Mass transit and passenger rail systems provided 10.7 billion passenger trips in the United States in fiscal year 2008. The nation’s mass transit and passenger rail systems include all multiple-occupancy vehicle services designed to transport customers on local and regional routes, such as transit buses, heavy rail, commuter rail, and light rail services, and the interconnected facilities and vehicles feeding into the transit systems. Buses are the most widely used form of transit, providing almost two- thirds of all passenger trips. Heavy rail systems––subway systems like New York City’s transit system and Washington, D.C.’s Metro—typically operate on fixed rail lines within a metropolitan area and have the capacity for a heavy volume of traffic. Commuter rail systems typically operate on railroad tracks and provide regional service (e.g., between a central city and adjacent suburbs). Light rail systems are typically characterized by lightweight passenger rail cars that operate on track that is not separated from vehicular traffic for much of the way. Mass transit and passenger rail systems in the United States are typically owned and operated by public sector entities, such as state and regional transportation authorities. Amtrak, which reported that it provided 25.8 million passenger trips in fiscal year 2007, operates the nation’s primary intercity passenger rail and serves more than 500 stations in 46 states and the District of Columbia. Amtrak operates over a 22,000 mile network, primarily over leased freight railroad tracks. In addition to leased tracks, Amtrak owns about 650 miles of track, primarily on the “Northeast Corridor” between Boston and Washington, D.C., which carries about two-thirds of Amtrak’s total ridership. Stations are owned by Amtrak, freight carriers, municipalities, and some private entities. Amtrak also operates commuter rail services in certain jurisdictions on behalf of state and regional transportation authorities. Figure 1 identifies the geographic distribution of rail transit systems and Amtrak within the United States. Though not indicated on the map, all of these cities also have bus transit systems. To date, U.S. mass transit and passenger rail systems have not been attacked by terrorists. However, these systems have received heightened attention as several alleged terrorists’ plots have been uncovered, including multiple plots involving systems in the New York City area. Worldwide, mass transit and passenger rail systems have been the frequent target of terrorist attacks. According to the Worldwide Incidents Tracking System maintained by the National Counter-Terrorism Center, from January 2004 to July 2008, there were 530 terrorist attacks worldwide against mass transit and passenger rail targets, resulting in over 2,000 deaths and over 9,000 injuries. Terrorist attacks include a 2007 attack on a passenger train in India (68 fatalities and over 13 injuries); the 2005 attack on London’s underground rail and bus systems (52 fatalities and over 700 injuries); and the 2004 attack on commuter rail trains in Madrid (191 fatalities and over 1,800 injuries). In January 2008, Spanish authorities arrested 14 suspected terrorists who were allegedly connected to a plot to conduct terrorist attacks in Spain, Portugal, Germany, and the United Kingdom, including an attack on the Barcelona metro subway system. The most common means of attack against mass transit and passenger rail systems has been improvised explosive devices (IED), with many of these attacks delivered by suicide bombers. According to transit agency officials, certain characteristics of mass transit and passenger rail systems make them inherently vulnerable to terrorist attacks and therefore difficult to secure. By design, mass transit and passenger rail systems are open (i.e., have multiple access points, hubs serving multiple carriers, and, in some cases, no barriers to access) so that they can move large numbers of people quickly. The openness of these systems can leave them vulnerable because operator personnel cannot completely monitor or control who enters or leaves the systems. In addition, other characteristics of mass transit and passenger rail systems—high ridership, expensive infrastructure (more so for passenger rail than bus), economic importance, and location in large metropolitan areas or tourist destinations––also make them attractive targets for terrorists because of the potential for mass casualties, economic damage and disruption. Moreover, some of these same characteristics make them difficult to secure. For example, the number of riders passing through a subway system––especially during peak hours—may make the sustained use of some security measures, such as airport style passenger screening checkpoints, difficult because the measures could disrupt scheduled service. In addition, multiple access points along extended routes may make securing each location difficult because of the costs associated with such actions. Balancing the potential economic impacts of security enhancements with the benefits of such measures is a difficult challenge. Securing the nation’s mass transit and passenger rail systems is a shared responsibility requiring coordinated action on the part of federal, state, and local governments; the private sector; and passengers who ride these systems. Since the September 11, 2001 attacks, the role of federal agencies in securing the nation’s transportation systems has continued to evolve. In response to the September 11th terrorist attacks, Congress passed the Aviation and Transportation Security Act of 2001, which created TSA within DOT and conferred to the agency broad responsibility for overseeing the security of all modes of transportation, including mass transit and passenger rail. In 2002, Congress passed the Homeland Security Act, which established DHS, transferred TSA from DOT to DHS, and assigned DHS responsibility for protecting the nation from terrorism, including securing the nation’s transportation systems. Within TSA, the office of Transportation Sector Network Management (TSNM) leads the unified effort to protect and secure the nation’s intermodal transportation systems, with divisions dedicated to each transportation mode, including mass transit and passenger rail. Within TSA’s Office of Security Operations, the Office of Multi-modal Oversight manages the Surface Transportation Security Inspection Program which coordinates with TSNM to develop and implement security programs, including strategies for conducting and implementing assessments and other actions in mass transit and passenger rail. In addition, TSA’s Office of Intelligence (TSA- OI) is responsible for collecting and analyzing threat information related to the transportation network, which includes all modes of transportation. TSA is supported in these efforts by other DHS entities such as the NPPD and the Federal Emergency Management Agency’s (FEMA) Grant Programs Directorate and Planning and Assistance Branch. The NPPD is responsible for coordinating efforts to protect the nation’s most critical assets across all 18 industry sectors, including surface transportation. FEMA’s Grant Programs Directorate is responsible for managing DHS grants for mass transit. FEMA’s Planning and Assistance