  employees.
TSA reported that a consolidated regulatory  project including public transportation,  railroad, and over-the-road bus has been  initiated. TSA reported that it anticipates  issuing a Notice of Proposed Rulemaking in  late calendar year 2009 or early calendar  year 2010.
Complete a name-based security  background check for all public  transportation frontline employees and  frontline railroad employees.
TSA reported that it has begun to develop a  project plan for a rulemaking needed to  satisfy this requirement, but that significant  funding and time will be required to meet this  requirement.
TSA reported that it tracks the implementation status of mass transit and  passenger rail security provisions of the 9/11 Commission Act on a  monthly basis as part of a DHS-managed working group and was  identifying processes needed to implement the provisions. TSA provided  us with progress reports for completing these provisions which, in certain  cases, identified challenges it faced in doing so, including a lack of  resources. But the reports did not include a plan for addressing these  challenges or milestones for implementing several 9/11 Act Commission  provisions, as called for by project management best practices. TSA  officials reported that before they could move forward on the 9/11  Commission Act requirements, they needed to allow the new  administration time to review TSA’s efforts to date. However, until TSA  develops a plan with milestones, it will be difficult to provide reasonable  assurance that the provisions of the act are being developed and that a  strategy is in place for overcoming identified challenges.
section_title: While Industry Security Actions Have Largely Been Voluntary, New 9/11 Commission Act Requirements Outline a Mandatory Approach and Pose Challenges for TSA’s Inspectors
paragraphs: While the majority of industry actions to secure mass transit and  passenger rail have been taken on a voluntary basis, the pending 9/11  Commission Act regulations outline a new approach that sets forth  mandatory requirements, the implementation of which may create  challenges for TSA and industry stakeholders. With the exception of the  2004 passenger rail security directives, TSA had not, until recently,  imposed security requirements on the mass transit and passenger rail  industry.  Instead TSA took a collaborative approach in encouraging  passenger rail systems to voluntarily participate and address security gaps  through its BASE review program. With TSA’s pending issuance of  regulations required by the 9/11 Commission Act, TSA will fundamentally  shift this approach, and establish a new regulatory regime for mass transit  and passenger rail security.
Once TSA issues the pending regulations for mass transit and passenger  rail security, TSA’s Surface Transportation Security Inspection Program  would have responsibility for enforcing industry compliance—further  expanding and evolving the roles and responsibilities these inspectors  have for mass transit and passenger rail, in addition to their  responsibilities for other surface modes, such as freight rail, highway, and  motor carrier security. TSA officials have raised concerns about their  ability to meet the growing inspection requirements for mass transit and  passenger rail and other surface modes that will be incurred by the new  regulations required by the 9/11 Commission Act, particularly because  TSA’s Surface Transportation Security Inspection Program is already  challenged to meet its existing workload.  For example, 10 of 11 Surface  Transportation Security Inspection Program field office supervisors— Assistant Federal Security Directors for Surface Transportation (AFSD- S)—whom we interviewed reported that while they were meeting their  primary inspection responsibilities for mass transit and other surface  modes, resource constraints were routinely leading them to delay  secondary activities, such as conducting stakeholder outreach with mass  transit and passenger rail agencies. These field office supervisors  attributed their resource constraints to a significantly expanded Surface  Transportation Security Inspection Program workload from fiscal year  2006 through 2008 without a corresponding increase in its workforce.  During this time, TSA expanded the responsibilities of the surface  transportation security inspectors to include additional surface  transportation modes, including conducting various voluntary security  inspections for mass transit bus and freight rail, and participating in VIPR  operations.
TSA’s Surface Transportation Security Inspection Program is at risk of  being unable to meet its expanding responsibilities if it does not plan for  how to meet them.  TSA reported that the agency had been appropriated  funding to hire an additional 125 surface inspectors that would more than  double its surface inspector workforce—including 75 in fiscal year 2008  and 50 more in fiscal year 2009—and planned to complete their hiring,  training, and deployment by the end of fiscal year 2009. TSA reported  plans to largely dedicate its newly hired surface inspectors to conducting  VIPR activities, assessing  security activities on surface modes, and  monitoring newly issued freight rail security rules, such as ensuring a  secure chain of custody for certain hazardous materials. However, as  reported by the DHS Inspector General, beyond supporting current  activities, the additional manpower TSA plans to put into its Surface  Transportation Security Inspection Program may provide only limited  relief. As a result, even with these additional resources, TSA’s surface  inspectors may face challenges in fulfilling their responsibilities.
