Public Transit Security Information Sharing: DHS Could Improve Information Sharing through Streamlining and Increased Outreach
Released: 2010-09-22T00:00:00

Letter

Background

Overview of the U.S. Public Transit Systems

The nation’s transportation system is a vast, interconnected network of diverse modes. Key modes of transportation include aviation, freight rail, highway, maritime, transit, and pipeline. The nation’s public transit system includes multiple-occupancy vehicle services designed to provide regular and continuing general or special transportation to the public, such as transit buses, light rail, commuter rail, subways, and waterborne passenger ferries. According to APTA, buses are the most widely used form of transit, providing almost two-thirds of all passenger trips. Light rail systems are typically characterized by lightweight passenger rail cars that operate on track that is not separated from vehicular traffic. Commuter rail systems typically operate on railroad tracks and provide regional service (e.g., between a city and adjacent suburbs). Subway systems, like the Metropolitan Transportation Authority’s New York City Transit, typically operate on fixed heavy lines within a metropolitan area and have the capacity for a heavy volume of traffic. Waterborne passenger ferries provide a link across many of the nation’s waterways and, in some cases, present drivers with an alternative travel option. Public transit systems in the United States are typically owned and operated by public sector entities, such as state and regional transportation authorities. In addition, while some transit agencies rely on their local police department to secure their systems, others, such as the Bay Area Rapid Transit system in San Francisco, have established their own dedicated police department.

Mass transit and passenger rail systems carry a high number of passengers every day and are open and fully accessible. Multiple stops and transfers lead to high passenger turnover, which is difficult to monitor effectively, and a terrorist attack on public transit systems could result in a large number of casualties. While there have been no successful terrorist attacks against U.S. public transit systems to date, terrorist attacks on public transit systems around the world, such as the March 2010 subway bombings in Moscow, Russia, and the recent plot to detonate explosives on the New York City subway system, illustrate the potential threat to public transit systems.

Multiple Stakeholders Have Responsibility for Sharing Security-Related Information with Public Transit Agencies

Securing the nation’s public transit systems is a shared responsibility requiring coordinated action on the part of federal, state, and local governments; the private sector; and passengers who ride these systems. A component of this shared responsibility is ensuring that those within the private and public sector have access to quality security-related information to enhance prevention and protection efforts. DHS is the lead department involved in securing the nation’s homeland. As required by the Homeland Security Act of 2002, the department is responsible for coordinating homeland security efforts across all levels of government and throughout the nation, including with federal, state, tribal, local, and private sector homeland security stakeholders.

The Aviation and Transportation Security Act established TSA as the federal agency with primary responsibility for securing the nation’s transportation systems. As part of this responsibility, TSA serves as the lead DHS component responsible for assessing intelligence and other information to identify individuals who pose a threat specifically to transportation security and to coordinate countermeasures with other federal agencies to address such threats. TSA is also charged with serving as the sector-specific agency for the transportation community. Within TSA, several offices, including the Office of Transportation Sector Network Management and the Office of Intelligence, play a role in sharing security-related information with transportation stakeholders. In addition to TSA, a number of other entities are responsible for sharing security- related information with internal and external stakeholders, including public transit agencies. Table 1 below provides details on roles and responsibilities of some of the various entities involved in sharing security- related information with public transit agencies.

PT-ISAC and HSIN-PT Were Established to Serve as the Primary Security Information- Sharing Mechanisms for Public Transit Agencies

According to APTA and TSA officials, the PT-ISAC and the public transit subportal on DHS’s HSIN (HSIN-PT) were designed to serve as the primary mechanisms for sharing security-related information with public transit agencies. The PT-ISAC, which is implemented by APTA under a cooperative agreement with FTA, was designed to serve as the one stop shop for public transit agencies seeking to obtain security-related information. The PT-ISAC collects, analyzes, and distributes security and threat information from the federal government and open sources on a 24/7 basis. It provides public transit agencies with unclassified and open- source documents obtained from numerous sources, including DOT, DHS, and DOJ. According to PT-ISAC officials, this mechanism disseminates this information through daily E-mails with attachments summarizing and analyzing recent security and cybersecurity information, news, threats, and vulnerabilities within the transportation sector. In addition, the PT- ISAC has a searchable library of government and private security documents, and PT-ISAC analysts hold top secret security clearances. HSIN-PT is also focused on providing security-related information pertaining to the public transit industry. According to DHS officials, HSIN was designed to serve as the department’s primary information-sharing mechanism for the larger homeland security community engaged in preventing, protecting from, responding to, and recovering from all threats, hazards, and incidents under DHS jurisdiction. HSIN is comprised of a network of communities, referred to as communities of interest, such as Intelligence and Analysis, Law Enforcement, Emergency Management, and Critical Sectors (CS). Within HSIN-CS, each of the 18 critical sectors maintains its own site. Under the transportation sector, the public transit mode maintains its own subportal on HSIN. According to TSA officials, HSIN-PT is maintained and populated by mass transit and passenger rail private and government stakeholders. HSIN, including its public transit subportal, is accessible via the Internet, but users must first be vetted against established criteria to obtain a user name and password from DHS to access the network and retrieve information. As an additional feature, HSIN users may elect to receive E-mail alerts that include notices of ongoing events or direct the user to a particular location within HSIN to obtain additional information.

While the PT-ISAC and HSIN-PT are focused on providing security-related information to public transit agencies, the agencies we surveyed did not rely solely on these two mechanisms for their information needs. Figure 1 below illustrates the 12 key information-sharing mechanisms, identified by the agencies we surveyed, that disseminate security-related information to public transit agencies. These mechanisms were cited as sources of security-related information by more than 40 percent of the public transit agencies we surveyed.

Forces (JTTF)

Transit Security and Safety Roundtables The information-sharing mechanisms described in figure 1 vary by intended users of the mechanism, the type and source of information offered, and how the information is distributed. Table 2 provides additional details on the 12 information-sharing mechanisms public transit agencies cited most frequently as sources for security-related information.

Although all of these mechanisms are used by some segment of the public transit agencies we surveyed to obtain security-related information, access to the information disseminated through the mechanisms illustrated in table 2 may vary by, among other factors, whether the transit agencies have a dedicated police department, the size of transit agency, and accessibility of the information. For example, some public transit agencies with a dedicated police department receive security-related information through their law enforcement representative on the local JTTF. According to FBI officials, public transit agencies that do not have a dedicated police department are less likely to receive information from the JTTF. In addition, the Transit Security and Safety Roundtables are specifically tailored for the nation’s largest mass transit and passenger rail agencies, typically those ranked within the top 50 or 60 by ridership. Smaller transit agencies are less likely to receive information disseminated through this mechanism since they are typically not invited to participate in these roundtables. Also, of the mechanisms identified by the public transit agencies we interviewed and surveyed, all but one send information directly to transit agencies instead of requiring users to log on to a system to retrieve information (“push” vs. “pull”).