Branch is responsible for assisting transit agencies with how to conduct risk assessments. TSA has issued requirements related to the security of mass transit and passenger rail systems. Specifically, in May 2004, TSA issued security directives that mandated passenger rail agencies and Amtrak to implement certain security measures, such as periodically inspecting passenger rail cars for suspicious or unattended items and reporting potential threats or significant security concerns to appropriate law enforcement authorities and TSA. In addition to these requirements, in August 2007, the 9/11 Commission Act was signed into law, which included provisions that task TSA with security actions related to mass transit and passenger rail security. Among other things, these provisions include mandates for developing and issuing reports on TSA’s strategy for securing public transportation, conducting and updating security assessments of mass transit systems, and establishing a program for conducting security exercises for transit and rail agencies. While TSA is the lead federal agency for overseeing the security of all transportation modes, DOT continues to play a key supporting role in securing mass transit and passenger rail systems. In a 2004 memorandum of understanding (MOU) and a 2005 annex to the MOU, TSA and FTA agreed that the two agencies would coordinate their programs and services, with FTA playing a supporting role by providing technical assistance and assisting DHS with implementation of its security policies, including collaborating in developing regulations affecting transportation security. In particular, FTA has played a role in coordinating and funding security training programs for mass transit and passenger rail employees, and provided dedicated funding to three federal training providers to implement mass transit and passenger rail employee training programs. Additionally, FTA administers the State Safety Oversight program and may withhold federal funding for states’ noncompliance with regulations governing state safety oversight agencies. As part of this program, state safety oversight agencies are responsible for reviewing and approving rail transit agencies’ safety and security plans, among other activities. FTA also promotes mass transit and passenger rail safety and security by providing funding for research, technical assistance, and technology demonstration projects. In addition to FTA, DOT’s FRA also has regulatory authority over commuter rail operators and Amtrak and employs over 400 inspectors who periodically monitor the implementation of safety and security plans at these systems. FRA regulations require railroads that operate intercity or commuter passenger train service or that host the operation of that service to adopt and comply with a written emergency preparedness plan approved by FRA. State and local governments, mass transit and passenger rail operators, and private industry are also important stakeholders in the nation’s mass transit and passenger rail security efforts. State and local governments, in some cases, own or operate a significant portion of mass transit and passenger rail systems. Consequently, the responsibility for responding to emergencies involving systems that run through their jurisdictions often falls to state and local governments. Although all levels of government are involved in mass transit and passenger rail security, the primary responsibility for securing the systems rests with the mass transit and passenger rail operators. These operators, which can be public or private entities, are responsible for administering and managing transit activities and services, including security. They can also directly operate the security service provided or contract for all or part of the total service. We discuss security actions taken by federal agencies and mass transit and passenger rail system operators later in this report. In recent years, we, along with the Congress, the executive branch, and the 9/11 Commission have recommended that federal agencies with homeland security responsibilities utilize a risk management approach to help ensure that finite national resources are dedicated to assets or activities considered to have the highest security priority. We have concluded that without a risk management approach, there is limited assurance that programs designed to combat terrorism would be properly prioritized and focused. Thus, risk management, as applied in the homeland security context, can help to more effectively and efficiently prepare defenses against acts of terrorism and other threats. Homeland Security Presidential Directive 7 (HSPD-7) directed the Secretary of Homeland Security to establish uniform policies, approaches, guidelines, and methodologies for integrating federal infrastructure protection and risk management activities. Recognizing that each sector possesses its own unique characteristics and risk landscape, HSPD-7 designates federal government sector specific agencies (SSA) for each of the critical infrastructure sectors that are to work with DHS to improve critical infrastructure security. On June 30, 2006, DHS released the National Infrastructure Protection Plan (NIPP), which created—in accordance with HSPD-7—a risk-based framework for the development of SSA strategic plans. As the SSA for transportation, TSA developed the Transportation Systems—Sector Specific Plan (TS-SSP) in 2007 to document the process to be used in carrying out the national strategic priorities outlined in the NIPP and the National Strategy for Transportation Security (NSTS). The TS-SSP contains supporting modal implementation plans for each transportation mode, including mass transit and passenger rail, which provides information on current efforts to secure mass transit and passenger rail, as well as TSA’s overall goals and objectives related to mass transit and passenger rail security. The NIPP defines roles and responsibilities for security partners in carrying out critical infrastructure and key resource (CI/KR) protection activities through the application of risk management principles. Figure 2 illustrates the several interrelated activities of the risk management framework as defined by the NIPP. The NIPP requires that federal agencies use this information to inform the selection of risk-based priorities and the continuous improvement of security strategies and programs to protect people and critical infrastructure by reducing the risk of acts of terrorism. Within the risk management framework, the NIPP also establishes baseline criteria for conducting risk assessments. According to the NIPP, risk assessments are a qualitative and/or quantitative determination of the likelihood of an adverse event occurring and are a critical element of the NIPP risk management framework. Risk assessments can also help decision makers identify and evaluate potential risks so that countermeasures can be designed and implemented to prevent or mitigate the potential effects of the risks. The NIPP characterizes risk assessment as a function of three elements: Threat: The likelihood that a particular asset, system, or network will suffer an attack or an incident. In the context of risk associated with a terrorist attack, the estimate of threat is based on the