GAO guidance on strategic human capital management reinforces that  high performing organizations conduct workforce planning and analysis to  identify and prepare for current and future workforce needs.  Accordingly, a workforce plan that includes an analysis of a program’s  workforce needs can help to ensure that the program has the right amount  of resources to achieve program goals, allowing program managers to  spotlight areas for attention before problems develop. In February 2009,  we reported that TSA did not have a human capital or other workforce  plan for its Transportation Security Inspection Program, but the agency  had plans to conduct a staffing study to identify the optimal workforce size  to address its current and future program needs. TSA reported that it had  hired a contractor to conduct a full workforce analysis of its security  inspectors, including both its aviation and surface inspectors, to determine  the number needed to fulfill expanded roles and responsibilities and  ensure effective deployment. TSA reported that it had initiated the study in  January 2009 to be completed in late fiscal year 2009. This study, if  completed, should provide TSA with a more reasonable basis for  determining the surface inspector workforce needed to achieve its current  and future workload needs in light of the new requirements of the 9/11  Commission Act.
subsections: section_title: Stakeholders Have Raised Concerns Regarding Changes to TSA’s Surface Transportation Security Inspection Program Field Office Command Structure
paragraphs: Surface inspectors have raised concerns about recent organizational  changes that TSA has made to the Surface Transportation Security  Inspection Program that may affect the implementation of its expanded  roles and responsibilities. These concerns were reported by Surface  Transportation Security Inspection Program field officials we interviewed,  two recent DHS-IG reports, and an internal TSA report prepared by several  Surface Transportation Security Inspection Program field officials.  Specifically, in April 2008, TSA announced plans to expand the number of  Surface Transportation Security Inspection field offices nationwide, from  22 to 54. Under a re-organized reporting structure, TSA placed 31 of the 32  new field offices under the command of Federal Security Directors and  Assistant Federal Security Directors for Inspections—aviation-focused  positions that historically have not had an active role in conducting mass  transit, passenger rail, or other surface transportation inspection duties.  TSA’s Surface Transportation Security Inspection Program headquarters  officials continue to set strategy and annual goals, while in most field  offices the surface inspectors report to the Federal Security Directors and  Assistant Federal Security Directors for Inspections, who have day-to-day  management lead and hiring responsibilities for surface inspectors.  Reported field official concerns include:    Balancing aviation and surface transportation priorities: A  January 2008 report that 6 of 12 of TSA’s Assistant Federal Security  Directors for Surface submitted to TSA headquarters cited concerns  that placing the Surface Transportation Security Inspection program  under the Federal Security Directors had resulted in the surface  transportation mission being diluted by TSA’s aviation mission. The  report also stated that the current reporting line of surface inspectors  is less efficient and may create confusion among surface inspectors,  because Federal Security Directors’ priorities and needs differ from  those of the surface program.
Establishing and maintaining credibility with industry  stakeholders: Eight of the 11 Assistant Federal Security Directors for  Surface we interviewed reported concerns that Federal Security  Directors were not sufficiently focused on mass transit and passenger  rail and the different challenges that surface inspectors face in  overseeing the industry’s voluntary participation in non-regulatory  security assessment activities. For example, one Assistant Federal  Security Director for Surface commented that Federal Security  Directors had tasked aviation security officers to participate in surface  assessments and that doing so had caused some frustration among  transit agency officials because of their lack of knowledge about the  transit environment. A June 2008 DHS-IG report also noted surface  inspectors’ concerns that Federal Security Directors were hiring  surface inspectors who had no prior surface transportation  experience, and that in some cases, Assistant Federal Security  Directors reported that they were not included in hiring decisions.
TSA disagreed with the DHS-IG and Assistant Federal Security Directors  reports’ findings that the present Surface Transportation Security  Inspection Program field office command structure had inhibited the  program’s effectiveness. For example, TSA did not concur with the DHS- IG’s recommendation that TSA place the Surface Transportation Security  Inspection Program under the direct authority of a TSA headquarters  official responsible for surface transportation, rather than under the  Federal Security Directors. TSA reported that they had selected their  current command structure because Federal Security Directors were best  equipped to make full use of the security network in their geographical  location because they frequently interacted with state and local law  enforcement and mass transit operators, and were aware of vulnerabilities  in these systems.
section_title: Transit Industry Stakeholders Expressed Concern about the Cost and Feasibility of Implementing Pending Regulatory Requirements
paragraphs: While TSA has not yet issued the new 9/11 Commission Act regulations for  mass transit and passenger rail, 12 of 30 mass transit and passenger rail  agencies we interviewed raised potential implementation concerns  associated with one expected regulatory requirement regarding training  for mass transit and passenger rail employees. Among other comments,  mass transit and passenger rail agency officials reported that unless these  new regulations were accompanied by funding to address implementation  costs, they would be challenged to comply since mass transit agencies face  tight budgetary constraints. For example, one transit agency official  reported in feedback to TSA that an agency with 5,000 employees would  incur labor costs of $1.5 million to have its employees participate in an 8- hour training program.  Another transit agency official reported that it  would be an achievement to get 30 to 40 percent of frontline employees  through training in a year due, in part, to the costly overtime for backfilling  those employees’ positions while they are in training.  Additionally, these  12 agencies also reported concerns about the logistical feasibility of  implementing the training requirement. For instance, under the act, mass  transit and passenger rail agencies would be required to complete security  training for all of their frontline employees within one year of DHS’s  approving the transit agency’s training program. However, several mass  transit and passenger rail agencies reported having thousands of  employees and said it would be difficult to schedule training for all  employees within one year without disrupting operations because they did  not have the staff needed to backfill the positions of the employees  undergoing training.