In addition to the information-sharing mechanisms identified in table 2, TSA-OI implemented its TS-ISAC in March 2010 as another means for sharing security-related information with the transportation industry, including public transit agencies. Specifically, TSA’s vision for the TS- ISAC is to serve as the one stop shop to obtain TSA-OI reports and documentation, such as SBU intelligence products and other documents from other transportation security partners and stakeholders. The TS- ISAC aims to enhance collaboration between operators, law enforcement personnel, and security directors from all transportation modes. Similar to HSIN-PT, the TS-ISAC is a subportal of HSIN-CS, and therefore users must have a HSIN password to access it. Once access is obtained, TS- ISAC users can set up alerts to be notified when a new document has been posted to the site.

Public Transit Agencies We Surveyed Were Generally Satisfied with Federal Efforts to Share Security- Related Information, but Opportunities Exist to Improve These Efforts

Large Transit Agencies and Rail Agencies Were Generally More Satisfied with Information-Sharing Efforts Than Midsized Agencies and Non-Rail Agencies

Our survey results indicate that public transit agencies’ satisfaction with the security-related information they received varied with the type of transportation service provided and whether the agency was large or midsized. As highlighted in table 3 below, three-fourths of public transit agencies that responded to this question in our survey (57 of 76) were generally satisfied with the security-related information they received, while less than one-sixth (11 of 76) were generally dissatisfied. The agencies that provide heavy rail, light rail, or commuter rail service (rail agencies) were generally more satisfied with the information they received than the agencies that provide bus or ferry service, but not rail service (non-rail agencies). Specifically, most rail agencies (30 of 36) were generally satisfied with the security-related information they received, as opposed to approximately two-thirds (27 of 40) of non-rail agencies.

In addition, the larger agencies we surveyed were generally more satisfied with security-related information-sharing than the midsized agencies. Specifically, nearly all of the large agencies that responded to the survey (14 of 15) were generally satisfied with the security-related information they received, and nearly half (7 of 15) were “very satisfied.” By contrast, 43 of 61 midsized agencies were generally satisfied with the information they received, and less than one-sixth (10 of 61) were “very satisfied.” Table 3 illustrates public transit agencies’ overall satisfaction with the security-related information they received.

The agencies we surveyed reported using several different mechanisms to receive security-related information, and in general they were satisfied with the information they received through these mechanisms. Of the mechanisms included in the survey, 12 were used by or accessible to at least 40 percent of the agencies that responded to the survey. The two mechanisms most often cited were E-mail alerts from FTA officials (65 of 76) and E-mail alerts from TSA officials (56 of 76); overall general satisfaction with these two mechanisms was 86 percent and 74 percent, respectively. Transit Security and Safety Roundtables were the highest- rated mechanism for overall general satisfaction, with 33 of 36 agencies generally satisfied. With respect to information relevance, validity, and timeliness—three of the six dimensions of quality we included in the survey—regional emergency operations centers received the highest general satisfaction ratings. For actionable information, respondents rated the information they received from other public transportation systems the highest for general satisfaction (28 of 33). Among the 12 most frequently cited mechanisms, public transit agencies were the least satisfied with HSIN, both in terms of overall general satisfaction (19 of 33) and for each of the six dimensions of quality. Public transit agencies in our survey viewed the PT-ISAC more favorably than HSIN; approximately three-fourths (37 of 49) of PT-ISAC users indicated they were generally satisfied with the security-related information they received from this mechanism. See appendix III for additional data on public transit agencies’ satisfaction with individual information-sharing mechanisms.

Public transit agencies also expressed their views on the “cross-sector” information they receive. Most agencies that responded to our survey indicated that receiving cross-sector information is important or very important (63 of 78), and this view was shared by both rail and non-rail agencies. However, these two groups characterized differently the amount of cross-sector information they received. Specifically, approximately half of responding rail agencies indicated that they received “about the right amount” of cross-sector information (18 of 37). The remaining rail agencies either wanted to receive additional cross-sector information (7 of 37) or felt that they already received too much (10 of 37). Conversely, about half of non-rail agencies (22 of 41) reported receiving “too little” or “far too little” cross-sector information. Rail and non-rail agencies also differed with respect to their satisfaction with cross-sector information. Approximately two-thirds of rail agencies that responded to this question (24 of 37) were generally satisfied with cross-sector information, whereas less than half of non-rail agencies (16 of 41) were generally satisfied. See table 4 for public transit agencies’ views on cross-sector security information sharing.

Opportunities Exist to Streamline Security Information-Sharing Efforts

According to TSA’s 2007 Transportation Systems Sector-Specific Plan Mass Transit Modal Annex, a streamlined and effective system to share mass transit and passenger rail information is needed to facilitate information sharing among the federal government and public and private stakeholders. Additionally, in September 2009, we reported that multiple information systems can create redundancies that make it difficult for end users to discern what is relevant and can overwhelm users with duplicative information from multiple sources.

Public transit agencies currently receive similar security-related information from a variety of sources. In addition to identifying the 12 key mechanisms most frequently used by public transit agencies to obtain security-related information, our survey also identified that nearly 80 percent of respondents (63 of 80) used 5 mechanisms or more to receive security information. Further, through interviews with public transit agencies of various sizes around the country, we identified at least 21 mechanisms through which these agencies receive security-related information. Moreover, the Mass Transit SCC/ Transit, Commuter, and Long-Distance Rail Government Coordinating Council (GCC) joint Information Sharing Working Group (SCC/GCC Information Sharing Working Group)—which is cochaired by TSA and comprised of federal and industry stakeholders and was formed to improve information sharing with public transit agencies—compiled a list that includes 59 different information products distributed to public transit agencies by 17 different sources.

We identified the potential for overlap between three mechanisms that are each designed to communicate similar unclassified and SBU security- related information to public transit agencies: the PT-ISAC, the HSIN-PT subportal, and the newly-formed TS-ISAC. According to APTA, the PT- ISAC is intended to be a one stop shop for public transit agencies’ information needs. However, according to DHS, the HSIN platform is intended to serve as the agency’s primary mechanism for sharing unclassified and SBU information with homeland security stakeholders, and TSA officials stated that the agency intends for the HSIN-PT subportal to be the primary mechanism for sharing such information with public transit agencies. Moreover, the TS-ISAC—which is hosted on HSIN-CS and is intended to serve as a collaborative information-sharing platform for the public transit and other transportation modes—includes unclassified and SBU transportation-related information products produced by TSA-OI. According to TSA officials, the TS-ISAC, which services the larger transportation community, is not intended to compete with or replace HSIN-PT or the PT-ISAC, but in the future it may include a separate Web page that is specific to public transit.