analysis of the intent and the capability of an adversary; in the context of a natural disaster or accident, the likelihood is based on the probability of occurrence. Vulnerability: The likelihood that a characteristic of, or flaw in, an asset, system, or network’s design, location, security posture, process, or operation renders it susceptible to destruction, incapacitation, or exploitation by terrorist or other intentional acts, mechanical failures, and natural hazards. Consequence: The negative effects on public health and safety, the economy, public confidence in institutions, and the functioning of government, both direct and indirect, that can be expected if an asset, system, or network is damaged, destroyed, or disrupted by a terrorist attack, natural disaster, or other incident. Information from the three elements that assess risk—threat, vulnerability and consequence—can lead to a risk characterization and provide input for prioritizing security goals. Since 2004, federal and industry stakeholders have conducted assessments of individual elements of risk—threat, vulnerability and consequence— and this information has informed TSA’s mass transit and passenger rail security strategy. However, TSA could strengthen its approach by using and combining this information to conduct a risk assessment of the mass transit and passenger rail system and by updating its strategy to include characteristics that we identified as desirable practices for successful national strategies and to more fully address elements that are outlined in Executive Order 13416: Strengthening Surface Transportation Security. While federal and industry stakeholders have conducted assessments of individual elements of risk—threat, vulnerability, and consequence—TSA could strengthen its security approach by using and combining this information to conduct a risk assessment of the mass transit and passenger rail system. A risk assessment, as required by the NIPP, involves assessing each of the three elements of risk and then combining them together into a single analysis. Since 2004, federal agencies have conducted a range of assessment activities related to the individual elements of risk to help determine their strategy for securing mass transit and passenger rail systems, and provided guidance to mass transit and passenger rail agencies on how to conduct assessments of individual elements of risk. For example, DHS’s threat assessments considered potential threats to the mass transit and passenger rail system, while vulnerability assessments focused on mass transit and passenger rail systems’ security conditions or specific infrastructure such as tunnels. In addition to DHS assessments, DOT provided assistance to mass transit and passenger rail agencies on how to conduct threat and vulnerability assessments, and transit agencies have reported conducting risk assessments for their own systems or assets. See table 1 for a summary of federal and industry stakeholders’ assessment activities related to individual elements of risk. As table 1 shows, DHS developed the Strategic Homeland Infrastructure Risk Assessment (SHIRA) that assessed risk across 18 CI/KR sectors. To develop SHIRA, DHS collaborated with members of the intelligence community to determine threats against various systems and assets in the 18 CI/KR sectors. TSA then assessed the vulnerabilities and consequences that resulted from these threat scenarios and provided this information to HITRAC. Although TSA contributed to DHS’s risk assessment effort, it has not conducted its own risk assessment of mass transit and passenger rail systems. TSA officials explained that the threat scenarios that SHIRA provided were general and not specific to mass transit and passenger rail. TSA could, however, use the information it provided for SHIRA to support a risk assessment. Table 1 also shows that mass transit and passenger rail agencies, including Amtrak, have reported conducting risk assessments of their own systems. Officials from 26 of 30 of the transit systems we visited stated that they had conducted their own assessments of their systems, including risk assessments. For example, one transit agency official stated that the agency had conducted risk assessments of its stations since 2003 and had updated them every 2 years. The official explained that his agency uses the risk assessment results to conduct cost benefit analyses that the agency uses before instituting new programs or purchasing equipment for its system. He also said that the assessments help the agency track risk reduction as a result of its security investments. Additionally, Amtrak officials stated that they conducted a risk assessment of all of their systems. As part of the assessment, Amtrak contracted with a private consulting firm to provide a scientific basis for identifying critical points at stations that might be vulnerable to IED attacks or that are structurally weak. Amtrak officials also stated that they gather and analyze threat information obtained from various classified and unclassified sources such as DHS, TSA, and the Federal Bureau of Investigation’s Joint Terrorism Task Force. Transit agencies have also received assistance in the form of either guidance or actual risk assessments from several federal and industry stakeholders. Table 2 identifies the various assistance programs available to transit agencies for risk assessment efforts. As table 2 shows, federal and industry stakeholders also provided assistance to transit agencies on how to assess risk. For example, FTA provided on-site technical assistance to the nation’s 50 largest transit agencies (i.e., those transit agencies with the highest ridership) on how to conduct threat and vulnerability assessments, among other technical assistance needs, through its Security and Emergency Management Technical Assistance Program (SEMTAP). According to FTA officials, although FTA continues providing technical assistance to transit agencies, the on-site SEMTAP program concluded in July 2006. Furthermore, FTA officials stated that on-site technical assistance was transferred to TSA when TSA became the lead agency on security matters for mass transit and passenger rail. Also, from 2004 though 2007, the former DHS Office of Domestic Preparedness (ODP), through a private consulting firm, provided assistance to transit agencies on how to conduct risk assessments through the Mass Transit Technical Assistance Program. Within this program, ODP developed a Transit Risk Assessment Methodology (TRAM) tool kit that provided transit agencies with an instrument to compare relative risks of terrorism against critical assets to better identify and prioritize security enhancements to reduce those risks. We reported in 2005 that officials from transit agencies participating in the Mass Transit Technical Assistance Program valued it and stated that the program was successful in helping them to devise risk-reduction strategies to guide security-related investments. Subsequently, since the restructuring of ODP in 2007, this program has been transferred to FEMA’s Planning and Assistance Branch where it has continued assisting transit agencies with risk assessments. However, according to FEMA’s Chief of the Planning and Assistance Branch, because of the high cost