section_title: Conclusions
paragraphs: As terrorist attacks on mass transit and passenger rail systems overseas  have made clear, even with a variety of security precautions in place, mass  transit and passenger rail systems that move high volumes of passengers  on a daily basis remain vulnerable to attack. Since 2004, TSA has  introduced a variety of initiatives aimed at enhancing the security of the  nation’s mass transit and passenger rail systems, including conducting  security assessments, implementing new security programs, and  implementing some provisions of the 9/11 Commission Act. However,  given the importance of the mass transit and passenger rail systems, the  inherent vulnerabilities that could be exploited by terrorist threats, and the  broadening requirements that will result in a shift to a regulatory  approach, addressing management and coordination challenges should  help ensure that current and future actions effectively improve the  security of these systems. TSA has taken key steps to help secure the  nation’s mass transit and passenger rail systems; however, additional  actions to more effectively target resources would strengthen TSA’s  security approach. To ensure that TSA’s efforts best prioritize and address  risks, TSA should conduct a risk assessment for the mass transit and  passenger rail systems that combines the results of threat, vulnerability,  and consequence assessments. Until the overall risk to the entire system is  identified through such an assessment, TSA cannot best determine how  and where to target its limited resources to achieve the greatest security  gains. TSA’s 2007 Mass Transit Modal Annex represents a positive step  toward documenting TSA’s strategy for securing the mass transit and  passenger rail systems, but further refinements to the strategy  documented in future updates to the Modal Annex would help ensure that  it provides all stakeholders with a clear and measurable path forward.  For  example, including relevant performance metrics will allow stakeholders  to better evaluate their progress in achieving the strategy’s vision. In  addition, incorporating information on what the strategy will cost, to the  extent possible, would help implementing parties allocate budgets  according to priorities and constraints, and would help stakeholders shift  such investments and resources as appropriate.
Federal and industry efforts to work together in securing mass transit and  passenger rail in the absence of any significant federal security regulations  have been commendable. In particular, TSA’s BASE reviews have been a  positive step as they enhanced the awareness of security vulnerabilities at  mass transit and passenger rail agencies throughout the country, while  strengthening relationships among transit stakeholders. Notwithstanding  TSA’s progress, TSA’s efforts remain largely in the early stages and  opportunities exist for TSA to strengthen the implementation of some of  its security programs. Expanding its outreach with mass transit and  passenger rail officials will be particularly important for TSA in gathering  security technology information and disseminating it to the systems and  enabling officials to identify and deploy new security technologies to  better secure their systems. In addition, with HSIN, TSA already has a  venue in place for expanding the dissemination process and should  explore the feasibility of populating this site with better and more relevant technology information to help meet the needs of mass transit  and passenger rail agencies regarding information on available security  technology.  Such action should help ensure that limited resources are not  used to duplicate research and testing efforts. Finally, by providing  guidance and funding to cover mass transit and passenger rail agency  costs for providing employee security training, TSA has taken steps to  reduce a key vulnerability it identified during its BASE reviews. However,  with the anticipated increase in demand for employee security training, it  is important that TSA have an effective evaluation process in place to  ensure it is consistently funding sound and valid training programs for  mass transit and passenger rail agencies seeking funding to pay for non- federal training providers.
Finally, a significant transition lies ahead. While TSA reports making  progress in implementing the provisions of the 9/11 Commission Act, the  agency has fallen behind in issuing required mass-transit and passenger-  rail security regulations. The implementation of these regulations will be a  fundamental shift in approach for TSA as it assumes more of a regulatory  role in securing mass transit and passenger rail. This shift—combined with  an expanding Surface Transportation Security Inspector workforce that  has more than doubled in size in the past year and shifting deployment and  field reporting structures—will challenge TSA to manage its new  responsibilities. However, this transition will be important for both TSA  and industry stakeholders to manage successfully to ensure that new  requirements are met and that TSA and stakeholders continue to work  together to secure mass transit and passenger rail. One approach that  could help DHS manage these many changes is to develop a schedule with  milestones for implementing the remaining 9/11 Commission Act  requirements pertaining to mass transit and passenger rail. Without such a  plan, it will be difficult for TSA to provide reasonable assurance that the  provisions of the act are being implemented and that a strategy is in place  for overcoming identified challenges. We recognize the inherent  challenges to securing these systems given the continuing terrorist threat,  openness of the system, and difficulties posed by attempting to secure and  patrol numerous points of entry. However, given the criticality of mass  transit and passenger rail systems to our way of life and the economy, and  the inherent risks to them, TSA should continue to strive to strengthen its  security efforts for the systems.
section_title: Recommendations for Executive Action
paragraphs: To help ensure that the Transportation Security Administration is  successfully prioritizing resources and collaborating with federal and  industry stakeholders in implementing actions to secure the mass transit  and passenger rail systems from acts of terrorism, and that its strategy is  consistent with the characteristics of a successful national strategy, we are  making six recommendations to the Assistant Secretary for the  Transportation Security Administration:    To help ensure that the federal strategy to secure the mass transit and  passenger rail systems considers assessment information within the  context of risk, TSA, as the sector-specific agency for mass transit and  passenger rail, should conduct a risk assessment that integrates all  three elements of risk—threat, vulnerability, and consequence.  As part  of this assessment, TSA should, to the extent feasible, fully leverage  existing assessment information from its own sources as well as those  provided by other federal and industry stakeholders, as appropriate,  and use this information to inform its security strategy.
