Passenger Rail Security: Consistent Incident Reporting and Analysis Needed to Achieve Program Objectives
Released: 2012-12-19T00:00:00

Letter

Background

As previously stated, TSA’s 2008 regulation requires passenger rail agencies to report potential threats and significant security concerns to the TSOC. According to the regulation, potential threats and significant security concerns (rail security incidents) include, but are not limited to, the following: 1) interference with the train or transit vehicle crew; 2) bomb threats, specific and non-specific; 3) reports or discovery of suspicious items that result in the disruption of rail operations; 4) suspicious activity occurring onboard a train or transit vehicle or inside the facility of a passenger railroad carrier or rail transit system that results in a disruption of rail operations; 5) suspicious activity observed at or around rail cars or transit vehicles, facilities, or infrastructure used in the operation of the passenger railroad carrier or rail transit system; 6) discharge, discovery, or seizure of a firearm or other deadly weapon on a train or transit vehicle or in a station, terminal, facility, or storage yard, or other location used in the operation of the passenger railroad carrier or rail transit system; 7) indications of tampering with passenger rail cars or rail transit vehicles; 8) information relating to the possible surveillance of a passenger train or rail transit vehicle or facility, storage yard, or other location used in the operation of the passenger railroad carrier or rail transit system; 9) correspondence received by the passenger railroad carrier or rail transit system indicating a potential threat to rail transportation; and 10) other incidents involving breaches of the security of the passenger railroad carrier or the rail transit system operations or facilities.

The regulation also authorizes TSA officials to view, inspect, and copy rail agencies’ records as necessary to enforce the rail security incident reporting requirements. This regulatory authority is supported by TSA policies and guidance, including the Transportation Security Inspector Inspections Handbook, the National Investigations and Enforcement Manual, and the Compliance Work Plan for Transportation Security Inspectors.

Within TSA, different offices have responsibilities related to implementing and enforcing the rail security incident reporting requirement. The TSOC, managed by TSA’s Office of Law Enforcement/Federal Air Marshal Service, is the TSA entity primarily responsible for collecting and disseminating information about rail security incidents. Once notified of a rail security incident, TSOC officials are responsible for inputting the incident information into their incident management database known as WebEOC, and for disseminating incident reports that they deem high priority or significant to select TSA officials; other federal, state, and local government officials; and select rail agencies’ law enforcement officials. TSA’s Office of Intelligence and Analysis is responsible for analyzing threat information for all modes of transportation, including information related to passenger rail. TSA’s Office of Security Policy and Industry Engagement is responsible for using incident reports and analyses, among other things, to develop strategies, policies, and programs for rail security, including operational security activities, training exercises, public awareness, and technology. Figure 1 shows the intended steps and responsibilities of TSA components involved in the rail security incident reporting process.

TSA’s Office of Security Operations is responsible for overseeing and enforcing the incident reporting requirement. Responsible for managing TSA’s inspection program for the aviation and surface modes of transportation, the Office of Security Operations’ Surface Compliance Branch deploys approximately 400 transportation security inspectors- surface (TSI-S) nationwide.clarification to rail agencies regarding the incident reporting process highlighted in figure 1, and for overseeing rail agencies’ compliance with the reporting requirement by conducting inspections to ensure that incidents were properly reported to the TSOC. TSI-Ss also conduct assessments of surface transportation systems, including passenger rail systems, and oversee compliance with other applicable transportation security policies, directives, standards, and agreements. At the headquarters level within the Office of Security Operations, the Compliance Programs Division is responsible for assisting TSA management and surface inspection officials in the field by providing guidance and subject matter expertise in ensuring compliance by The TSI-Ss are responsible for providing regulated entities with security requirements. Six regional security inspectors-surface (RSI-S) within the Compliance Programs Division are responsible for providing national oversight of local surface inspection, assessment, and operational activities.

TSA Has Provided Inconsistent Oversight and Enforcement of the Passenger Rail Security Incident Reporting Requirement

TSA has not provided consistent oversight of the implementation of the passenger rail security reporting requirement, leading to considerable variation in the types and number of rail security incidents reported. This variation is compounded by inconsistency in compliance inspections and enforcement actions, due in part to limited utilization of oversight mechanisms at the headquarters level.

Variation in Implementation of the Reporting Requirement

Since the rail security incident reporting regulation went into effect in December 2008, local TSA inspection officials, who are the primary TSA points of contact for rail agencies, have not received clarifying guidance from TSA headquarters regarding how rail agencies should implement the reporting regulation. Although the regulation identifies 10 broad types of rail security incidents that must be reported to the TSOC, 7 of the 19 rail agencies we spoke with noted that there are several grey areas within these incident types that can be open to interpretation. In the absence of clarifying guidance from TSA headquarters, local TSA inspection officials have provided rail agencies with inconsistent interpretations of the regulation’s reporting requirements. Some variation is expected in the number of rail security incidents that rail agencies reported because of differences in agency size, geographic location, and ridership. For example, we analyzed incident data for 7 of the 19 rail agencies included in our review, and found that the number of incidents reported per million riders ranged from 0.25 to 23.15. Inconsistent interpretation of the regulation by local TSA inspection officials has contributed to this variation. For example, officials from one rail agency we spoke with had been told by their local TSA inspection officials that they were required to report all instances in which a person was hit by a train, because an individual cannot be struck by a train in the right of way without trespassing or breaching security. In contrast, officials from another rail agency told us that their agency does not report all of these incidents because they are most often intentional suicides that are unrelated to terrorism. The local TSA inspection officials responsible for this agency agreed with this interpretation, noting that suicides generally have no nexus to terrorism.