FTA, TSA, APTA, and public transit agency officials we interviewed expressed the desire to streamline information sharing to reduce the volume of overlapping information public transit agencies receive. For example, the then-Acting Manager of TSA's Mass Transit Division stated that the current number of sources available to public transit agencies to receive security-related information is “overwhelming.” Additionally, officials from 16 of 27 agencies we interviewed also suggested that information sharing could be improved by reducing redundancies and consolidating existing mechanisms. Our survey of public transit agencies also indicated a desire for a more streamlined approach to information sharing. In an open-ended question asking how information sharing could be improved, 24 of 80 agencies provided comments in favor of consolidating existing information-sharing mechanisms. For example, according to one respondent who favored streamlining the existing mechanisms, “there are so many purported analysis centers pushing out redundant information that an inordinate amount of my time is spent filtering these many reports to find the high-value nuggets.” Our interviews and survey data are consistent with the Administration’s March 2010 Surface Transportation Security Priority Assessment, which recommended, among other things, that TSA implement an approach for sharing transportation security information that provides all relevant threat information and improves the effectiveness of information flow.

Federal and industry stakeholders have efforts under way intended to improve the efficiency of information sharing with public transit agencies and reduce the volume of overlapping information public transit agencies receive. Specifically, TSA, FTA, APTA, and other government and private sector stakeholders are participating in the SCC/GCC Information Sharing Working Group, which is reviewing how the PT-ISAC, the HSIN-PT subportal, the TS-ISAC, and other related information-sharing mechanisms (including direct E-mails from FTA and TSA officials) might be streamlined or consolidated to better serve the public transit industry. This working group is considering, among other things, whether the PT- ISAC could produce a daily (or twice daily) 2 to 3 page unclassified/For Official Use Only (FOUO) information product using open-source information as well as intelligence products from TSA, DHS, and other entities. This would mark a shift in the PT-ISAC’s activities, as it would replace a longer information product (10 to 15 pages) the PT-ISAC prepares using primarily open-source information. Working group participants are still debating how this new information product would be disseminated to the public transit industry (e.g., through direct E-mails to public transit agencies, through HSIN-PT, or both), and whether products could be archived on HSIN-PT or another system to facilitate later viewing. In addition, the working group is considering ways to scale back the number of direct E-mails public transit agencies receive, while still maintaining the capability to disseminate information in this manner when necessary.

Participants in this working group have not yet agreed on a path forward to improve information sharing with public transit agencies. As of July 2010, TSA officials stated that the working group had not yet (1) drafted options for improving information sharing with public transit agencies, (2) documented the group’s current working proposal, or (3) established a time frame for completing either of these activities. Additionally, the working group has not yet determined how it will incorporate the TS-ISAC into its proposed options. While TSA, through the working group, is assessing, among other things, the extent to which information-sharing mechanisms can be streamlined, there are no time frames established for completing these efforts. Developing such time frames to guide the working group’s activities—including its assessment of opportunities to streamline existing information-sharing mechanisms that target similar user groups with similar information—could assist TSA in completing this important effort.

The PT-ISAC Is Not Completing Agreed-Upon Responsibilities and Tasks

Standards for Internal Control in the Federal Government provide that internal controls should be designed to assure that ongoing monitoring occurs in the course of normal operations. The cooperative agreement between FTA and APTA that provides funding for the PT-ISAC specifies that the ISAC perform several functions related to the HSIN-PT subportal. For example, the agreement states that the PT-ISAC is to control access to the HSIN-PT subportal, manage the information that is available on the subportal, and take steps to enhance its user-friendliness. As specified in the cooperative agreement, TSA and FTA monitor the PT- ISAC’s expenditures and activities through quarterly financial and operational reports to help ensure the PT-ISAC fulfills the se tasks.

However, while TSA and FTA oversee PT-ISAC expenditures, they are not currently taking steps to ensure that the PT-ISAC performs all of the activities that are specified under the cooperative agreement. For example, the PT-ISAC does not post its analytical products (or other security-related information) to the HSIN-PT subportal, nor has it organized and archived HSIN-PT content to facilitate better access to information, as specified by the agreement. As a result, HSIN-PT is not regularly updated with security-related information, including PT-ISAC analytical products, which could be beneficial to public transit agencies.

TSA, FTA, APTA, and PT-ISAC officials agree that the PT-ISAC is not performing the HSIN-related functions specified in the FTA/APTA cooperative agreement. These officials told us that through the SCC/GCC Information Sharing Working Group, they are reviewing the specific roles and responsibilities of the PT-ISAC—including activities related to the HSIN-PT subportal. However, regardless of whether the working group redefines the PT-ISAC’s roles and responsibilities, it is important to ensure that the activities specified in the cooperative agreement are carried out. Taking steps to ensure the PT-ISAC fulfills its responsibilities and completes agreed-upon tasks could help assure TSA and FTA that this mechanism meets the security information needs of public transit agencies.

Awareness and Use of PT- ISAC and HSIN among Some Public Transit Agencies Could Be Increased

In March 2004, we recommended that agencies take actions to better target federal outreach efforts, and internal control standards call for management to ensure adequate means of communicating with external stakeholders who may have a significant impact on agency goals. Security officials at the public transit agencies we surveyed were not always aware of the existence of the PT-ISAC and HSIN, particularly non- rail agencies, midsized agencies, and agencies that do not have their own dedicated police department. For example, of the 80 agencies we surveyed, 23 indicated they did not receive security information from the PT-ISAC and 8 did not know whether they used this mechanism. Moreover, 15 of the 23 agencies that did not receive information from the PT-ISAC had never heard of it (see table 5).

According to FTA officials, the PT-ISAC is meant to serve as a valuable resource for midsized and smaller public transit agencies. However, our survey results indicate that fewer non-rail and midsized agencies received information from the PT-ISAC than rail and large agencies (19 of 41 non- rail and 35 of 65 midsized agencies, as opposed to 30 of 39 rail agencies and 14 of 15 large agencies, respectively). Moreover, nearly all of the agencies we surveyed that had not heard of the PT-ISAC were non-rail agencies (14 of 15), midsized agencies (15 of 15), or agencies without their own dedicated police department (14 of 15).

APTA conducts some PT-ISAC outreach through E-mails and newsletters to its members and other stakeholders, and FTA officials stated that they promote the PT-ISAC at Transit Security and Safety Roundtables. Both APTA and FTA officials agreed, however, on the need for additional outreach to public transit agencies to increase awareness and use of the PT-ISAC. TSA did not provide information on any existing PT-ISAC outreach efforts, but officials stated that the agency’s future actions with respect to the PT-ISAC, including outreach activities, will depend on the proposed options that arise from the SCC/GCC Information Sharing Working Group. However, as noted above, there are no time frames for this working group to draft or finalize its proposals for improving information sharing, including who will be responsible for conducting outreach activities for the PT-ISAC or what these activities will entail. Conducting targeted outreach to agencies that are not currently using the PT-ISAC—particularly non-rail agencies, midsized agencies, and agencies that do not have their own dedicated police department—could help to increase awareness and use of this mechanism.