To better achieve the security strategy laid out in its Mass Transit  Modal Annex—TSA’s security strategy for the mass transit and  passenger rail systems—TSA should, to the extent feasible,  incorporate into future updates of the Modal Annex the characteristics  of a successful national strategy and the elements outlined in  Executive Order 13416, including:   measuring the agency’s and industry’s performance in achieving the  goals of preventing and deterring acts of terrorism and enhancing  the resiliency of mass transit and passenger rail systems and   incorporating information on what the strategy will cost along with  the specifying the sources and types of resources and investments  needed, and identifying where those resources and investments  should be targeted.
To help ensure that DHS security technology research and  development efforts reflect the security technology needs of the  nation’s mass transit and passenger rail systems, TSA should expand  its outreach to the mass transit and passenger rail industry in the  planning and selection of related security technology research and  development projects.
To meet the needs of mass transit and passenger rail agencies  regarding information on available security technologies, TSA should  explore the feasibility of expanding the security technology product  information on the Public Transit Portal of the Homeland Security  Information Network, and consider including information such as  product performance in a rail or bus venue, cost, maintenance needs,  and other information to support mass transit and passenger rail  agencies purchasing and deploying new security technologies.
To better ensure that DHS consistently funds sound and valid security  training delivery programs for mass transit and passenger rail  employees, TSA should consider enhancing its criteria for evaluating  whether security training vendors meet the performance standards of  federally sponsored training providers and whether the criteria could  be used by transit agencies for training under the transit security grant  program.  As part of this effort, TSA should consider coordinating with  other federal agencies that have developed criteria for similar  programs, such as the Federal Transit Administration.
To better ensure DHS’s ability to satisfy the provisions of the 9/11  Commission Act related to mass transit and passenger rail, DHS should  develop a plan with milestones for implementing provisions of the 9/11  Commission Act related to mass transit and passenger rail security.
section_title: Agency Comments
paragraphs: We provided a draft of this report to DOT, Amtrak, and DHS for review  and comment. DOT did not provide comments. Amtrak provided written  comments on June 16, 2009. In its letter, Amtrak provided additional  information on security actions they were taking, noted collaboration with  federal agencies, and expressed some concern about the cumbersome  nature and cost share requirements of the Transit Security Grant Program.  Amtrak’s comments are presented in appendix VII.  DHS provided written  comments on June 17, 2009, which are presented in appendix VIII.  In  commenting on the report, DHS stated that it concurred with all six  recommendations and identified actions planned or under way to  implement them.
In comments related to our first recommendation, that DHS conduct a risk  assessment that integrates all three elements of risk, DHS stated that it  recognized the importance of conducting risk assessments to inform  agency priorities, security enhancement programs, and resource  allocations. It also reported that in addition to the various assessments  already completed and the BASE reviews conducted on a continuous  cycle, an assessment pilot program is planned for later in 2009.  Under this  pilot, TSA will evaluate the effectiveness of and provide lessons learned  from its new risk assessment tool for mass transit and passenger rail to  enhance the tool’s capability prior to its implementation. In comments  related to our second recommendation that DHS incorporate in future  updates of the Modal Annex the characteristics of a successful national  strategy and the elements outlined in Executive Order 13416, DHS  reported that it planned to revise its Mass Transit Modal Annex and  incorporate these characteristics and elements to improve its ability to  measure agency and industry progress toward achieving mass transit and  passenger rail security performance goals.  In response to our third  recommendation that TSA expand its outreach to the mass transit and  passenger rail industry in the planning and selection of related security  technology research and development projects, DHS reported on several  planned coordination efforts including its intent to coordinate the Modal  Annex update with mass transit and passenger rail stakeholders, and work  to ensure that stakeholders have ample opportunities to provide input on  security technology development and testing priorities. With regard to our  fourth recommendation that TSA explore the feasibility of expanding the  security technology product information on the Public Transit Portal of  the Homeland Security Information Network, DHS reported that it expects  to expand both the scope and quality of security technology information  provided to stakeholders through the Public Transportation Information  Sharing and Analysis Center—which has a principal objective of aligning  and integrating analytical and information sharing activities with relevant  federal processes to enhance the information-sharing environment for the  mass transit and passenger rail community.  In comments related to our  fifth recommendation that TSA consider enhancing its criteria for  evaluating security training vendors under the Transit Security Grant  Program and consider coordinating with other federal agencies that have  developed such criteria, DHS stated that TSA will work with FTA through  an existing joint working group to develop criteria for reviewing new  vendor-provided training courses.  Lastly, with regard to our sixth  recommendation that DHS develop a plan with milestones for  implementing provisions of the 9/11 Commission Act related to mass  transit and passenger rail security, DHS reported that TSA will produce a  plan that identifies necessary actions and sets milestones to evaluate its  effectiveness in meeting statutory requirements associated with the 9/11  Commission Act.
DHS and Amtrak also provided us with technical comments, which we  considered and incorporated into the report where appropriate.
As agreed with your office, unless you publicly announce the contents of  this report, we plan no further distribution for 30 days from the report  date.  At that time, we will send copies of this report to the Secretary of  Homeland Security, the Secretary of Transportation, Amtrak, interested  congressional committees, and other interested parties.  The report will  also be available at no charge on the GAO Web site at http://www.gao.gov.