Similarly, rail agencies may have received inconsistent feedback from their local TSA inspection officials about reporting incidents involving weapons. The regulation requires that rail agencies report incidents that involve the “discharge, discovery, or seizure of a firearm or other deadly weapon on a train or transit vehicle or in a station, terminal, facility, or storage yard, or other location used in the operation of the passenger railroad carrier or rail transit system.” However, officials from one rail agency stated that if an individual is stopped for fare evasion and is subsequently found to be in possession of an illegal firearm, they would not report the incident to the TSOC because it is a local criminal incident unrelated to terrorism. These officials explained that they would report only incidents that could have a nexus to terrorism, in part because reporting incidents that are unrelated to terrorism could reduce the quality of the data TSA collects. The local TSA inspection officials responsible for this agency have never found it to be in noncompliance for not reporting a weapon, tacitly approving of the agency’s interpretation of the regulation. In contrast, officials at another rail agency said that they report all incidents related to weapons—regardless of their possible nexus to terrorism—because their local TSA inspection officials have instructed them that any firearm found in the system has to be reported. However, these officials stated that because of local gun laws, handguns are seized during the course of routine law enforcement activities, and are generally incidental to the original criminal offense. While they do report these local criminal incidents to the TSOC as directed by their local TSA inspection officials, the rail agency officials stated that it is unclear to them why it is necessary to do so if they have no nexus to terrorism. Clarification about which incidents should be reported could help address the confusion among rail agencies, and improve consistency in incident reporting.

Before the final rule was issued in November 2008, rail stakeholders raised concerns about the types of incidents required to be reported in commenting on the notice of proposed rulemaking. Specifically, some rail stakeholders noted when commenting on the proposed rule that the regulation’s definition of reportable events was too broad and would result in an overload of information that would divert attention from truly significant threats and dilute the effectiveness of the reporting system. Rail stakeholders requested that TSA clarify the reporting requirements, but in the preamble to the final rule, TSA stated that the agency would not further define or limit the scope of the reporting requirement, because doing so would reduce the data that TSA received, which could be used for broader trend analyses in order to anticipate or prevent an attack. TSA has maintained this position, and as a result, has not developed clarifying guidance at the headquarters level regarding the reporting requirement.

However, local TSA inspection officials, headquarters level compliance officials, and rail agency officials that we interviewed stated that additional written guidance could help ensure that the regulation is implemented more consistently. According to Standards for Internal Control in the Federal Government, information should be communicated in a way that allows officials to carry out their responsibilities. In October 2011, we also reported that providing officials with guidance that contains specific criteria and definitions would provide greater assurance that decisions are made consistently. For the aviation mode, TSA has established written guidance for reporting security incidents. TSA’s operational directive for reporting aviation security incidents includes attachments that, among other things, identify the types of incidents that are to be reported, based on the immediate security threat of different types of incidents. With regard to passenger rail, however, TSA has maintained the agency’s position as detailed in the preamble to the final rule, as described above, and has not taken actions to develop clarifying guidance regarding the types of incidents that should be reported under the regulation. Providing similar guidance to local TSA inspection officials responsible for rail agencies could help to ensure that these officials are interpreting the regulation consistently across different field offices. These actions could also better position TSA to consistently collect rail security incident information, which may facilitate its efforts to conduct trend analysis and also help TSA to “connect the dots” to identify potential threats to passenger rail systems.

Inconsistent Compliance and Enforcement

TSA monitors passenger rail agency compliance with incident reporting requirements through compliance inspections and related enforcement activities at the local level, but TSA has not utilized its limited oversight mechanisms at the headquarters level as intended for ensuring consistency in these activities. Local TSA inspection officials conduct inspections of rail agencies to ensure compliance with the incident reporting requirement—that is, to ensure that rail agencies are properly reporting significant security concerns to the TSOC. In addition to monitoring compliance, inspections offer local TSA officials opportunities to provide rail agencies with feedback regarding their implementation of the regulation. TSA inspection officials also may take enforcement action against a rail agency that TSA finds to be not in compliance. Within TSA headquarters, the Compliance Programs Division within the Office of Security Operations is responsible for ensuring consistency in the application of all regulatory priorities that are to be implemented by the field and for monitoring and overseeing operational and field activities intended to support TSA’s national rail security programs and objectives.

Our analysis of TSA’s inspection data from January 1, 2011, through June 30, 2012, shows that the frequency of local TSA inspections of compliance with the reporting regulation varies among rail agencies. TSA’s rail security inspection policies and guidance do not specify how often inspections should be conducted, instead recommending that inspections be driven by reportable events, with local discretion used to ensure a reasonable number of inspections are performed. According to senior TSA compliance officials, this means that inspections can be initiated in response to a particular incident that local TSA officials become aware of, as opposed to being scheduled at regular intervals. According to PARIS data, from January 1, 2011, through June 30, 2012, of the 19 rail agencies we spoke with, 7 agencies had been inspected at least 18 times, or an average of once per month. However, 3 agencies had not been inspected, including a large metropolitan rail agency. Information in the text box below provides an example of this rail agency’s experience with TSA compliance activities. Average monthly inspections for this time period ranged from about eight inspections to no inspections, and there was also variation in the regularity with which inspections occur. For example, although 1 agency was inspected 4 times during the time period we reviewed, 3 of these inspections were conducted on the same day. In contrast, another agency was inspected a total of 11 times, with each inspection occurring in a different month.

TSA Had Not Inspected a Major Rail Agency On the basis of our review of the TSOC’s database, we found that one major rail agency had not reported any incidents to the TSOC from January 1, 2011 through June 30, 2012. According to officials from this rail agency, the agency did not report any incidents because the rail agency had not clearly identified who in the agency was responsible for reporting incidents to the TSOC. Further, the local TSA inspectors responsible for this rail system had not conducted any compliance inspections to determine whether the system was meeting its requirement to report rail security incidents, according to PARIS inspection records. The regulation requires rail agencies to allow TSA inspectors to conduct inspections, copy records, and perform tests to ensure that rail agencies are meeting their rail security incident reporting responsibilities. Local TSA inspection officials told us, however, they did not have sufficient access to the rail agency’s police records and personnel to complete these inspection activities and therefore were unable to determine whether rail security incidents have actually occurred in the system. Given the passenger volume of this rail system, the local TSA officials stated that it was highly unlikely that no rail security incidents had occurred. According to local news sources, several security incidents had occurred on the system during 2011 that, according to the regulation, should have been reported to the TSOC. For example, an Internet search we conducted in September 2012 indicated that in 2011, local news reported on a suspicious item found in one of the rail system’s stations that resulted in a delay of service. Local TSA inspection officials stated that they did not pursue enforcement action against the rail system for incidents that should have been reported, nor did they request assistance from TSA’s Surface Compliance Branch in obtaining access to the rail system’s incident documentation. These local TSA inspection officials also explained that they are working on improving their relationship with the rail agency and their access to the agency’s incident records.