TSA and APTA officials also stated that not all public transit agencies are aware of HSIN and those that are may not view the system as a valuable resource. The results of our survey are consistent with this view and illustrate that public transit agencies’ awareness of HSIN could be increased. For example, less than half of public transit agencies (34 of 77) reported that they had log-in access to HSIN and had not lost or forgotten their log-in information (see table 6).

As with PT-ISAC usage, a greater proportion of large agencies, rail agencies, and agencies that maintain their own dedicated police departments indicated they had log-in access to HSIN and had not lost or forgotten their log-in information (9 of 15 large agencies, 20 of 39 rail agencies, and 17 of 29 agencies with dedicated police departments, as opposed to 25 of 65 midsized agencies, 14 of 41 non-rail agencies, and 17 of 51 agencies without dedicated police departments, respectively). Moreover, our survey also identified that, of the 19 agencies that do not have HSIN access, 12 had never heard of the mechanism, and an additional 11 agencies did not know whether they had access to HSIN. Of the 12 agencies that had never heard of HSIN, nearly all were non-rail agencies (10 of 12), midsized agencies (12 of 12), or agencies without their own dedicated police department (12 of 12).

Multiple entities have a role in conducting outreach to public transit agencies about HSIN. DHS’s Office of Operations, Coordination, and Planning is generally responsible for conducting HSIN outreach, but DHS officials from this office told us that outreach efforts for HSIN-CS, including the HSIN-PT subportal, are under the purview of DHS IP. However, DHS IP officials told us that they are deferring to APTA and TSA (the sector coordinator and sector-specific agency for mass transit, respectively), as described in the NIPP, to conduct outreach to public transit agencies on the HSIN-PT subportal. TSA has conducted some outreach to the public transit industry about HSIN by including HSIN reminders when it distributes security information via E-mail to public transit agencies. However, as table 6 illustrates, past outreach efforts have not resulted in widespread HSIN awareness and use among public transit agencies that we surveyed (particularly midsized agencies, non-rail agencies, and agencies without a dedicated police department), and our survey results suggest that access to HSIN remains a concern. TSA officials stated that the agency recognizes the need for additional outreach to increase public transit agencies’ awareness and use of the HSIN-PT subportal and added that future outreach efforts will depend on the proposed options that arise from the SCC/GCC Information Sharing Working Group. However, there are no time frames for this working group to draft or finalize its proposals for improving information sharing. Conducting targeted outreach to agencies that are not currently using HSIN—particularly non-rail agencies, midsized agencies, and agencies that do not have their own dedicated police department—could help to increase awareness and use of this mechanism.

Regarding the newly-formed TS-ISAC, TSA has conducted initial outreach to increase public transit agencies’ awareness. For example, TSA distributed a TS-ISAC marketing package via E-mail to transportation stakeholders, and TSA officials stated that the agency is outreaching to other DHS components, state and local stakeholders, and other ISACs (in addition to the PT-ISAC). According to TSA data from April 2010, officials from 46 public transit agencies had been granted access to the public transit Web page of the TS-ISAC within the first 4 weeks of its operation. However, we did not collect data from public transit agencies on their awareness or use of the TS-ISAC because it was not implemented until March 2010, after we developed our survey. As a result, we could not determine the extent to which outreach efforts have increased awareness and use of the TS-ISAC in the public transit industry.

Concerns with Accessibility, User- Friendliness, and Information Value May Hinder HSIN from Meeting the Security Information Needs of Public Transit Agencies

Standards for Internal Control in the Federal Government call for agencies to ensure adequate means of communicating with external stakeholders that may have a significant impact on agency goals, and effective information technology management is critical to achieving useful, reliable, and continuous communication of information. However, concerns among public transit agencies about HSIN’s accessibility may reduce its value as a source of security-related information. Industry officials characterized HSIN as a “pull” system that requires users to log in and extract what is relevant to their agency. Security officials at 11 of 27 public transit agencies we interviewed told us they prefer security information to be “pushed” out to them (e.g., through E-mails, phone calls) instead of having to log into a system to retrieve it themselves. APTA officials stated that public transit security personnel do not have time to log into a “pull” system, such as HSIN, every day and sift through excess information to extract what is relevant to their agency. In addition, when a HSIN password expires (which occurs after 90 days for security reasons) users must call the HSIN help desk to obtain a new one. However, the contact information for the HSIN help desk is not located on the main HSIN log-in page, so users may not know how to get help if they experience log-in challenges. Of the 27 agencies we interviewed, 8 indicated they had experienced problems accessing HSIN. In June 2010, DHS implemented a new agency policy to identify HSIN users that have not accessed the system in 180 days and notify them via E-mail every 3 months instructing them to contact the HSIN help desk to obtain a new password. DHS officials also told us that the phone number for the HSIN help desk would be added to the HSIN log-in page, but the agency had not done so as of August 2010.

In addition to accessibility concerns, certain aspects of HSIN are not user- friendly, and the security-related information available on the HSIN-PT subportal is not always valuable to public transit agencies. Of the 11 agencies we interviewed that had access to HSIN and used it to receive security-related information, 5 reported problems with using the system once they logged in. These problems included configuring E-mail alerts to notify them when information is discovered or changed in a particular area of HSIN (e.g., the HSIN-PT subportal). We experienced similar problems using these E-mail alerts. After setting up alerts to notify us when documents are discovered or changed on the HSIN-PT subportal, we received multiple notifications on a near-daily basis with links to outdated documents, such as job announcements last modified in 2007, a threat advisory for the New York City subway system last modified in 2006, and a map of power outages caused by Hurricane Wilma in 2005. Further, we found that security-related information on HSIN that could be useful to public transit agencies was not always posted to the HSIN-PT subportal. For example, in the days following the Moscow subway bombings in March 2010, certain documents pertaining to the attack were available on the HSIN-CS portal, but did not appear on HSIN-PT, despite their direct relevance to public transit agency users. The E-mail alerts we had set up for HSIN-PT did not notify us of any of this information, which included a document describing heightened security measures a large U.S. public transit agency took in response to the Moscow attack. This information could have been of interest to other public transit agencies, but HSIN-PT users would not have known about it unless they logged into the system without an E-mail prompt, navigated to the HSIN-CS portal, and found the information themselves. Based on our survey results—which indicate that only 3 of 77 agencies use HSIN daily—agencies may not have known that information pertaining to the Moscow bombings was available to them on HSIN.