of the program—$300,000 to $600,000 per transit agency—the rate of assistance to transit agencies has decreased annually. Also, FEMA is trying to convert the focus of the program from technical assistance to training. As such, FEMA plans to educate transit agencies on how to conduct risk assessments. Additionally, the same FEMA official reported that FEMA is also in the process of conducting a pilot project with one transit agency to evolve the program and the tool kit to an all hazards focus. Furthermore, recognizing the value of this program, officials from four of the 30 transit agencies we interviewed have since contracted with the same private consulting firm that ODP and FEMA used to update security plans or conduct a cost-benefit analysis of new programs or equipment. TSA has reported conducting annual threat assessments of the mass transit and passenger rail systems, and these assessments have provided TSA with an array of information about potential threats to the systems. TSA is responsible for conducting and issuing an annual threat assessment report for the mass transit and passenger rail systems. While it has been widely reported that no specific threats to the mass transit and passenger rail systems currently exist, it has been noted that terrorists tend to target these systems, as overseas attacks on mass transit and passenger rail systems have demonstrated. TSA’s Mass Transit Modal Annex identified numerous potential threats to mass transit, including placing a vehicle bomb near a station or track or introducing an IED or lower-yield explosive in a station, train, or bus, or laying explosives on a track. Deploying conventional or improvised explosives would likely result in scores of casualties. Since IEDs were used in the majority of the recent overseas attacks against mass transit and passenger rail systems, TSA and other experts are concerned that extremists may be motivated to employ similar tactics to target mass transit and passenger rail systems. In its Modal Annex, TSA also noted that the threat to heavy and commuter rail (i.e., underground, subway, elevated, rapid rail, or metro) is higher than the threat to buses and light rail (i.e., street cars, trolley) because of the accessibility of the large numbers of people typically found in the confined spaces of a rail system. Several DHS components, including TSA, conducted assessments related to vulnerability and consequence since 2004, which have highlighted areas for security improvement. For example, DHS S&T conducted vulnerability assessments of transit tunnels as well as assessments of the potential consequences that various types of explosives threats would have on tunnel structures (which showed that improving evacuation plans and emergency response efforts, among other things, would improve public safety). Additionally, TSA has gathered vulnerability data through such programs as the Baseline Assessment for Security Enhancement (BASE). TSA officials reported that the BASE assesses the security posture of a mass transit or passenger rail system against the Security and Emergency Management Action Items and is TSA’s primary source of vulnerability information. For example, through initial assessments of the BASE program, TSA officials identified the need for increased security training at mass transit and passenger rail systems. Furthermore, FEMA has calculated consequence information for mass transit and passenger rail by using proxy data, such as population and national infrastructure indices. This information has been incorporated into the Transit Security Grant Program (TSGP). TSA officials also reported using population density and ridership data as information for consequence assessments for mass transit and passenger rail systems and stated that they consider the number of potential casualties when determining consequence, and as a result, have chosen to focus their security efforts on the mass transit and passenger rail systems carrying the most passengers. Officials also mentioned that other factors such as the nature of the infrastructure (underground, underwater tunnels), time of day, and number of mass transit and passenger rail lines are also considered when assessing consequence. TSA has used these various threat, vulnerability, and consequence assessments to inform its security strategy for mass transit and passenger rail—the Mass Transit Modal Annex. TSA reported that its efforts to inform its strategy included using information from TSA-OI’s annual mass transit threat assessment report to, for example, highlight the greater threats to underground and underwater passenger rail segments within a transit system. TSA also reported incorporating into its strategy information identified through its BASE reviews, such as the need for increased security training at mass transit and passenger rail systems. While TSA reported using these various assessments to inform its mass transit and passenger rail security strategy, it could further strengthen its approach for securing these systems by combining the results from these assessments to conduct a risk assessment of the mass transit and passenger rail systems. Both the NIPP and TS-SSP establish a risk management framework that includes a process for considering threat, vulnerability, and consequence assessments together to determine the likelihood of a terrorist attack and the severity of its impact. The NIPP states that after the three elements of risk have been assessed, they are factored numerically and combined mathematically to provide an estimate of the expected loss considering the likelihood of an attack or other incident. It also states that when numerical values are not practical, scales could be used to estimate threat, vulnerability, and consequence. Thus, risk can be measured either quantitatively (i.e., numerically) or qualitatively (i.e., descriptively). However, rather than using the methodology established in the NIPP for assessing risk, TSA officials stated that the agency uses an intelligence-driven approach to make strategic investment decisions across the transportation system. Within this intelligence-driven approach for the sector, TSA also developed a tactical, threat-based process known as Objectively Measured Risk Reduction (OMRR) at the program level to help each of its individual divisions manage their day-to-day security operations. These approaches differ from the NIPP in part because they rely primarily on intelligence information to identify threats, prioritize tactics, and guide long-term investments, rather than systematically assessing the vulnerabilities and consequences of a range of threat scenarios. In March 2009, we recommended that TSA work with DHS to validate its risk management approach by establishing a plan and time frame for assessing the appropriateness of TSA’s intelligence-driven risk management approach for managing risk and document the results of this review once completed. TSA concurred with this recommendation. TSA officials stated that they plan to revise and reissue the TS-SSP, as required by DHS, to reflect the adoption of their intelligence-driven methodology. As on June 2009, TSA reported that the update of the TS-SSP is ongoing, with the goal of completing the effort in 2009. Until TSA works