TSA’s policies also describe a variety of activities that may constitute an inspection. According to senior TSA compliance officials, these broad policies on how to conduct inspections contribute to inconsistent approaches across TSA field offices. For example, according to TSA policy, inspections could range from a phone call to the rail agency to inquire whether the agency reported a specific incident to more rigorous, regularly scheduled, on-site inspections of rail agencies’ internal incident management systems. However, for an inspection official to inquire about whether an agency reported a specific incident by phone, that official must first become aware of the incident through other means, such as a media report, whereas on-site inspections could allow TSA inspection officials to identify incidents that did not result in media reports, but should have been reported to the TSOC under the regulation. Further, senior TSA compliance officials told us that some local TSA inspectors may be hesitant to conduct regular on-site inspections or find rail agencies not in compliance for incident reporting because doing so could make rail agencies less willing to participate in other important voluntary security activities, such as TSA’s Baseline Assessment for Security Enhancement (BASE) and the TSA-led Visible Intermodal Prevention and Response Program. However, variations in the rigor and frequency of inspections highlight the need for enhanced oversight of these activities at the headquarters level to help ensure that rail agencies are reporting security incidents as required by the regulation.

In addition, TSA has inconsistently applied enforcement actions against rail agencies for not complying with the regulation. TSA’s progressive enforcement policy includes the following steps, in order of severity, following a finding of not in compliance: (1) on-the-spot counseling, (2) administrative action—notice of noncompliance, and (3) civil penalty action.compliance that resulted in on-the-spot counseling or a notice of noncompliance for failing to report certain types of incidents that other agencies may not report as a matter of standard practice, such as weapons discovered during the course of routine criminal activity. For example, one rail agency received a notice of noncompliance for failing to report an incident involving a knife that was discovered in an individual’s possession after law enforcement officials intervened in a verbal altercation on a train. In contrast, as discussed above, officials from another rail agency said that they would not report routine criminal incidents involving weapons, including firearms and other deadly weapons such as knives, and had discussed this policy with their local TSA inspection officials. While the agency had been inspected, the local TSA officials had never issued a finding of noncompliance related to not reporting incidents involving weapons. TSA inspection officials have also taken an enforcement action against a rail agency for failing to report an incident that was not required to be reported. Specifically, one rail agency received a notice of noncompliance for failing to report a suspicious item discovered in the public area of one of its bus garages. However, according to a senior TSA compliance official, rail agencies are not required to report incidents involving buses or bus facilities, and therefore TSA officials should not take enforcement actions against rail agencies for failing to report bus incidents.

In some cases, rail agencies have received a finding of not in According to senior TSA compliance officials, inconsistent inspection and enforcement actions occur, in part because TSA has limited oversight mechanisms at the headquarters level, and has not utilized them as intended to monitor or oversee the rail security compliance and inspection activities in the field. Standards for Internal Control in the Federal Government provides that internal controls should be designed to ensure that ongoing monitoring occurs in the course of normal operations. TSA established the regional security inspector-surface (RSI-S) position as a primary oversight mechanism at the headquarters level for monitoring compliance inspections and enforcement actions to help ensure consistency across field offices. However, according to TSA officials, the RSI-S is not part of the formal inspection process and has no authority to ensure that inspections are conducted consistently. The RSI-S also has limited visibility over when and where inspections are completed or enforcement actions are taken because TSA lacks a process to systematically provide the RSI-S with this information during the course of normal operations. As a result, TSA has limited assurance that the RSI-S will be able to provide oversight of local passenger rail inspection and enforcement activities. For example, with regard to the situation discussed in the text box above, the RSI-S responsible for that rail agency was not aware that the agency had not reported any incidents to the TSOC and had never been inspected by the local TSA inspection officials. The text box below provides another example of the challenges that TSA faces in ensuring consistency across local TSA offices.

TSA Efforts to Streamline Amtrak’s Compliance Activities Face Challenges In 2010, Amtrak worked with an RSI-S to streamline the reporting and inspection process, but TSA has faced challenges implementing this process across all its field offices. As the only nationwide passenger rail agency, Amtrak has been regularly inspected by multiple TSA field offices in locations that Amtrak services. According to Amtrak and TSA officials, these inspections are duplicative and cause confusion because incidents may be inspected for compliance by multiple TSA field offices, each with potentially different interpretations of the regulatory requirement. For example, one local TSA office found Amtrak to be not-in-compliance for not reporting an incident that another TSA office had told Amtrak did not need to be reported. To ensure that that the regulation was being applied consistently throughout its operations, Amtrak notified the RSI-S of these inconsistencies between different field offices, and worked with the RSI-S to establish a centralized incident reporting and inspection process. Under this new process, according to Amtrak and TSA officials, all rail security incidents occurring on Amtrak nationwide should be reported to TSOC by Amtrak’s National Communications Center in Philadelphia, Pennsylvania, rather than by the local Amtrak officials where the incident occurred. In addition, according to Amtrak and TSA officials, all TSA compliance inspections should be conducted by the local TSA field office in Philadelphia. According to these officials, the centralized reporting and inspection process has been implemented effectively by the Philadelphia field office. Specifically, between one and three times per month, a TSA official from the Philadelphia office checks compliance by randomly selecting security incidents from Amtrak’s centralized incident monitoring system to determine whether they have been properly reported to the TSOC. However, although Amtrak and the RSI-S have implemented this reporting approach with the Philadelphia TSA office, other local TSA offices have continued to conduct compliance inspections of Amtrak. According to PARIS data, from January 2011 through July 2012, Amtrak was inspected 145 times. Of these, 116 were carried out by local TSA offices other than the Philadelphia office. According to senior TSA compliance officials, TSA headquarters has not taken actions to ensure that other field offices adhere to this centralized inspection approach, and TSA’s mechanisms to monitor or oversee the rail security compliance and inspection activities in the field are limited.