DHS and TSA agree that the HSIN-PT subportal is not widely used by the public transit industry and that improvements are needed. One such improvement is related to DHS’s efforts to develop a replacement system for the HSIN platform, known as HSIN Next Generation. This new system, which DHS began to develop in 2008, is intended to provide increased security and access to SBU information for public transit agencies and other user communities, including law enforcement, intelligence, immigration, and emergency and disaster management. According to DHS officials, the agency intends to move the subportals on HSIN-CS, including HSIN-PT, to the new HSIN Next Generation platform during the last quarter of calendar year 2010. Taking steps to ensure public transit agencies can access and readily use HSIN—and ensuring the HSIN-PT subportal contains security-related information that is of value to these agencies—could help DHS improve HSIN’s capacity to meet public transit agencies’ security-related information needs.

DHS’s Information- Sharing Efforts Could be Enhanced by Developing More Specific Goals and Measures and Obtaining Additional Industry Feedback

DHS and TSA Have Established Goals and Measures Related to Information Sharing, but Their Goals Are Not Specific to Public Transit and Existing Measures May Limit Program Assessment

DHS and TSA have established goals and output-oriented performance measures for their information-sharing activities to help gauge the effectiveness of their overall information-sharing efforts with security stakeholders. However, they have not developed performance goals and outcome-oriented measures to gauge the effectiveness of their information-sharing efforts specific to public transit agencies. Specifically, DHS and TSA have not developed such goals and measures for HSIN-PT and the PT-ISAC—mechanisms designed to serve as the primary information sources for the public transit agencies—or the recently established TS-ISAC. As a result, DHS and TSA may not be fully informed of the effectiveness of their information-sharing activities for the public transit industry. TSA officials recognize the importance of establishing specific goals and developing outcome-oriented measures, but they are in the beginning stages of doing so and could not provide time frames for when they plan to complete these efforts. Table 7, below, details DHS’s current goals and performance measures related to information sharing.

The performance goals and measures established by DHS and TSA are primarily focused on information-sharing efforts with homeland security stakeholders and the transportation community as a whole, and are not specific to their efforts to share security-related information with the public transit industry. TSA has developed some output-oriented performance measures specifically for assessing its efforts to share security-related information with public transit agencies. According to TSA officials, the agency currently tracks: (1) the number of meetings held between the GCC and the Mass Transit SCC and the number of Transit Security and Safety Roundtables; (2) the number of teleconferences it conducts with the peer advisory group and the number of intelligence/information products it releases; and (3) the usage of the public transit subportal on HSIN as an indicator of stakeholders’ interest in the information provided. TSA-OI is also collecting output data to measure the performance of the TS-ISAC, such as the number of users, the length of time each user is logged-on to the site, and the number of times users access information from the Web site.

We have previously reported that decision makers use performance measurement information, including output measures and information on program operations, to help identify problems in individual programs, identify causes of the problems, and modify services or processes to address problems. However, leading management practices emphasize that successful performance measurement focuses on assessing the results of individual programs and activities. We have also previously reported that without effective performance measurement, especially data on program outcomes, decision makers may have insufficient information to evaluate the cost-effectiveness of their activities. While output measures, such as those developed by TSA, are useful because they indicate the quantity of direct services a program delivers, they do not reflect the overall effectiveness of their activities. We recognize and have previously reported on the challenge of assessing the effectiveness of security-related activities such as information sharing and developing outcome-oriented measures, but have called on agencies to take steps towards establishing such measures to hold them accountable for the investments they make. Furthermore, developing such measures provides agencies with valuable information for evaluating the effectiveness of their programs and the extent to which they are meeting their goals.

Furthermore, TSA has not developed specific performance goals or outcome-oriented measures for the PT-ISAC or HSIN-PT, which were both established as primary information-sharing mechanisms for public transit agencies. According to TSA and APTA officials, they plan to develop specific goals and measures for the PT-ISAC through the GCC/SCC Information Sharing Working Group. However, the working group is still finalizing its options for enhancing information-sharing efforts with public transit agencies, including assessing opportunities to streamline existing information-sharing mechanisms, and TSA officials were unable to provide us with time frames concerning the completion of these efforts. In regard to HSIN-PT, TSA has developed an output-oriented performance measure which tracks the number of users of this mechanism; however, this measure provides limited information on which the agency can assess the results and progress of this information-sharing mechanism. TSA-OI, however, has not developed specific goals or outcome-oriented performance measures for HSIN-PT. Moreover, TSA-OI officials reported that for the newly established TS-ISAC, they are focusing on providing security-related products to 100 percent of homeland security stakeholders, including public transit agencies. However, TSA has not developed goals or related performance measures for this mechanism and could not provide time frames for doing so. Once the SCC/GCC Information Sharing Working Group has developed options for improving information sharing with public transit agencies, establishing time frames for developing goals and related, outcome-oriented measures for the PT- ISAC, HSIN-PT, and TS-ISAC could assist TSA in obtaining more meaningful information from which to gauge the effectiveness of these information-sharing mechanisms.

DHS Has Taken Steps to Gather Feedback on Public Transit Agencies’ Satisfaction with the Security-Related Information They Receive, but Has Not Established a Systematic Process for Collecting Such Information

DHS and TSA have taken some steps to gather feedback on public transit agencies’ satisfaction with the security-related information they receive. For example, DHS and TSA developed forms to periodically gather feedback on security-related products from their customers, including public transit agencies. TSA officials also reported that they informally gather feedback during the Transit Security and Safety Roundtables. However, a systematic process for obtaining feedback on the usefulness of the PT-ISAC and HSIN-PT does not currently exist. We have previously reported that agencies with a systematic process for gathering feedback use surveys and other methods to identify the importance or depth of customers’ issues in a single, centralized framework, and integrate the feedback information obtained in a standard and consistent manner. In December 2009, we reported that additional DHS actions to obtain feedback on the utility and quality of information shared could strengthen the department’s efforts in this area. Research of best practices for customer satisfaction suggests that multiple approaches to customer feedback, such as focus groups and complaint programs that provide qualitative and quantitative data, and the integration of feedback data, are needed to effectively listen and understand customers’ needs and to take appropriate action to meet those needs.