If you or your staff have any questions concerning this report, or wish to  discuss these matters further, please contact me at (202) 512-3404 or  berrickc@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  Key contributors to this report are listed in appendix IX.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of this report were to: (1) determine the extent that federal  and industry stakeholders assessed or supported assessments of the  security risks to mass transit and passenger rail since 2004, and how, if at  all, TSA used risk assessment information to inform and update its  security strategy; (2) describe key actions, if any, that federal and industry  stakeholders implemented or initiated, since 2004, to strengthen the  security of mass transit and passenger rail systems, the extent to which  federal actions were consistent with TSA’s security strategy, and what  challenges, if any, TSA faces in implementing these actions; and (3)  describe TSA’s reported status in implementing provisions of the  Implementing Recommendations of the 9/11 Commission Act of 2007  related to mass transit and passenger rail security, and discuss challenges,  if any, TSA and the mass transit and passenger rail industry face in  implementing the actions required by the act.
To determine the extent that federal and industry stakeholders have  assessed or supported assessments of the security risks to mass transit  and passenger rail since 2004, and how, if at all, TSA has used risk  assessment information to inform and update its security strategy, we  obtained and analyzed various reports that address some or all elements of  security risk (threat, vulnerability, and consequence) from DHS  component agencies, including TSA, the DHS Office of Infrastructure  Protection within the National Protection and Programs Directorate  (NPPD), and the Homeland Infrastructure Threat Reporting and Analysis  Center (HITRAC). We also reviewed information on risk-related  assessments conducted by federal agencies, including mass transit and  passenger rail security vulnerability assessments conducted by DOT’s  Federal Transit Administration (FTA), and a variety of federally developed  security risk assessment tools for the mass transit and passenger rail  industry.
Additionally, we reviewed TSA’s Baseline Assessment for Security  Enhancement (BASE) review checklist and fiscal year 2007 BASE report  of the results of BASE reviews that TSA conducted at 44 of the top 50  largest mass transit and passenger rail agencies—by ridership—as a  measure of TSA’s efforts to gather vulnerability information. We gathered  information on TSA’s consequence assessments through interviews with  Transportation Sector Network Management (TSNM) officials. We also  interviewed TSNM officials in order to assess how risk assessments were  informing TSA’s security strategy for mass transit and passenger rail and  then compared TSA’s actions to GAO and DHS reports on risk  assessment.  Because of the scope of our work, we relied on TSA to  identify its assessment activities but did not assess the extent to which its  assessment activities meet the National Infrastructure Protection Plan  criteria for threat, vulnerability, and consequence assessments.
To further assess risk assessment efforts, we interviewed federal officials  from DHS’s HITRAC, TSA’s Office of Intelligence, TSA’s Surface  Transportation Security Inspection Program, and, at DOT, FTA’s Office of  Safety and Security to understand what additional assessment information  or assistance on risk assessments was available to either TSA or the transit  agencies. Further, we interviewed security officials from Amtrak and 30  mass transit and passenger rail agencies across the nation. This sample  allowed us to meet with agencies of varying sizes and types to determine  their perspectives on federal and mass transit and passenger rail industry  risk assessment efforts to date (see objective 2 for how these agencies and  cities were selected).
Additionally, we reviewed TSA’s strategic planning document—the Mass  Transit Modal Annex to the Transportation System - Sector Specific Plan  (TS-SSP) issued in May 2007—and identified federal guidelines for  developing a risk-based security strategy. Specifically, to determine the  extent to which TSA’s strategy conformed to requirements and best  practices, we reviewed relevant statutory requirements of the Government  Performance and Results Act of 1993 (GPRA) that included general  requirements that are applicable in the establishment of government  strategies and programs, and the Implementing Recommendations of the  9/11 Commission Act of 2007, which included requirements for  establishing a security strategy. For example, we reviewed existing  Executive Directives, including Homeland Security Presidential Directives  1, 7, and 8, and Executive Order 13416: Strengthening Surface  Transportation Security to determine the extent to which TSA’s Mass  Transit Modal Annex conformed to these requirements. We also analyzed  executive guidance documents outlining best practices for effectively  implementing a risk management framework, and in particular, risk  assessment best practices, including both the DHS National Infrastructure  Protection Plan (NIPP) and the TS-SSP. We also reviewed GAO best  practice criteria for developing a successful national strategy and  compared the Mass Transit Modal Annex against it. Finally, to identify the  extent to which TSA is measuring its performance in implementing its  mass transit and passenger rail security programs, we reviewed DHS and  TSA documents, including the Modal Annex, DHS Critical Infrastructure  and Key Resources Annual Reports, and Surface Transportation  Regulatory Activities Plan, as well as the Office of Management and  Budget’s Program Assessment Rating Tool (PART), which assessed the  adequacy and effectiveness of these program measures.