In the absence of a process to systematically monitor the inspection and enforcement activities of TSA field offices, it is unlikely that the RSI-Ss or compliance officials at the headquarters level would become aware of inconsistencies in compliance and enforcement activities in the field, unless the inconsistencies were specifically brought to their attention. However, even when compliance officials have become aware of issues related to inconsistent application of compliance or enforcement measures in the field, according to senior TSA compliance officials, no action has been taken by the Office of Security Operations at the headquarters level to ensure consistency among field offices. TSA inspection and compliance officials agreed that TSA could take steps to ensure more consistent application of compliance inspections and enforcement actions among TSA surface inspectors. By enhancing the existing oversight mechanisms at the headquarters level to systematically monitor and oversee compliance inspections and enforcement actions, as intended, TSA could improve its visibility over activities in the field, helping to ensure that local TSA inspection officials are consistently overseeing the regulatory reporting requirement. Such actions could further reduce inconsistency in the number and type of incidents that rail agencies report to the TSOC, which could improve TSA’s ability to use the incident information for trend analysis to identify potential threats, as discussed below.

Incident Data and Process Limitations Hinder Trend Analysis

TSA’s incident management data system, known as WebEOC, has incomplete information, is prone to data entry errors, and has other limitations which inhibit TSA’s ability to search and extract basic information. These weaknesses in WebEOC hinder TSA’s ability to use rail security incident data to identify security trends or potential threats. In addition to these data weaknesses, TSA has conducted limited analysis of rail security incident information, in part because TSA does not have a systematic process for identifying trends or patterns in rail security incident information.

Incomplete Information

When TSA learns about an incident that may not have been properly reported to the TSOC (through a compliance inspection or other means), there is no established process to ensure that WebEOC is updated to include that incident. As a result, WebEOC has incomplete incident information, which hinders TSA’s ability to identify security trends and patterns. For example, over the course of 19 months, five similar incidents involving a suspicious item occurred in different stations of one rail agency. Although the rail agency did not report these incidents to the TSOC, the rail agency’s internal intelligence group recognized a pattern, and developed an intelligence brief that it then disseminated to relevant rail stakeholders, including TSA. Upon receipt of this intelligence brief, local TSA inspection officials responsible for this rail agency issued a notice of noncompliance to the agency for not reporting two incidents highlighted in the brief. In this case, the local TSA inspection official responsible for the agency reported these two incidents to the TSOC, but did not subsequently report the other three related incidents for inclusion in WebEOC. Similarly, of the 18 findings of noncompliance that were a result of failure to report an incident, 13 were not subsequently reported to the TSOC. Because TSA has no established process to help ensure TSA inspection officials or rail agencies notify the TSOC or update WebEOC with incident information that was not properly reported, WebEOC does not contain a record of these unreported rail security incidents. Standards for Internal Control in the Federal Government calls for agencies to take actions to help ensure that data are complete and accurate. Developing a process for ensuring the inclusion of incidents discovered during compliance inspections that were not immediately reported to the TSOC could provide TSA with a more comprehensive picture of security incidents to better position it to identify any trends or patterns.

Data Entry Errors and Limitations

In addition, we identified data entry errors and limitations in WebEOC, which inhibit TSA’s ability to search and extract certain information. Further, the guidance provided to officials responsible for entering incident information does not help prevent these errors because it allows for variation in the WebEOC data and assumes that the official responsible for entering the data fully understands the data entry options. As a result, the TSOC could not provide us with certain information about the rail security incident data, such as the number of incidents reported by incident type (e.g., suspicious item or bomb threat) or the total number of rail security incidents that have been reported to the TSOC. Without the ability to identify this information on the number of incidents by type or the total number of incidents, TSA faces challenges determining if patterns or trends exist in the data, as the reporting system is intended to do. Additionally, because WebEOC does not contain a specific data field to identify the agency affected by the incident, TSA could not provide us with the total number of incidents reported by a particular agency.TSOC officials agreed with our findings and noted that these errors and limitations in WebEOC have complicated TSA’s ability to use the data to identify security trends or potential threats. For example, TSA attempted to analyze the frequency of rail tunnel breaches occurring in the U.S. rail system, as directed by the conference report accompanying the DHS Senior appropriations act for fiscal year 2012.TSA intelligence analyst, the rail security incident information from WebEOC was inadequate for conducting this analysis, and as a result, TSA had to request information from rail agencies and industry associations to complete the analysis.

However, according to a senior We also found that WebEOC data entry errors occur, in part, because of problems in the data entry process and limitations in WebEOC, including inaccurate categorization of incident characteristics in key data fields, such as the “Incident Type” and “Type of Entry” fields. For example, we analyzed 1 month of the data provided by TSA, which included a total of 152 passenger rail security incidents. We reviewed the “Incident Type” data field for these incidents, and found that 106 (70 percent) were characterized as “Not Applicable” or “Other Rail Incidents.” While this alone does not indicate that these incidents were mischaracterized, we found that 25 of these incidents should have been characterized under other available options, including “Firearm or Deadly Weapon,” “Bomb Threat,” or “Suspicious Activity,” among others. TSA officials agreed that the options for the “Incident Type” data field could often result in errors, and that these errors contributed to TSA’s inability to provide the number of security incidents reported by incident type.

With regard to the “Type of Entry” data field, TSA provided data extracted from WebEOC using the “Mass Transit” and “Rail” categories within this data field in response to our request for all of the passenger rail incidents reported from January 2011 through June 2012. However, because the WebEOC data entry options did not distinguish between passenger rail and freight rail, TSA could not provide a dataset that included only incidents reported by passenger rail agencies. Further, because TSA officials responsible for entering the incident data were not provided guidance that included definitions of the data entry options, incidents reported by the passenger rail agencies in our scope were sometimes categorized as “Mass Transit” and other times as “Rail.” As a result of our review, TSOC officials recognized that the options available under the “Type of Entry” data field were a key limitation of the WebEOC system resulting in data entry errors. In July 2012, officials at TSOC removed “Rail” as an option within “Type of Entry,” and replaced it with two options—“Passenger Rail” and “Freight Rail.” TSOC officials also developed additional guidance for the individuals responsible for entering the data, which can be accessed directly from WebEOC. This guidance addresses the data entry options for the “Type of Entry” data field, providing definitions of each of the surface transportation modes included as options.