In March 2010, DHS I&A began attaching a survey to each of its FOUO intelligence products that are disseminated to all its customers, including state and local partners, who receive FOUO products, to better understand customer information needs. Public transit agencies that receive I&A’s FOUO intelligence products will therefore have an opportunity to provide feedback on the information provided. I&A officials stated that they plan to use these results to better inform them of product usefulness and the security information needs of their customers. In addition, TSA-OI posted a feedback form on the TS-ISAC to gather users’ views, including public transit agencies, on TSA-OI products. However, TSA-OI’s marketing materials on the TS-ISAC did not reference this feedback survey, nor has the agency informed users of this survey’s existence through any other method. In addition, according to TSA-OI officials, this survey was posted shortly after the TS-ISAC was implemented in March 2010, but as of May 27, 2010, TSA-OI had not received any feedback through this survey. Due to the recent timing of these survey efforts, it may be too early to assess the insights that will be provided through this mechanism.

Although TSA officials have established a process to gather user views, including public transit agencies, on TSA-OI products, TSA has not established a systematic process to obtain public transit agencies’ feedback on information shared through the PT-ISAC and through HSIN- PT— the primary mechanisms designed to share security-related information with public transit agencies. Also, as of July 2010, TSA officials stated that they are uncertain about whether or not they will continue to use the TS-ISAC feedback form as a mechanism to gather public transit agency feedback. However, they stated that the agency does not have a systematic process in place to request, collect, and analyze feedback in order to gauge public transit agencies’ overall satisfaction with its information-sharing activities, and that such a process is needed. TSA officials could consider using various survey tools and other methods to assist them in collecting public transit agency feedback, which could better inform them of the effectiveness of their information-sharing efforts. For example, through our survey, we were able to assess the extent to which these public transit agencies used and were satisfied with a variety of information-sharing mechanisms, including TSA mechanisms. DHS’s and TSA’s efforts to share security-related information with public transit agencies could be enhanced by developing a systematic process for gathering feedback on these agencies’ satisfaction with the information they receive.

Conclusions

The recent bombings on the Moscow subway and planned attempts to detonate explosives in the New York City subway system have highlighted the continued threat to public transit systems in foreign countries and in the United States. While the SCC/GCC Information Sharing Working Group’s efforts to enhance information sharing with public transit agencies reflects the joint stakeholder commitment to this area, opportunities for strengthening information sharing exist. Until TSA establishes time frames for the SCC/GCC Information Sharing Working Group to complete its efforts, including assessing opportunities to streamline existing information-sharing mechanisms and conducting targeted outreach efforts to increase awareness of the PT-ISAC and HSIN, the agency is limited in its ability to take further action to strengthen information sharing. In addition, without taking steps to ensure that the PT-ISAC fulfills its responsibilities and completes agreed-upon tasks, TSA and FTA cannot be assured that this mechanism meets the security information needs of public transit agencies. Further, while DHS and TSA are taking steps to improve information sharing with public transit agencies, this effort will not be complete until the accessibility and user- friendliness of HSIN are addressed. Moreover, the HSIN-PT subportal will likely continue to be underutilized until DHS takes steps to ensure that this mechanism contains security-related information that is of value to public transit agencies.

Once the SCC/GCC Information Sharing Working Group develops options for improving information sharing with public transit agencies, it will be important for DHS and TSA to continue with other efforts to strengthen this area of information sharing. Specifically, until DHS establishes time frames for developing goals and related outcome-oriented performance measures for the PT-ISAC, HSIN-PT, and TS-ISAC, the department will be limited in its ability to gauge the effectiveness of its information-sharing efforts with the public transit industry. Finally, while we are encouraged by the department’s efforts to gather feedback on public transit agencies’ satisfaction with the security-related information they receive, a systematic process for obtaining such feedback on the PT-ISAC and HSIN- PT is lacking. Such a process could help DHS and TSA assess the effectiveness of their efforts to share security-related information with public transit agencies.

Recommendations for Executive Action

To help strengthen information sharing with public transit agencies, we recommend that the Secretary of Homeland Security direct the Assistant Secretary for the Transportation Security Administration to take the following action in coordination with FTA and public transit agencies: Establish time frames for the SCC/GCC Information Sharing Working Group to develop options for improving information sharing to public transit agencies and complete this effort, including the Working Group’s efforts to: assess opportunities to streamline existing information-sharing mechanisms that target similar user groups with similar information to reduce overlap, where appropriate; and conduct targeted outreach efforts to increase awareness of the PT- ISAC and HSIN among agencies that are not currently using or aware of these systems.

To help ensure that the PT-ISAC is meeting its objectives for sharing security-related information with public transit agencies, we recommend that the Secretaries of Homeland Security and Transportation direct the Assistant Secretary of the Transportation Security Administration and Administrator of the Federal Transit Administration to take the following action: Take steps to ensure the PT-ISAC fulfills its responsibilities and completes agreed-upon tasks.

To help strengthen DHS’s efforts to share security-related information with public transit agencies, we recommend that the Secretary of Homeland Security take the following three actions: Take steps to ensure that public transit agencies can access and readily utilize HSIN and that the HSIN-PT subportal contains security-related information that is of value to public transit agencies.

Once the SCC/GCC Information Sharing Working Group has developed options for improving information sharing with public transit agencies, establish time frames for developing goals and related outcome- oriented performance measures specific to the PT-ISAC, HSIN-PT, and TS-ISAC.

Develop a process for systematically gathering feedback on public transit agencies’ satisfaction with the PT-ISAC and HSIN-PT.

Agency Comments and Our Evaluation

We provided a draft of this report and its accompanying e-supplement (GAO-10-896SP) to DHS, DOJ, and DOT for review and comments. We received written comments from DHS on the draft report, which are summarized below and reproduced in full in appendix IV. DHS concurred with the report and recommendations and indicated that it is taking steps to address the recommendations. DHS also provided technical comments that we incorporated where appropriate. In an E-mail received September 7, 2010, the FBI liaison stated that the Bureau had no comments on the draft report. DOT did not provide comments on the findings and recommendations but did provide technical comments to the draft report, which we have incorporated where appropriate. DHS, DOJ, and DOT did not provide comments on the e-supplement.

In commenting on the draft report, DHS described the efforts the department has underway or planned to address our recommendations. These efforts are intended to improve information sharing with public transit agencies. However, although the actions DHS reported are important first steps, additional efforts are needed to help ensure that our recommendations are fully implemented, as discussed below. With regard to our first recommendation that TSA coordinate with FTA and public transit agencies to establish time frames for the SCC/GCC Information Sharing Working Group for completing efforts to develop options for improving information sharing to public transit agencies, including assessing opportunities for streamlining existing mechanisms and conducting targeted outreach, DHS stated that TSA is continuing to work with members of the working group to identify options on how to streamline the flow of information and described one such option. According to DHS, the working group has identified at least one product option for streamlining information sharing that would match the needs of stakeholders. This product would be “pushed” out to stakeholders and also be posted on appropriate websites. DHS also stated that TSA is taking steps to improve targeted outreach through collaboration of the Surface Transportation Information Sharing and Analysis Center and the PT-ISAC in the development of periodic intelligence summaries and plans to work with both ISACs, as well as DHS to ensure further outreach is conducted with stakeholders. TSA’s efforts to streamline information sharing with public transit agencies and improve its outreach are important first steps toward improving the information provided to the public transit industry. In order to meet the full intent of our recommendation, TSA should establish time frames for completing these efforts. In addition, TSA did not indicate whether it has identified other options or is considering taking additional steps to streamline existing information sharing mechanisms or how its outreach to public transit agencies will be targeted to those agencies not currently using or aware of these systems. Taking such actions would be necessary to fully address the intent of this recommendation.