with DHS to validate its risk management approach, TSA lacks assurance that its approach provides the agency and DHS with the information needed to guide investment decisions to ensure resources are allocated to the highest risks. Moreover, as we reported in March 2009, although intelligence is necessary to inform threat assessments, it does not provide all of the information needed to assess risk, in particular information related to vulnerability and consequence assessments. In addition, the intelligence- driven approach that TSA uses may be limited because, in contrast with practices adopted by the intelligence community, TSA officials do not plan to assign uncertainty or confidence levels to the intelligence information it uses to identify threats and guide long-range planning and strategic investment. Both Congress and the administration have recognized the uncertainty inherent in intelligence analysis and have required analytic products within the intelligence community to properly caveat and express uncertainties or confidence in analytic judgments. Furthermore, while intelligence can and does help the U.S. security community on an operational or tactical level, uncertainty in intelligence analysis limits its utility for long-range planning and strategic investment. Without expressing confidence levels in its analytic judgments, it will be difficult for TSA to correctly prioritize its tactics and long-term investments based on uncertain intelligence. In March 2009, we recommended that the Assistant Secretary of TSA work with the Director of National Intelligence to determine the best approach for assigning uncertainty or confidence levels to analytic intelligence products and apply this approach to intelligence products. TSA officials agreed that they do not have a risk assessment and expressed the desire to conduct one; however, they reported that a lack of resources and other factors made completing a risk assessment challenging. For example, TSA officials stated that comprehensive vulnerability and consequence assessments are cost-prohibitive and time-intensive to conduct. Specifically, according to TSA officials, the Security Analysis and Action Program conducted by surface inspectors, a program that identifies, among other things, transit agencies’ vulnerabilities can take days to complete resulting in a large resource investment. However, the 9/11 Commission Act requires TSA to use existing relevant assessments developed by federal and industry stakeholders, as appropriate, to develop a risk assessment for rail, including passenger rail. Furthermore, as suggested by the NIPP, agencies should consider existing risk measures when assessing risk. In addition to using the information for SHIRA, TSA could use other risk assessments, such as industry stakeholders’ risk assessments and federal and industry stakeholders’ guidance on how to conduct risk assessments, to potentially support a risk assessment of the mass transit and passenger rail systems. Despite the challenges that TSA officials reported, it is important to note that risk assessment is an accepted and required practice with a long history of use in a wide variety of public and private sector organizations. Completing a risk assessment would provide TSA greater assurance that it is directing its resources toward mitigating the highest priority risks. Moreover, other agencies conduct risk assessments based on threat, vulnerability, and consequences and have overcome the challenges TSA cited. For instance, within DHS, the U.S. Coast Guard, and FEMA use risk assessment methodologies to inform resource allocation. The U.S. Coast Guard, which is responsible for securing the maritime transportation mode, conducts risk assessments using its Maritime Security Risk Analysis Model (MSRAM). Coast Guard units use the Maritime Security Risk Analysis Model to assess the risk of terrorist attack based on scenarios—a combination of target and attack mode— in terms of threats, vulnerabilities, and consequences to more than 18,000 targets. The model combines these assessments and provides analysis to identify security priorities and support risk management decisions at the strategic, operational, and tactical levels. The tool’s underlying methodology is designed to capture the security risks facing different types of targets spanning every DHS CI/KR industry sector, allowing comparison between different targets and geographic areas at the local, regional, and national levels. In conducting assessments, the Coast Guard Intelligence Coordination Center quantifies threat as a function of intent (the likelihood of terrorists seeking to attack), capability (the likelihood of terrorists having the resources to attack), and presence (the likelihood of terrorists having the personnel to attack). Intelligence Coordination Center officials stated that the Coast Guard uses MSRAM to inform allocation decisions, such as the local deployment of resources and grants. In June 2008, we reported that FEMA used a reasonable risk assessment methodology—based on a definition of risk as a function of threat, vulnerability, and consequence—to determine grant funding allocations under the Homeland Security Grant Program. We found that this program utilized a reasonable methodology to assess risk and allocate grants to states and urban areas even though its assessment of vulnerability was limited. The risk assessment methodology used by FEMA is based on assessments of the threat, vulnerability, and consequence of a terrorist attack to each state and the largest urban areas. FEMA’s methodology estimates the threat to geographic areas based on terrorists’ capabilities and intentions, as determined by intelligence community judgment and data on credible plots, and planning and threats from international terrorist networks. Because this threat information is recognized as uncertain, threat accounts for 20 percent of the total risk to a geographic area, while vulnerability and consequence account for 80 percent. Moreover, the NIPP states that implementing protective programs based on risk assessment and prioritization enables DHS, sector-specific agencies, and other security partners to enhance current CI/KR protection programs and develop new programs where they will offer the greatest benefit. By conducting a risk assessment, TSA would be able to better prioritize risks as well as more confidently assure that its programs are directed toward the highest priority risks. TSA’s Mass Transit Modal Annex contains some information that is consistent with our prior work on characteristics of a successful national strategy and that is called for by Executive Order 13416: Strengthening Surface Transportation Security. However, the Modal Annex could be strengthened by including additional information that could help TSA and other implementing parties better leverage their resources to achieve the strategy’s vision of protecting mass transit and passenger rail systems from terrorist attacks. In February 2004, we identified six characteristics of successful national strategies. Additionally, the Executive Order calls for the Secretary of Homeland Security to develop modal annexes for each transportation sector that includes certain elements, many of which are similar to the