TSA’s actions to create new data entry options and guidance for the “Type of Entry” data field are positive steps toward improving the categorization of rail security incident data. However, TSOC officials have not taken similar actions to address issues that exist with other data fields in WebEOC, including the “Incident Type” data field. The WebEOC data entry guidance that TSA has provided officials in the TSOC for data fields other than “Type of Entry” does not help prevent data entry errors from occurring because it allows for variation in the WebEOC data and assumes that the official responsible for entering the data fully understands the data entry options. For example, the stated purpose of the guidance is to ensure that all necessary elements of an incident are captured “while maintaining each unique style.” Further, the guidance states that the data fields such as “Incident Type” are “self- explanatory” and provides no additional information on how to enter the data or choose among different options.

We have previously reported on the importance of clear data entry guidance to help ensure that TSA is collecting consistent data that will allow the agency to better “connect the dots” with regard to potential terror threats to U.S. transportation systems. Further, Standards for Internal Control in the Federal Government states that information should be communicated to officials within an agency in a way that allows them to carry out their responsibilities. Additional guidance that contains clear definitions of data entry options could help TSA to reduce data entry errors in other data fields and improve users’ ability to search and extract basic information from the system, ultimately improving TSA’s ability to analyze the rail security incident information.

Limited Use of Incident Information

The weaknesses in the incident information notwithstanding, TSA has made limited use of the rail security incident information it has collected from rail agencies, in part because it does not have a systematic process for conducting trend analysis. As a result, TSA is missing an opportunity to identify potential security trends and patterns in the incident information, and develop recommended security measures to mitigate threats, as intended. Although TSA does not have a systematic process for identifying trends and patterns using the WebEOC rail security incident information, opportunities exist to identify trends from the information, despite the data weaknesses discussed above. In one example, the freight rail industry, through the Railway Alert Network— which is managed by the Association of American Railroads, a rail industry group—identified a trend where individuals were reportedly impersonating federal officials. In coordination with TSA and FRA, the Railway Alert Network subsequently issued guidance to its member organizations designed to increase awareness among freight rail employees and provide descriptive information on steps to take in response. The Railway Alert Network identified this trend through analysis of incident reporting from multiple freight railroads. In each case, the incident had been reported by a railroad employee. These incidents had also been reported to the TSOC.

Similarly, in response to a specific request from freight rail stakeholders, TSA’s Office of Intelligence and Analysis, which is responsible for analyzing threat information, used WebEOC incident information to identify the frequency and timing of shootings at freight trains. However, other products developed by the Office of Intelligence and Analysis and other DHS components that address domestic rail security incidents do not contain trend analysis of reported rail security incidents and are instead generally limited to descriptions of specific incidents. For example, TSA produces a series of periodic reports called the Global and Regional Intelligence Digest that provides descriptive reports of select transportation security incidents (for all transportation modes), with minimal accompanying analysis. Similarly, other products may contain intelligence information designed to inform rail stakeholders, but are based on sources other than the rail security incident data reported by rail agencies to the TSOC. Senior TSA intelligence officials we spoke with agreed that TSA does not have a systematic process for analyzing the rail security incident information, and is not using the information to conduct long-term trend analysis, though agency officials said they would like to do so in the future.

In the absence of a systematic process for conducting trend analysis, TSA officials said that the agency primarily relies on internal TSA officials to notice trends when they receive daily incident report summaries from the TSOC, which are detailed summaries of the most significant incidents reported each day, across all modes of transportation. However, TSA officials said that the agency has not identified any trends in passenger rail incidents as a result of these summaries. As a result, officials from rail agencies we spoke with generally found little value in the reporting process, because it was unclear to them how, if at all, the information was being used by TSA to identify trends or threats that could help TSA and rail agencies develop appropriate security measures. The notice of proposed rulemaking, final rule, and the Privacy Impact Assessment associated with collecting the incident information in WebEOC state that TSA’s purpose for collecting and maintaining the incident information is to help TSA “connect the dots.” In these documents, the agency said it would “connect the dots” by pulling together seemingly disconnected or disparate reports of suspicious or unusual rail security incidents through trend analysis that may allow TSA to anticipate and prevent an attack, and determine whether to encourage or require rail agencies to implement particular security measures. Without a process for systematically conducting trend analysis of the rail security incident data, it will be difficult for TSA to use the incident data it collects from agencies. As a result, TSA may continue to miss opportunities to identify security trends, such as the freight rail security trend identified by the Railway Alert Network, or to develop recommended security measures.

Conclusions

The foiled terrorist plots against the New York and Washington, D.C., passenger rail systems in 2009 and 2010, respectively, show the continued threat to passenger rail security and underscore the importance of tracking and analyzing security incident information to identify possible indicators or precursors of terrorist activity. TSA’s incident reporting regulation, issued in 2008, was intended to allow TSA to “connect the dots” to identify significant incidents, and discern rail security threats and trends. However, TSA has not used the incident information as it was intended. Using the incident information to conduct trend analysis would better position TSA to anticipate a future attack, and encourage or require rail agencies to implement more targeted security measures. Key to the effectiveness of this effort is collecting consistent, accurate, and complete incident information from rail agencies. While some variation is expected among rail agencies in the number and types of rail security incidents reported, written guidance disseminated to rail agencies and local TSA inspection officials—clarifying the types of incidents that should be reported to the TSOC—and enhanced mechanisms for oversight of compliance and enforcement activities could help ensure that the regulation is implemented consistently. Such actions could also help improve consistency in TSA’s compliance activities, thereby improving the reporting process and facilitating TSA’s ability to use the incident information for trend analysis that may identify potential threats.

In addition, incomplete information, data entry errors, and limitations in WebEOC hinder TSA’s ability to use rail security incident data to identify security trends or potential threats. TSA has taken some steps toward addressing some of the weaknesses in WebEOC, but additional actions could improve the completeness and accuracy of the information in the database. A process for updating the database when incidents that had not previously been reported are discovered through compliance activities and additional guidance for TSOC officials who enter the information would help TSA to reduce data entry errors and improve users’ ability to search and extract information from the system, ultimately improving TSA’s ability to analyze the rail security incident information. The weaknesses in the incident information notwithstanding, without a systematic process in place for regularly conducting trend analysis, TSA has missed opportunities to use the data in its incident reporting system as it was intended—to identify trends or patterns in the incident information that could help TSA and rail agencies develop targeted security measures that could strengthen rail security.