Regarding our second recommendation that TSA and FTA take steps to ensure the PT-ISAC fulfills its responsibilities and completes agreed-upon tasks, DHS stated that the purpose for including HSIN-PT content management and other elements currently in the cooperative agreement with APTA/PT-ISAC was to fill gaps in the information sharing process used by the mass transit and passenger rail community. DHS also stated that TSA intends to ensure compliance with the contract elements by “phasing in PT-ISAC contributions and requirements to achieve maximum effectiveness.” TSA’s stated plan for ensuring compliance with contract elements appears to be a positive step. However, DHS’s response did not indicate the specific steps that will be taken to ensure that the PT-ISAC fulfills its responsibilities and completes agreed-upon tasks. Taking such action would more fully address our recommendation.

In regards to our third recommendation that DHS take steps to ensure that public transit agencies can access and readily utilize HSIN and that the HSIN-PT subportal contains security-related information that is of value to public transit agencies, DHS stated that it supports changes to HSIN and the intensification of efforts to expand its use for the broader range of transit and passenger rail agencies. DHS also stated that in fiscal year 2010, the HSIN program increased its efforts to raise the awareness of HSIN through a targeted marketing strategy. DHS also stated that the HSIN program’s requirements management process and operator representation on the HSIN Mission Operators Committee governance board will ensure that public transit sector requirements are assessed, prioritized, and implemented. While DHS’s reported efforts to expand HSIN use with the public transit community are noteworthy, in order to meet the full intent of our recommendation, DHS should also take steps to ensure that public transit agencies can readily access and use HSIN, as we recommended. Additionally, DHS did not clearly identify the actions it will take to ensure that the HSIN-PT subportal contains security-related information that is of value to public transit agencies. Identifying and implementing such steps would be necessary to fully address the intent of our recommendation.

With regard to our fourth recommendation that DHS establish time frames for developing goals and related outcome-oriented performance measures specific to the PT-ISAC, HSIN-PT, and TS-ISAC, DHS agreed that developing outcome-oriented measures for information sharing is important. Specifically, DHS stated that TSA will work with DHS, APTA, and the PT-ISAC to develop a series of goals and measures to assess the effectiveness of its information-sharing efforts. DHS added that these measures, once developed, can be expected to evolve and improve over time as systematic improvements are made. DHS plans to share the developed measures with its stakeholders to obtain their comments. In order to meet the full intent of our recommendation, DHS should establish time frames for developing such goals and measures.

Concerning our fifth recommendation that DHS develop a process for systematically gathering feedback on public transit agencies’ satisfaction with the PT-ISAC and HSIN-PT, DHS stated that updates to HSIN will enable the department to efficiently capture user feedback. DHS also stated that it would need to collaborate with TSA and DOT as well as industry stakeholders to develop additional stakeholder feedback mechanisms. DHS also noted that is will continue to obtain stakeholder feedback through its survey on the TS-ISAC subportal. While the development of the customer survey on the TS-ISAC is an important step in obtaining feedback on the satisfaction of this mechanism, DHS should ensure that its process for gathering feedback on public transit agencies’ satisfaction with the PT-ISAC and HSIN-PT is systematic, as we recommended. Taking such action is necessary to fully address this recommendation.

We are sending copies of this report to the Secretaries of Homeland Security and Transportation, and the Attorney General. The report is also available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4379 or lords@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

This report addresses the following questions: (1) What mechanisms has the federal government established or funded as primary information- sharing sources for public transit agencies? (2) To what extent are public transit agencies satisfied with federal efforts to share security-related information, and how, if at all, can these efforts be improved? (3) To what extent has the Department of Homeland Security (DHS) identified goals for sharing security-related information with public transit agencies and developed measures to gauge its progress in meeting those goals?

To identify the mechanisms established or funded by the federal government to serve as primary information sources for public transit agencies, we reviewed and assessed relevant documentation, such as the Homeland Security Information Network (HSIN) Program Management Plan, and interviewed officials from DHS components including the Office of Infrastructure Protection (IP) within the National Protection and Programs Directorate (NPPD), the Office of Intelligence and Analysis (I&A), the U.S. Coast Guard, and the Transportation Security Administration (TSA), as well as officials from the Federal Transit Administration (FTA) and the Federal Bureau of Investigation (FBI) to discuss the mechanisms they use to share security-related information with public transit agencies. We also conducted site visits, or held teleconferences, with security and management officials from a nonprobability sample of 27 public transit agencies across the nation to determine which mechanisms are most routinely used by these agencies to obtain security-related information. These transit agencies were selected to generally reflect the variety of transit agencies in terms of size, location, transportation mode, and law enforcement presence and represent about 63 percent of the nation’s total public transit ridership based on information we obtained from FTA’s National Transit Database. Because we selected a nonprobability sample of transit agencies to interview, the information obtained cannot be generalized to the overall population of transit agencies. However, the interviews provided illustrative examples of the perspectives of various transit agencies about federal government information-sharing mechanisms and corroborated information we gathered through other means. Table 8 lists the public transit agencies we interviewed.

To assess the satisfaction of public transit agencies with federal security- related information- sharing efforts and related opportunities for improvement, in March and April 2010, we surveyed 96 of the of the 694 U.S. public transit agencies as of 2008, by ridership statistics, on their satisfaction with information-sharing efforts. The 96 public transit agencies surveyed represent about 91 percent of total 2008 ridership. For the purposes of this survey, we defined the six aspects of quality security- related information as (1) relevance (i.e., is the information sufficiently relevant to be of value to a public transit agency?); (2) validity (i.e., is the information accurate?); (3) timeliness (i.e., is information received in a timely manner?); (4) completeness (i.e., does the information contain all the necessary details?); (5) actionability (i.e., would the information allow a public transit agency to change its security posture, if such a change was warranted?); and (6) access/ease of use (i.e., is information available through this mechanism easy to obtain?). To develop the survey instrument, we conducted pretest interviews with four public transit agencies and obtained input from GAO experts. Out of the original population of 96 transit agencies, we received completed questionnaires from 80 respondents—a response rate of 83 percent; however, not all respondents provided answers to every question.