national strategy characteristics. Table 3 provides a brief description of five of the national strategy characteristics and relevant Executive Order elements that are discussed further below. The Modal Annex contains information related to three of the characteristics we identified as desirable characteristics for a successful national strategy: (1) purpose, scope and methodology; (2) organizational roles, responsibilities, and coordination; and (3) integration and implementation. For example, the organizational roles, responsibilities, and coordination characteristic, which is also an element in Executive Order 13416, calls for agencies to identify which organizations are to implement the strategy, their roles and responsibilities, and the mechanisms for collaborating. The Modal Annex generally addresses this characteristic as it identifies relevant stakeholder roles and responsibilities. Specifically, the Modal Annex states that TSA has primary responsibility for ensuring security for mass transit and passenger rail while other federal and industry stakeholders, such as the FTA, FRA, FBI, private sector, and transit labor representatives have partnership roles. The Modal Annex also describes stakeholders’ collaboration efforts. For example, it describes FTA, FRA, APTA, and transit operators’ involvement in the development and implementation of security standards and directives. See appendix III for more information on the characteristics the Modal Annex includes. The Modal Annex, however, could be strengthened by addressing the other two desirable characteristics of an effective national strategy: (1) goals, subordinate objectives, activities, and performance measures and (2) resources and investments. Both of these could be useful in achieving the vision articulated in the Modal Annex of securing the mass transit and passenger rail systems. In conformance with this characteristic, the Modal Annex identifies sector- wide goals that apply to all modes of transportation as well as subordinate objectives specific to mass transit and passenger rail systems. For instance, one of TSA’s transportation sector goals is to enhance resiliency of the U.S. transportation system and presents three subordinate objectives to demonstrate how the agency intends to meet this goal. Further, for each subordinate objective, TSA presents information to explain what TSA, other federal components, or industry stakeholders are doing to meet the subordinate objective. For example, the agency identifies its Explosives Detection Canine Teams as an activity to accomplish assessing, managing, and reducing risk associated with key modes, links, and flows within critical transportation systems. Table 4 provides a complete list of the TSA’s goals and their subordinate objectives for the mass transit and passenger rail systems. While the Modal Annex identifies goals, objectives, and activities, it does not contain measures or targets on the effectiveness of the operations of the security programs identified in the Modal Annex. For example, one of TSA’s security programs listed in the Modal Annex—Security Technology Deployment––aligns under one of the sector goals: prevent and deter acts of terrorism using or against the transportation system. However, the Modal Annex contains no measures or targets to assess the effectiveness of this program in achieving this goal. In August 2006, we reported that performance measures are an important tool to communicate what a program has accomplished and provide information for budget decisions. Further, we noted that it is desirable for these measures to be as effective as possible in helping to explain the relationship between resources expended and results achieved because agencies that understand this linkage are better positioned to allocate and manage their resources effectively. Although the Modal Annex does not contain specific measures or targets, it does call for developing measures of effectiveness to evaluate mass transit and passenger rail efforts to mitigate risk and increase the resilience of systems and assets. TSA has developed performance measures to track the progress that the surface transportation security program has made in conducting activities to enhance the security of the mass transit and passenger rail systems. Specifically, TSA’s Surface Transportation Security Inspection Program fiscal year 2009 Annual Inspection Plan identifies annual and quarterly performance metrics for conducting mass transit and passenger rail-related assessments that TSA plans nationwide: number of inspections conducted per 1,000 inspector work hours on mass transit, passenger rail, and freight rail systems and number of BASE reviews conducted at the top 100 largest transit agencies. While these measures are useful in tracking activities or actions taken, they are output measures that do not fully inform TSA about how various actions have impacted the security of mass transit and passenger rail systems’ goals and objectives. For example, TSA has so far reported the progress in its Visible Intermodal Prevention and Response (VIPR) program in terms of the number of VIPR operations TSA conducted, but has not yet developed measures or targets to report on the effectiveness of the operations themselves. However, in June 2009, TSA program officials reported that they are planning the introduction of additional performance measures for no later than the first quarter of fiscal year 2010. These measures would gather information on (1) interagency collaboration by collecting performance feedback from federal, state and local security, law enforcement, and transportation officials prior to and during VIPR deployments; and (2) stakeholder views on the effectiveness and value of the VIPR deployment. In February 2009, TSA reported plans to introduce its first outcome measures for its mass transit and passenger rail security programs. For example, TSA plans to introduce a performance measure for its BASE review program. TSA officials reported that they plan to calculate this measure by comparing the results from the first and second round BASE reviews for the nation’s top 100 largest transit mass transit and passenger rail systems. TSA also reported plans to introduce additional outcome performance measures in the future, including an overall risk reduction measure tied to the BASE program. Implementing these new performance measures and including them in future updates of the Mass Transit Modal Annex should better inform decision makers at TSA on the effect of its programs in securing mass transit and passenger rail. While the Modal Annex identifies how TSA has allocated funds available to different transit agencies, the Modal Annex provides relatively few details on how grant resources should be targeted. Also, the Modal Annex contains little information on resources and costs associated with mass transit and passenger rail security programs. For example, the Modal Annex identifies as its third sector-goal, as shown on table 4, improve the cost-effective use of resources for transportation security; however, it provides few details on the costs, types, or levels of resources associated with implementation of the security programs that are aligned with this goal. Furthermore, the Modal Annex describes