Recommendations for Executive Action

To help ensure that the rail security incident reporting process is consistently implemented and enforced, we recommend that the Administrator of TSA take the following two actions: develop and disseminate written guidance for local TSA inspection officials and rail agencies that clarifies the types of incidents that should be reported to the TSOC, and enhance and utilize existing oversight mechanisms at the headquarters level, as intended, to provide management oversight of local compliance inspections and enforcement actions.

To help fulfill TSA’s stated purpose for collecting rail security incident information and improve the accuracy and completeness of the incident data in TSA’s incident management system, WebEOC, we recommend that the Administrator of TSA take the following three actions: establish a process for updating the database when incidents that had not previously been reported are discovered through compliance activities; develop guidance for TSOC officials that includes definitions of data entry options to reduce errors resulting from data entry problems; and establish a systematic process for regularly conducting trend analysis of the rail security incident data, in an effort to identify potential security trends that could help the agency anticipate or prevent an attack against passenger rail and develop recommended security measures.

Agency Comments and Our Evaluation

We provided a draft of this report to DHS for comment. In written comments received December 4, 2012, DHS concurred with the recommendations and identified actions taken, planned, or under way to implement the recommendations. DHS’s written comments are summarized below and reproduced in appendix V. The Department of Transportation’s Director of Audit Relations stated in an e-mail received on December 6, 2012, that the department had no comments on the report. Amtrak’s audit liaison stated in an email received on November 16, 2012, that Amtrak had no comments on the report.

In its written comments, DHS concurred with our recommendation that TSA develop and disseminate written guidance for local TSA inspection officials and rail agencies that clarifies the types of incidents that should be reported to the TSOC. DHS stated that TSA’s Office of Security Operations and its Office of Security Policy and Industry Engagement will work together to develop written guidance for passenger rail agencies clarifying the types of incidents that should be reported to the TSOC. TSA plans to disseminate the guidance to passenger rail agencies. If implemented, these actions would address our recommendation and could help reduce confusion among rail agencies and improve consistency in incident reporting.

In response to our recommendation that TSA enhance and utilize existing oversight mechanisms at the headquarters level, as intended, DHS concurred with the recommendation and stated that while several mechanisms and layers are in place for oversight and management of local inspection and enforcement actions, TSA recognizes that there are opportunities for improving oversight. According to DHS, existing oversight mechanisms include RSI-Ss, who serve as technical specialists, oversee and implement transportation security policy and programs, and conduct field office audits and visits, among other things. DHS also stated that its Office of Chief Counsel coordinates enforcement actions with RSI- Ss, local field offices, TSA’s Office of Compliance Programs, and TSA’s Office of Security Policy and Industry Engagement. DHS stated that to improve headquarters oversight, RSI-Ss have recently been granted case review privileges in PARIS—which is used to record all TSA inspection activities—along with any findings and actions taken. DHS stated that this will allow the RSI-Ss greater visibility on all surface inspections, investigations, and recommendations for enforcement actions entered into PARIS by enabling the RSI-Ss to provide written recommendations in PARIS prior to inspection approval. Because RSI-Ss have recently been granted this access, it is too soon to determine the extent to which this action will address our recommendation.

In response to our recommendation that TSA establish a process for updating its WebEOC database when incidents that had not been previously reported are discovered through compliance activities, DHS concurred and stated that TSA is currently establishing a business process to ensure the relevant databases are complete. According to DHS, the WebEOC system will be adjusted to permit inputting of records that are discovered through compliance activities. We will continue to monitor the agency’s efforts to implement our recommendation.

DHS also concurred with our recommendation that TSA develop guidance for TSOC officials that includes definitions of data entry options to reduce errors resulting from data entry problems. DHS stated that the TSOC had completed implementing this recommendation by updating the guidance with respect to input options. However, the updated guidance that TSA sent to us clarifies that incident logs in WebEOC need to indicate that an incident was reported by phone. The guidance does not provide definitions for data entry options, as we recommended, and we therefore continue to believe that additional guidance is necessary for the officials responsible for inputting the incident information into WebEOC.

In response to our recommendation that TSA establish a systematic process for regularly conducting trend analysis of the rail security incident data, in an effort to identify potential security trends, DHS concurred and stated that TSA will develop a process to review suspicious activities and incidents in the mass transit and passenger rail areas in order to identify trends that might represent a threat to transportation. We will continue to monitor the agency’s efforts to implement our recommendation.

We are sending copies of this report to the Secretaries of Homeland Security and Transportation, the TSA Administrator, Amtrak, appropriate congressional committees, and other interested parties. In addition, this report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-4379 or lords@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are acknowledged in appendix VI.

Appendix I: Influence of Foreign Attacks on Selected U.S. Rail Agencies’ Security Measures

Officials we met with from eight high-volume rail agencies generally stated that foreign rail attacks (such as those described in appendix IV) served as potent reminders of potential terror threats against rail, but they did not lead the rail agencies to make significant changes in their security measures. Nonetheless, agencies have used these incidents to inform security enhancements. Specifically, these agencies reported making changes to their security measures, in part as a result of lessons learned from foreign attacks. These changes were related to:

Public awareness campaigns. These include publicity posters and announcements over public address systems within rail stations that alert passengers and rail agency employees to report suspicious items or behaviors to police. For example, officials from one rail agency we spoke with reported making changes to its public awareness campaign following the attacks in Madrid and London. These changes included instituting a regional transit security awareness program, including periodic audio announcements reminding passengers to be aware of potential threats, in coordination with the Federal Transit Administration’s Transit Watch Program. Other rail agencies reported that the attacks described in appendix IV emphasized the importance of having informed riders that can act as a “force multiplier” when it comes to noticing suspicious activity.

Armed mobile tactical teams. These are police teams similar to SWAT teams that patrol rail systems or that are intended for rapid deployment in the event of a terror attack or related incident. Officials from one high-volume rail agency reported that the 2008 attack in Mumbai led it to immediately increase training in responding to “active shooter” scenarios by its existing mobile tactical teams. Officials from other high-volume rail agencies we interviewed also reported that they established mobile tactical teams or increased the training of their existing patrols following the 2008 Mumbai attacks.