The final instrument, reproduced in an e-supplement we are issuing concurrent with this report—GAO-10-896SP—displays the counts of responses received for each question. The questionnaire asked those public transit officials responsible for security operations to identify the modes of transportation they provide, the extent to which they house their own law enforcement component, the mechanisms they use to obtain security information, and their satisfaction with each of these mechanisms.

While we surveyed 96 agencies of the largest U.S. public transit agencies, and thus our data are not subject to sampling error, the practical difficulties of conducting any survey may introduce other errors in our findings. We took steps to minimize errors of measurement, nonresponse, and data processing. In addition to the questionnaire development and testing activities described above, we made multiple follow-up attempts by E-mail and telephone to reduce the level of nonresponse throughout the survey period. Finally, analysis programs and other data analyses were independently verified.

To further address this question, we assessed relevant documentation, including interagency agreements between TSA and FTA, as well as marketing materials on the Transportation Security Information Sharing and Analysis Center (TS-ISAC). We also interviewed American Public Transportation Association (APTA), Public Transportation Information Sharing and Analysis Center (PT-ISAC), TSA, FBI, FTA, and DHS Operations, Coordination, and Planning Directorate officials to discuss efforts to streamline existing information-sharing mechanisms, oversee the results of the PT-ISAC, and conduct outreach on various information- sharing mechanisms. We compared these efforts to internal control standards, as well as our previous work on the need to consolidate redundant information systems and target outreach efforts. In addition, we interviewed select public transit agencies and included questions in our Web-based survey of public transit agencies on the various information-sharing mechanisms available to them.

To assess the extent to which DHS has identified goals for sharing information with public transit agencies and developed measures to gauge its progress in meeting those goals, we reviewed DHS’s Annual Performance Report, TSA’s Transportation Security Information Sharing Plan (TSISP), and available performance data and measures for fiscal years 2007 through 2010 related to information-sharing efforts with public transit agencies and compared them to leading management practices and our previous work on program assessments. We also interviewed relevant DHS and TSA officials to obtain information on their efforts to revise and develop performance measures and goals for this area of information sharing, as well as their efforts to obtain feedback from public transit agencies on their satisfaction with the security-related information they receive. In addition, we compared TSA’s efforts to evaluate their information-sharing efforts with guidance on performance measurement contained in our previous reports.

We conducted this performance audit from August 2009 through September 2010 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: National Strategies, Plans, and Reports Designed to Enhance Information Sharing

Since the terrorist attacks on September 11, 2001, the federal government has developed strategies to enhance the sharing of terrorism-related information among federal, state, local, and tribal agencies, and the private sector. These strategies include the following: National Strategy for Information Sharing: Issued in October 2007, this strategy identifies the federal government’s information sharing responsibilities. These responsibilities include gathering and documenting the information that state, local, and tribal agencies need to enhance their situational awareness of terrorist threats. The strategy also calls for authorities at all levels of government to work together to obtain a common understanding of the information needed to prevent, deter, and respond to terrorist attacks. Specifically, the strategy discusses the need to improve the two-way sharing of terrorism-related information on incidents, threats, consequences, and vulnerabilities, including enhancing the quantity and quality of specific, timely, and actionable information provided by the federal government to critical infrastructure sectors.

DHS Information Sharing Strategy: Issued in April 2008, this strategy describes the guiding principles for DHS’s efforts to share information within the department, across the federal government, and with state, local, tribal, territorial, private sector, and international partners. Among other things, the strategy notes that DHS must take steps to ensure that the right information gets to the right people at the right time. The strategy also discusses the department’s need to institute performance measures to provide an accurate assessment of the department’s progress towards meeting its information-sharing goals.

The National Infrastructure Protection Plan (NIPP): Updated in 2009, the NIPP is intended to provide the framework for a coordinated national approach to address the full range of physical, cyber, and human threats and vulnerabilities that pose risks to the nation’s critical infrastructure. Among other things, the NIPP names TSA as the primary federal agency responsible for coordinating critical infrastructure protection efforts within the transportation sector and emphasizes the importance and benefits of sharing security-related information with critical sector partners.

Transportation Security Information Sharing Plan (TSISP): Established by TSA in July 2008 pursuant to the 9/11 Commission Act and subsequently updated in December 2009. The stated purpose of the TSISP is to establish a foundation for sharing transportation security information between all entities that have a stake in protecting t transportation system, including federal, state, local, and tribal agencies and governments, the private sector, and foreign partners.

Surface Transportation Security Priority Assessment: Issued in March 2010 by the Administration’s Transborder Security Interagency Policy Committee, Surface Transportation Subcommittee. The study identified 10 issue areas to examine, obtained input from surface transportation sector stakeholders, and analyzed the responses to reach a consensus set of priorities and recommendations related to surface transportation. Among other things, the assessment included a recommendation that that TSA collaborate with DHS and the Department of Transportation (DOT) to more effectively share transportation security information.

Appendix III: Public Transit Agencies’ General Satisfaction with the 12 Most Frequently-Cited Information-Sharing Mechanisms

The table below illustrates, for the public transit agencies we surveyed, the general satisfaction along 6 quality dimensions with the 12 most frequently-cited information-sharing mechanisms. The quality dimensions rated for level of satisfaction were: relevance (i.e., is the information sufficiently relevant to be of value to a public transit agency?); validity (i.e., is the information accurate?); timeliness (i.e., is information received in a timely manner?); completeness (i.e., does the information contain all the necessary details?); actionability (i.e., would the information allow a public transit agency to change its security posture, if such a change was warranted?); and access/ease of use (i.e., is information available through this mechanism easy to obtain?). The numbers in parentheses below each mechanism represent the number of agencies in our survey that indicated they use this mechanism to receive security-related information. For each mechanism and quality dimension, the table indicates (1) the number of agencies that indicated they were either “very satisfied” or “somewhat satisfied” with the information they receive through the mechanism (or, in the case of “access / ease of use,” the mechanism itself); (2) the total number of agencies that provided a response to the question; and (3) the percentage of responding agencies that were generally satisfied. The mechanisms are organized in the order they were presented in the survey.

Appendix IV: Comments from the Department of Homeland Security

Appendix V: GAO Contact and Staff Acknowledgments

Acknowledgments

In addition to the contact named above, Jessica Lucas-Judy, Assistant Director, managed this assignment. Vanessa Dillard, Jeff C. Jensen, Nancy Meyer, Octavia Parks, and Meg Ullengren made significant contributions to the work. Tracey King provided significant legal support and analysis. Stanley J. Kostyla assisted with design and methodology. Carl Ramirez and Joanna Chan assisted with the survey design, implementation, and data analysis. Christopher Currie, Lara Miklozek, and Debbie Sebastian provided assistance in report preparation. Tina Cheng and Robert Robinson developed the report graphic.