To identify and describe the key actions federal and industry stakeholders  have implemented or initiated since 2004 to strengthen the security of  mass transit and passenger rail systems, the extent to which federal  actions are consistent with TSA’s security strategy, and the challenges, if  any, that TSA has faced in making these actions effective, we interviewed  officials from DHS and DOT. From DHS, we interviewed officials from  TSA’s Surface Transportation Security Inspection Program within the  Office of Security Operations, TSA’s Office of Security Technology, and,  within TSA’s Office of Law Enforcement, the Federal Air Marshal Service  (which plays a lead role in implementing VIPR Operations). We also  interviewed officials from DHS’s Science and Technology Directorate and  Federal Emergency Management Agency’s Grants Programs Directorate.  Within DOT, we interviewed officials from FTA’s Office of Safety and  Security and also the Federal Railroad Administration. We also  interviewed officials from the three federally sponsored mass transit  employee training providers—the National Transit Institute,  Transportation Safety Institute, and Johns Hopkins University—to obtain  information on training they offered to mass transit and passenger rail  employees and their perspectives on TSA’s Mass Transit Security Training  Program.
To obtain information on industry security actions and perspectives on  federal mass transit and passenger rail security actions, we conducted site  visits at, or held teleconferences with, officials representing 30 mass  transit and passenger rail systems across the nation—representing 75  percent of the nation’s total mass transit and passenger rail ridership— based on information we obtained from the Federal Transit  Administration’s National Transit Database and the American Public  Transportation Association (APTA).  We selected this non-probability  sample of mass transit and passenger rail systems and cities because of  their high levels of ridership, geographic dispersion, experience with TSA  security assessments, eligibility for grant funding, and expert  recommendation. Because we selected a non-probability sample of mass  transit and passenger rail agencies, the information obtained from these  site visits cannot be generalized to all transit agencies nationwide.  However, we determined that the selection of these sites was appropriate  for our design and objectives and that the selection would provide valid  and reliable evidence. The information we obtained provided us with a  broad overview of the types of actions taken to strengthen security. Table  1 lists the mass transit and passenger rail systems we interviewed.
We also interviewed Amtrak headquarters officials and visited three  Amtrak station locations in the Northeast Corridor. During site visits to  mass transit and passenger rail agencies, we interviewed security officials,  toured stations and other facilities such as control centers, and observed  security practices. Further, we interviewed TSA surface transportation  security inspectors from the 13 field offices responsible for overseeing the  passenger rail and mass transit systems we visited, and in one case,  observed the inspectors conduct a BASE review of a mass transit system.  We also interviewed state officials with homeland security responsibilities,  representatives of the American Public Transportation Association, and  where applicable, regional transportation authority officials. To determine  the extent to which federal and industry actions were consistent with  TSA’s security strategy, we reviewed TSA and FTA documentation  describing ongoing programs and compared them with the strategic  objectives, programs, and actions TSA described in its Mass Transit Modal  Annex.
To further assess federal and industry actions, and identify potential  challenges, we reviewed DHS and DOT documents relevant to federal and  industry stakeholder actions to secure passenger rail and mass transit  systems. For example, we reviewed program documentation for TSA’s  Mass Transit Security Training Program, as well as FTA’s 2009 Final Draft  of Training Curriculum Development Guidelines and federal transit  employee training curricula. We also reviewed TSA’s Surface  Transportation Security Inspection Program Standard Operating  Procedures, strategic and annual plans, and documentation of completed  mass transit and passenger rail security assessments. We also reviewed  TSA’s Concept of Operations (CONOPS) for its Visible Intermodal  Prevention and Response (VIPR) program—TSA’s program for deploying  security personnel to augment security on mass transit and passenger rail  systems—to identify guidelines TSA has established for implementing the  program. We then obtained a list of VIPR operations, by location and date,  that TSA reported conducting in mass transit and passenger rail systems  immediately following its issuance of the CONOPS in October 2007. We  obtained and matched this list with information found in electronic copies  of all TSA VIPR operation plan after-action reports (AAR)—describing the  results and challenges encountered during VIPR operations that TSA  conducted at mass transit and passenger rail systems from November 2007  through July 2008. We chose to review after-action reports for this period  to determine the impact of guidance TSA issued in October  2007, to  improve its implementation of the VIPR program. Both the initial list and  after-action reports identified 108 VIPR operations; however, we reviewed  104 of these. Two analysts independently coded the challenges noted on  each of the reports.  They discussed differences until agreement could be  reached on the most appropriate challenge category. We also conducted a  site visit to the Transportation Security Operations Center to interview  officials with TSA’s Federal Air Marshal Service within the Office of Law  Enforcement—which manages the VIPR program—to discuss the  challenges identified in the after-action reports. We also obtained access  to, and reviewed, the DHS Homeland Security Information Network - Public Transit Portal secure Web communication system to identify the  type and extent of security technology information that TSA had made  available to industry users of the system, and identified and reviewed best  practices applicable to R&D programs identified by leading research  organizations, such as the National Research Council of the National  Academy of Sciences, in order to establish criteria for evaluating federal  and industry coordination in research and development efforts. We also  reviewed two DHS-IG reports and found the quality of the methods used to  develop these reports sufficient for use as a source in this report.