Motorized emergency response vehicles. These are small battery- operated vehicles intended to help first responders reach injured or stranded passengers when they cannot be quickly reached by a rescue train (if, for example, rails have been damaged by a terror blast or electrical outage). Officials from one agency we interviewed reported that it deployed these response vehicles directly in response to lessons learned from the London attack, during which first responders used such vehicles to rescue injured Underground rail passengers.

Closed-circuit television (CCTV). CCTV refers to a visible or covert video system intended for only a limited number of viewers. In CCTV, the picture is viewed or recorded, but not broadcast. According to officials from two high-volume rail agencies we interviewed, the July 2005 attacks in London demonstrated the utility of CCTV coverage for forensic investigation. A United Kingdom government analysis reported that the cameras helped police determine the identity of the bombers. Officials from four high-volume rail agencies we interviewed stated that while they increased the number of CCTV cameras in their rail systems, this did not occur immediately following the London attacks. Rather, the London attacks reinforced the importance of CCTV camera coverage as a key security measure.

Appendix II: Selected Mechanisms Used to Gather Information on Lessons Learned from Passenger Rail Attacks and Share Rail Security Information

The Transportation Security Administration (TSA) and officials from eight high-volume passenger rail agencies we interviewed identified several different mechanisms they use to obtain and share passenger rail security-related information, including information on lessons learned from foreign rail attacks (such as those described in appendix IV) and security measures implemented or considered by other U.S. rail stakeholders. Many of these mechanisms have also been discussed in our previous reports on information sharing and rail security issues. The key mechanisms that officials from the eight high-volume rail agencies we interviewed cited using to obtain and share passenger rail security-related information are summarized in table 1.

Appendix III: Objectives, Scope, and Methodology

This report addresses the following questions:

To what extent has the Transportation Security Administration (TSA) overseen and enforced the passenger rail security incident reporting requirements?

To what extent has TSA analyzed passenger rail security incident information to identify security trends and potential threats against passenger rail systems?

Appendix I of this report also includes information on how selected rail agencies applied lessons learned from foreign rail attacks to enhance their rail security measures. Appendix II includes information on key mechanisms rail agencies use to obtain rail security-related information.

To address these questions, we examined TSA’s rail security incident reporting process. We focused on TSA’s regulation for rail security incident reporting, which requires passenger rail agencies to report rail security incidents to the Transportation Security Operations Center (TSOC). We reviewed the notice of proposed rulemaking and final rule that describe the purpose and justification of the incident reporting requirement, as well as TSA policy documents, manuals, and guidance concerning the rail security incident reporting process. We also interviewed cognizant TSA officials at headquarters and in the field regarding their roles in the incident reporting process. To obtain rail industry perspectives on the rail security incident reporting process, we conducted visits at, or teleconferences with, 19 of the top 50 passenger rail systems across the nation, by passenger rail ridership. See table 2 for a list of passenger rail systems we interviewed. We selected these passenger rail systems to reflect varied levels of ridership and geographic dispersion. Because we selected a nonprobability sample of passenger rail systems, the information obtained from these visits and interviews cannot be generalized to all rail systems nationwide. However, we determined that the selection of these rail systems was appropriate for our design and objectives and that the selection would provide valid and reliable evidence. The information we obtained provided illustrative examples of the perspectives of various passenger rail stakeholders about the rail security incident reporting process, and corroborated information we gathered through other means. Further, we interviewed rail industry representatives from the American Public Transportation Association and the Association of American Railroads to obtain their perspectives on rail security issues. We selected these associations because they represent the majority of the passenger and freight rail systems in the United States.

To assess the extent to which TSA has overseen and enforced the rail security reporting requirement, we interviewed officials from the selected rail systems discussed earlier on how they have implemented this requirement, including the guidance they have received from TSA on the types of incidents to report to the TSOC. We interviewed TSA headquarters officials from the Compliance Programs Division within the Office of Security Operations and local TSA officials from five field offices, including transportation security inspectors-surface (TSI-S) and assistant federal security directors-inspections (AFSD-I), regarding the guidance they provide to rail agencies on incident reporting and how they ensure rail agencies’ compliance with the regulation. We selected these five field office locations because they had oversight responsibility for many of the rail agencies included in our scope. We also interviewed one TSA regional security inspector-surface (RSI-S) regarding his role in the rail security incident reporting process. Because we selected a nonprobability sample of TSA’s field offices and officials, the results from these interviews cannot be generalized to all TSA field offices; however, the information we obtained provided us with an overview of the role of TSA surface inspectors in the rail incident reporting process and corroborated information we obtained through other sources. We examined documentation on TSA’s inspection processes for monitoring rail systems’ compliance with the incident reporting requirement, including the Transportation Security Inspector Inspections Handbook, the National Investigations and Enforcement Manual, and the Compliance Work Plan for Transportation Security Inspectors. We also reviewed a TSA operational directive related to reporting aviation security incidents to TSA.

We chose January 2011 as the starting point for our analysis because it was 2 full years after the regulation became effective, which would allow rail agencies and TSA a period of adjustment. The regulation went into effect in December 2008. June 2012 was the end of our data collection period.

WebEOC by conducting visits to the TSOC and interviewing TSOC officials to discuss their role in incident reporting and the mechanisms in place to ensure data quality. We also reviewed WebEOC documentation to identify how passenger rail security incident data are collected and managed, and how data quality is ensured. While we determined that the information in WebEOC was sufficiently reliable for the purposes of providing information on differences in the number and types of rail security incidents reported by selected rail agencies to the TSOC, we identified issues with data entry and data quality, which are discussed in this report. In addition, we obtained data from TSA’s Performance and Results Information System (PARIS) for January 2011 through June 2012 on TSA’s compliance inspections and all records related to enforcement actions taken under the passenger rail security incident reporting requirement. We analyzed the data to identify the content and frequency of TSA inspections conducted and enforcement actions taken under the incident reporting regulation. We ascertained the reliability of compliance data derived from PARIS by interviewing TSA officials from the Compliance Programs Division and reviewing documentation on controls implemented to ensure the integrity of the data in PARIS, and found the compliance data sufficiently reliable for our purposes. We also evaluated TSA’s efforts to oversee and enforce the incident reporting requirement against criteria in Standards for Internal Control in the Federal Government.