risks to the mass transit and passenger rail systems by discussing overseas attacks and the potential consequences of such attacks in the United States. However, the Modal Annex does not provide information on the cost of the consequences of such attacks and is silent on risk assessment efforts. TSA officials acknowledged the lack of this information and the need to include it in future updates of the Modal Annex. While providing cost estimates may be difficult to do, including resources and costs, to the extent possible, would help implementing parties allocate budgets according to priorities and constraints, and would help stakeholders shift such investments and resources as appropriate. Since 2004, federal and industry stakeholders have implemented several key actions to strengthen the security of the nation’s mass transit and passenger rail systems and federal actions have generally been consistent with TSA’s security strategy. However, federal efforts are largely in the early stages and opportunities exist for TSA to strengthen some programs. Since 2004, federal stakeholders have taken a number of key actions to secure mass transit and passenger rail systems and TSA has been the primary federal agency involved in implementing these actions. In general, these actions can be categorized into three areas: (1) deploying surface inspectors and other personnel to conduct voluntary security assessments and security operations at the nation’s largest mass transit and passenger rail systems; (2) establishing and implementing coordination mechanisms between federal entities and mass transit and passenger rail industry stakeholders; and (3) coordinating with the DHS Science and Technology Directorate (DHS S&T) to develop and test new security technology appropriate for deployment in mass transit and passenger rail systems. Since 2004, TSA’s primary security activity for mass transit and passenger rail has been conducting voluntary security assessments of the nation’s top 100 largest mass transit and passenger rail systems through its BASE program. TSA has used the BASE results to inform the development of security enhancement programs and to determine priorities for allocating mass transit and passenger rail security grants. In addition, through its VIPR program and its National Explosive Detection Canine Team Program (NEDCTP), TSA has deployed personnel and explosive detection canine teams to augment mass transit and passenger rail systems’ security forces to conduct hundreds of random and event-based security operations as a show of force to deter potential terrorist attacks at key mass transit and passenger rail stations. Federal agencies have taken other actions as well to strengthen security by enhancing coordination with transit industry stakeholders. For example, TSA established the monthly Transit Policing and Security Peer Advisory Group (PAG) and FTA initiated the semi-annual Transit Safety and Security Roundtables, both of which provide forums for TSA and mass transit and passenger rail systems, including Amtrak, to share security information and ideas. Additionally, FTA has enhanced mass transit and passenger rail security by funding the development and delivery of security training curriculum and programs for mass transit and passenger rail system employees, and by developing a list of recommended security and emergency action items for mass transit security programs, which it later updated in collaboration with TSA. TSA also collaborates with DHS S&T to pursue research, development, and testing of new security technology appropriate for deployment in mass transit and passenger rail systems. In 2006, DHS reorganized its security technology research and development structure, and under the new structure, TSA is to identify technology priorities to address security gaps and communicate these priorities to DHS S&T, which in turn is to conduct technology research, development, and testing. Table 5 provides descriptions of key federal programs and activities, initiated since 2004, mostly by TSA and FTA, to enhance mass transit and passenger rail system security. For a more extensive list of federal programs and activities, see appendix IV. Federal actions to secure mass transit and passenger rail systems generally have been consistent with those that TSA outlined in its security strategy for mass transit, the Mass Transit Modal Annex. The Modal Annex describes TSA’s strategic objectives and associated federal programs and activities to meet these objectives. For example, one objective calls for conducting security readiness assessments, which TSA has been doing since August 2006 through its BASE review program. Another objective calls for a public awareness program, which TSA reported implementing through its Employee Awareness Poster Program. See appendix V for a list of all of the Modal Annex mass transit objectives and TSA’s reported actions to achieve these objectives. Mass transit and passenger rail systems, including Amtrak, reported taking key actions since 2004 to improve their security. Most systems reported making operational enhancements to their security programs, such as adding security personnel or transit police. Moreover, some of the largest systems have implemented varying types of random passenger or baggage inspection screening programs. These programs include deploying security personnel at checkpoints to conduct visual observation of passengers for suspicious behaviors as well as non-invasive baggage checks. Since 2004, Amtrak reported taking additional actions to secure its system, focusing particularly on securing stations on its Northeast Corridor. Among other things, Amtrak introduced new passenger and baggage screening operations, increased its own explosive detection canine capacity, and deployed an armed mobile tactical team to respond to threats and conduct deterrent operations. Further, Amtrak provided security training to all of its frontline employees and conducted additional security risk assessments on its system as the baseline for developing its corporate security strategy. Officials from 24 of 25 passenger rail systems we interviewed and Amtrak also reported taking actions to strengthen the security of their systems in response to TSA’s 2004 passenger rail security directives. These actions included removing trash receptacles from high-risk platform areas and deploying explosive detection canine units to patrol their systems. Amtrak also initiated identification checks for adult passengers. However, TSA’s security directives contained limited requirements for passenger rail, and TSA has not enforced their implementation. Additionally, TSA released a report summarizing results of the BASE reviews it had conducted of mass transit and passenger rail systems during fiscal year 2007. This report showed that almost all transit agencies reported providing some type of security training to their frontline employees; however, the extent of the training provided varied greatly—with a majority providing an introductory level of safety and security training for new hires, but not refresher training. Many mass transit and passenger rail agencies also reported making capital improvements to secure their systems. For example, since 2004, 19 of the 30 transit agencies