For the final objective, to determine the status of TSA’s implementation of  9/11 Commission Act requirements for mass transit and passenger rail, and  challenges, if any, that TSA and the mass transit and passenger rail  industry face in meeting these requirements, we reviewed the 9/11  Commission Act to identify DHS and industry requirements related to  mass transit and passenger rail security. We also reviewed TSA status  reports outlining the agency’s reported status in satisfying various 9/11  Commission Act provisions related to mass transit and passenger rail  security. However, we did not verify the accuracy of TSA’s reported status  in implementing these 9/11 Commission Act requirements. To identify  potential challenges TSA and the mass transit and passenger rail industry  may face in implementing various 9/11 Commission Act requirements, we  interviewed TSA headquarters officials from the Transportation Security  Network Management—Mass Transit division, including the Deputy  General Manager, and officials from TSA’s Surface Transportation Security  Inspection Program, including the headquarters based Program Chief, and  Surface Transportation Security Inspectors from 13 of 54 field offices,  including 11 of 12 Assistant Federal Security Directors for Surface. We  also reviewed TSA program documents relating to its inspection program  including strategic and annual inspection plans, standard operating  procedures, and memorandums and directives documenting organizational  and staffing plans. Moreover, to obtain information on industry  perspectives of potential challenges, we interviewed officials from 30 mass  transit and passenger rail systems and Amtrak as well as APTA. In  addition, we obtained and reviewed various reports which discuss the  federal or industry role in implementing the 9/11 Commission Act,  including recent reports issued by the DHS-IG, Congressional Research  Service, and a January 2008 report prepared by six Assistant Federal  Security Directors for Surface.
We conducted this performance audit from September 2007 through June  2009 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: TSA/FTA Security and Emergency Management Action Items
paragraphs: The following list of voluntary Security and Emergency Management  Action Items is an update to the Federal Transit Administration's Top 20  Security Program Action Items originally released in January 2003. The  update has been developed by FTA and the Department of Homeland  Security's Transportation Security Administration and Office of Grants &  Training in consultation with the public transportation industry through  the Mass Transit Sector Coordinating Council, for which the American  Public Transportation Association serves as Executive Secretary. The  updated action items address current security threats and risks that  confront transit agencies, with particular emphasis on priority areas where  gaps need to be closed in security and emergency preparedness programs.  Though this update consolidates the previous 20 items into 17, the  purpose, scope, and objectives remain consistent.
subsections: section_title: Management and Accountability
paragraphs: 1.  Establish written security plans and emergency management  plans.  2.  Define roles and responsibilities for security and emergency  management.  3.  Ensure that operations and maintenance supervisors, forepersons,  and managers are held responsible for security issues under their  control.  4.  Coordinate security and emergency management plan(s) with  local and regional agencies.
section_title: Security and Emergency Response Training
paragraphs: 5.  Establish and maintain a security and emergency training  program.
section_title: Homeland Security Advisory System
paragraphs: 6.  Establish plans and protocols to respond to the DHS Homeland  Security Advisory System threat levels.
section_title: Public Awareness
paragraphs: 7.  Implement and reinforce a Public Security and Emergency  Awareness Program.
section_title: Drills and Exercises
paragraphs: 8.  Conduct tabletop and functional drills.
section_title: Risk Management and Information Sharing
paragraphs: 9.  Establish and use a risk management process to assess and  manage threats, vulnerabilities and consequences.  10. Participate in an information sharing process for threat and  intelligence information.  11. Establish and use a reporting process for suspicious activity  (internal and external).
section_title: Facility Security and Access Controls
paragraphs: 12. Control access to security critical facilities with ID badges for all  visitors, employees, and contractors.  13. Conduct physical security inspections.
section_title: Background Investigations
paragraphs: 14. Conduct background investigations of employees and contractors.
section_title: Document Control
paragraphs: 15. Control access to documents of security critical systems and  facilities.  16. Ensure existence of a process for handling and access to Sensitive  Security Information (SSI).
section_title: Security Audits
paragraphs: 17. Conduct security program audits.
section_title: Appendix III: Identifying Characteristics of Successful National Strategies in the Context of Mass Transit and Passenger Rail Security
paragraphs: To help the federal government develop sound national strategies, we have  previously identified six desirable characteristics of successful national  strategies, including (1) purpose, scope, and methodology of the strategy;  (2) risk assessment; (3) goals, subordinate objectives, activities, and  performance measures; (4)  resources and investments; (5) organizational  roles, responsibilities, and coordination; (6) integration and  implementation. We discussed four of these characteristics in the body of  the report, and below we discuss the other two characteristics. Where  applicable, we link relevant sections of Executive Order 13416 to highlight  the importance of these measures to strengthen the passenger rail and  mass transit security national strategy.
subsections: section_title: Purpose, Scope, and Methodology
paragraphs: This characteristic addresses why the strategy was produced, the scope of  its coverage, and the process by which it was developed. For example, a  strategy might discuss the specific impetus that led to its creation, such as  statutory requirements, executive mandates, or other events—such as  terrorist attacks. In addition to describing what the strategy is meant to do  and the major functions, mission areas, or activities it covers, a national  strategy would ideally also outline its methodology. For example, a  strategy might discuss the principles or theories that guided its  development, what organizations or offices drafted the document, whether  it was the result of a working group, or which parties were consulted in its  development.