To assess the extent to which TSA has analyzed rail security incident information, we interviewed TSA officials from the TSOC, the Office of Intelligence and Analysis, the Office of Security Operations, and the Office of Security Policy and Industry Engagement regarding their roles and responsibilities. We reviewed available documentation and analyses that TSA prepared containing rail security incident information. We also examined the WebEOC incident management database to identify any limitations in the database that could present challenges for analyzing the rail security incident data, and we discussed these limitations with relevant TSA officials. We also interviewed officials from the rail agencies noted earlier about their views on the information and analyses they receive from TSA on rail security incidents.

We also obtained information on how selected rail agencies applied lessons learned from foreign rail attacks to enhance their rail security measures and how rail agencies obtain and share passenger rail security- related information, including information on lessons learned from foreign rail attacks. To do this, we reviewed TSA documentation describing TSA’s security strategy for the mass transit and passenger rail systems, such as TSA’s Mass Transit and Passenger Rail Annex, and we discussed the rail security actions outlined in the annex with TSA officials. In addition, we reviewed rail security reports and interviewed an official from the Mineta Transportation Institute (MTI). We met with MTI because the organization’s database on attacks against surface transportation, including passenger rail, was cited by TSA as the most comprehensive and up-to-date of existing databases. On the basis of information we obtained from MTI, and discussions with MTI and TSA officials, we found the quality of the methods used to develop these reports sufficient for use as a source in this report. We also interviewed security officials from selected passenger rail systems regarding their key security measures. During visits to passenger rail systems, we toured stations and other facilities such as control centers, and observed security practices. We also interviewed officials from other federal agencies including the Central Intelligence Agency and the Department of Transportation’s Federal Transit Administration and Federal Railroad Administration regarding their roles in passenger rail security, and we interviewed government officials involved with securing passenger rail in the United Kingdom. We also reviewed our prior reports on passenger rail security and information sharing as well as studies and reports conducted by outside organizations related to passenger rail, such as the Department of Homeland Security Office of the Inspector General.

Appendix IV: Summary of Recent Attacks against Foreign Passenger Rail Systems

According to the Mineta Transportation Institute (MTI), from September 12, 2001 through December 31, 2011, 838 attacks occurred worldwide against passenger and commuter rail systems, resulting in 1,372 fatalities. Most of these attacks occurred in South Asia (Pakistan, India, and Thailand) and Russia. For purposes of our review, we focused on recent passenger rail attacks that occurred in the following locations: Madrid, Spain; London, England; Mumbai, India; and Moscow, Russia. In this section, we summarize the basic facts of these attacks, using reports and information from the Department of Homeland Security (DHS), the Transportation Security Administration (TSA), open source, MTI, and others. Other attacks may have occurred at these locations, both before and after those cited.

On March 11, 2004, 10 bombs exploded on three trains on Madrid’s commuter rail system during the morning rush hour, killing 191 people and wounding more than 1,500 others. The bombs were placed in backpacks and detonated by cell phones. According to DHS’s report on the attack, those responsible were from a terrorist group associated with al-Qaeda. According to DHS, by the end of March 2004, authorities had arrested 22 people in connection with the attack. The following month, Madrid law enforcement located a safe house associated with the suspected bombers. As authorities entered the apartment, the suspected terrorists inside detonated explosives, killing themselves and a police officer. Officers subsequently found backpacks filled with of explosives and detonators in the wreckage.

On July 7, 2005, four suicide bombers detonated improvised explosive devices during the London rush hour on three Underground (subway) trains and on a double-decker bus, killing a total of 52 people and injuring about 700. All four bombers were also killed in the attacks. The three Underground attacks occurred within moments of one another and the bus bombing occurred approximately 1 hour later. The bombers traveled together from a commuter rail station north of London to the King’s Cross Underground station, from which they departed to their respective attack destinations. A second series of attacks was attempted 2 weeks later, on July 21. However, the explosives failed to detonate. According to DHS, no terrorist group has claimed responsibility. After a police investigation of the attacks, three additional suspects were charged with conspiracy in the identification and reconnaissance of potential terrorist targets in London. However, all three were acquitted on those charges in April 2009.

On July 11, 2006, a series of seven explosions occurred on a single rail line of Mumbai’s commuter railway. In all, 190 people were killed and 625 were injured across all the incidents. In September 2006, Indian police said that the attacks were executed by Lashkar-e-Taiba.

Starting on November 26, 2008, and continuing for the next 2 days, terrorists attacked various locations in the Mumbai area including a passenger rail station and hotels catering to Western tourists. The attackers used assault weapons, small arms, grenades, and explosives. One of the first attacks occurred at the Chhatrapati Shivaji rail terminus, one of the busiest train stations in the country. Two gunmen entered the passenger hall and opened fire, killing 59 and injuring 104. The terrorists then dispersed throughout the city attacking another eight locations, killing at least an additional 129 and injuring more than 223 others. According to DHS, like the attacks on July 11, 2006, the terrorists were also from Lashkar-e-Taiba. Nine terrorists were killed during the course of the attacks, while one was captured alive.

On March 29, 2010, two suicide bombers attacked trains at two stations in the Moscow Metro during the morning rush hour, killing 40 and injuring 58 others. The first explosion occurred on a train as it pulled into Lubyanka station. The second explosion occurred at the Park Kultury station as passengers were boarding a train. Both the Lubyanka and Park Kultury stations are transfer stations and may have been chosen by the attackers in an effort to target the greatest number of people. Russian officials attribute the attack to Chechen separatists.

Appendix V: Comments from the Department of Homeland Security

Appendix VI: GAO Contact and Staff Acknowledgments

GAO Contact

Stephen M. Lord, (202) 512-4379 or LordS@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Jessica Lucas-Judy (Assistant Director), Eric Hauswirth, Adam Hoffman, Tracey King, Elizabeth Kowalewski, Kelly Rubin, and Jonathan Tumin made key contributions to this report.