TSA’s Mass Transit Modal Annex identifies the purpose and scope of the  Modal Annex and references several principle documents used to develop  the Modal Annex—including the Presidential Executive Order 13416:  Strengthening Surface Transportation Security, the Transportation  System- Sector Specific Plan (TS-SSP), and the National Infrastructure  Protection Plan.  It also describes the process or methodology that was  used and who developed the Annex.   For example, the Modal Annex  states that TSA’s vision is to provide a secure, resilient transit system that  leverages public awareness, technology, and layered security programs  while maintaining the efficient flow of passengers and encouraging the  expanded use of the nation’s transit services.  The Modal Annex also  discusses the scope and type of various federal and industry mass transit  and passenger rail security efforts and aligns them with three broad DHS  security goals for the transportation sector, as outlined in the TS-SSP. In  addition, the Modal Annex references the National Infrastructure  Protection Plan as a source for developing security programs for mass  transit and passenger rail systems, and it also discusses several domestic  and international terrorist attacks that have occurred as evidence of the  various security risks to the mass transit and passenger rail systems.   Furthermore, the Modal Annex explains the methodology used in its  development, as called for in our prior work on characteristics of a  national strategy.
In addition to referencing the National Infrastructure Protection Plan and  the TS-SSP as literatures providing the principles or theories that guided  the development of the Modal Annex, the Modal Annex also describes the  process and information that were used to develop the strategy and  identified entities that contributed to its development.  For example, the  strategy describes how mass transit and passenger rail security programs  and initiatives are developed and implemented and how they are aligned  with the overall transportation sector goals and objectives and mass  transit and passenger rail modal strategies and objectives.  Also, the Modal  Annex identifies the Transit, Commuter and Long Distance Rail  Government Coordinating Council (TCLDR-GCC), the Mass Transit Sector  Coordinating Council (SCC), the Critical Infrastructure Partnership  Advisory Council, and TSA’s Mass Transit Division as entities involved in  developing the transportation security strategic policy.
subsections: section_title: Integration and implementation
paragraphs: This characteristic addresses both how a national strategy relates to other  strategies’ goals, objectives, and activities and to subordinate levels of  government and their plans to implement the strategy. For example, a  national strategy could discuss how its scope complements, expands  upon, or overlaps with other national strategies, such as DHS efforts to  mitigate transportation risks. Also, related strategies could highlight their  common or shared goals, subordinate objectives, and activities. Similarly,  the Executive Order requires that the Modal Annex identify existing  security guidelines and requirements. To meet these requirements and  because protecting the mass transit and passenger rail systems is a shared  responsibility among many stakeholders, the Modal Annex could identify  regulations and programs that affect the security of the mass transit and  passenger rail systems.  In addition, a strategy could address its  relationship to other agency strategies using relevant documents from  implementing organizations, such as strategic plans, annual performance  plans, or annual performance reports that GPRA requires of federal  agencies. A strategy might also discuss, as appropriate, various strategies  and plans produced by the state, local, or private sectors and could  provide guidance such as the development of national standards to more  effectively link together the roles, responsibilities, and capabilities of the  implementing parties.
TSA’s Modal Annex delineates mechanisms to facilitate stakeholders  coordination, specifically the TCLDR-GCC and the Mass Transit SCC,  discusses other relevant industry security plans, and identifies regulations  and programs such as the regulation on designating a rail security  coordinator and security programs related to public awareness and  training that affect the security of the mass transit and passenger rail  systems.  The Modal Annex also addresses its relationship with strategic  documents or activities of other federal agencies that have a role in mass  transit and passenger rail security, such as those that guide FTA, which  has a supporting role along with TSA for protecting mass transit and  passenger rail systems. For example, the Modal Annex mentions how  FTA’s activities, such as the State Safety Oversight Agencies audit program  and FTA’s Section 5307 grant program fit into TSA’s overall strategy for  securing mass transit and passenger rail systems.   The Modal Annex also  mentions DHS-DOT collaborative efforts through their memorandum of  understanding such as the development of public transportation annex  delineating areas of coordination to assist transit agencies in prioritizing  and addressing security related needs.  In addition, the Modal Annex  points out how it relates to the National Strategy for Transportation  Security required by the Intelligence Reform and Terrorism Prevention Act  of 2004.  For example, it explains how TSA’s effort in building security  force multipliers through security training for front-line employees of mass  transit and passenger rail systems directly supports the National Priorities,  the National Preparedness Goal, and the National Strategy for  Transportation Security.  By providing such information, the agency is  identifying linkages with other developed strategies and other  organizational roles and responsibilities.
section_title: Appendix IV: Federal Actions Taken to Enhance Mass Transit and Passenger Rail Security since 2004
paragraphs: This appendix expands on the list of key actions identified in the body of  the report in table 5. This table presents a more comprehensive list of  federal actions taken to enhance mass transit and passenger rail security  since 2004.
section_title: Appendix VII: Comments from Amtrak
section_title: Appendix VIII: Comments from the Department of Homeland Security
section_title: Appendix IX: GAO Contacts and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Dawn Hoff, Assistant Director,  and Daniel Klabunde, Analyst-in-Charge, managed this assignment.          Jay Berman, Martene Bryan, Charlotte Gamble, and Su Jin Yon made  significant contributions to the work. Chuck Bausell and Rudy Chatlos,  assisted with design, methodology, and data analysis. Lara Kaskie and  Linda Miller provided assistance in report preparation; and Tracey King  provided legal support.