we interviewed had embarked on programs to upgrade their existing security technology, including upgrading closed- circuit television at key station locations with video surveillance systems that alert personnel to suspicious activities and abandoned packages and installing chemical, biological, radiological, nuclear, and explosives detection equipment and laser intrusion detection systems in critical areas. For bus transit agencies, capital improvements have included installing automatic vehicle location tracking, silent alarms, and engine disabling systems to counter potential hijacking threats. While mass transit and passenger rail systems as a whole have taken actions to enhance their security, TSA’s BASE reviews indicated that rail transit agencies were implementing a wider range of security programs than bus only transit agencies. For example, according to TSA’s initial findings from its BASE reviews of the 50 largest transit agencies, conducted during fiscal year 2007, rail transit agencies implemented more of the TSA/FTA security and emergency management action items than bus-only systems. TSA officials attributed the differences to three factors. First, passenger rail agencies have been required to comply with FTA’s triennial State Safety Oversight audits that require passenger rail agencies to have both a safety and security plan in place and TSA’s 2004 security directives. In contrast, bus-only transit agencies have not been required to implement such FTA security requirements, and no federal agency has issued bus-specific security requirements or directives. Second, bus-only transit agencies tend to be smaller than rail only or rail and bus transit agencies and have fewer financial resources available to invest in security activities. Finally, because passenger rail has been the target of recent high profile terrorist attacks overseas and rail is considered a higher security risk to terrorist attack than bus-only systems, passenger rail transit security has received greater focus—both by the transit industry and the federal government. As part of its research and development (R&D) strategy, DHS has been exploring new explosive detection technologies, particularly those that deter, detect, defeat, and protect against the use of IEDs in or around transit infrastructure. Accordingly, DHS technology pilot projects for mass transit and passenger rail have sought to identify and develop technologies that can effectively detect explosive weapons or compounds while causing minimal delays to passengers, such as fare card vending machines capable of detecting explosive residue on passengers’ bodies or bags (see figure 3). Although DHS has worked to develop some security technologies specific to mass transit and passenger rail systems, most technologies that it has pursued could work across different transportation modes, including aviation, maritime, mass transit, and passenger rail. DHS has also pursued several infrastructure protection projects that address the threat of IEDs, with a particular focus on addressing the vulnerabilities of underground and underwater transit tunnels. Unlike its role in commercial aviation, TSA does not procure or deploy security technologies for mass transit and passenger rail systems. Instead, TSA partners with mass transit and passenger rail systems to conduct pilot projects and demonstrations of commercially available technologies and technologies from DHS laboratories. The mass transit and passenger rail systems themselves determine which security technologies to procure and deploy. See appendix VI for a list of ongoing and completed TSA and DHS mass transit and passenger rail security-related technology pilot programs. Since 2007, TSA, like other DHS components, has been responsible for articulating the technology needs of all transportation sector end-users— including mass transit and passenger rail agency operators—to DHS S&T for development. TSA has taken some initial actions to reach out to mass transit and passenger rail systems regarding their security R&D needs; however, these efforts could be expanded and improved by more fully leveraging existing forums to solicit a wider range of input. This effort is important because, as we reported in September 2004, stakeholders are more likely to use research results if they are involved in the R&D process from the beginning. The Mass Transit Modal Annex states that DHS S&T and TSA will identify security technology needs in full partnership with the mass transit community. To achieve this, TSA officials told us that TSA leverages existing forums for communication, such as the semi-annual Transit Security Roundtables, to identify technology capability gaps and to solicit input and feedback on its technology priorities. Additionally, in 2008, TSA headquarters officials reported that they sought input from transit industry representatives through the Transit Policing and Security Peer Advisory Group and the Mass Transit Sector Coordinating Council Security Technology Working Group. Nonetheless, in a September 2008 draft report, the Mass Transit Sector Coordinating Council Security Technology Working Group reported that other than occasional telephone discussions, there was no ongoing structure that brought the federal government and transit industry together to discuss transit security technology priorities, needs, and areas of potential interest for technology advancement and research. In September 2004, we recommended that DHS and TSA improve their outreach to the transportation industry (including mass transit and passenger rail systems) to ensure that the industry’s R&D security needs have been identified and considered. DHS agreed that this recommendation was key to a successful R&D program and since that time, DHS and TSA have made some preliminary efforts to outreach on R&D security issues. However, by continuing to expand these efforts and getting input early on in the project selection process, TSA should be able to ensure that DHS has adequately considered and addressed the full scope of the industry’s R&D needs. TSA has taken initial actions to share information on available security technologies, but could strengthen its approach by providing more information to support transit agencies that are considering deploying new security technologies. Consistent with a recommendation we made in September 2005, TSA established the Public Transit Portal of DHS’s Homeland Security Information Network (HSIN), a secure Web site that serves as a clearinghouse of information on available security technologies that have been tested and evaluated by DHS, in addition to providing security alerts, advisories, and information bulletins. In February 2009, TSA reported that it had established HSIN accounts for 75 of the 100 largest mass transit and passenger rail systems. However, officials from 11 of 17 mass transit and passenger rail systems who discussed HSIN told us that they did not use it for guidance on available security technologies when considering security technology investments. These officials said that they did not use HSIN when considering such investments because HSIN did not contain product details that would support these decisions, including details on product capabilities, maintenance, ease of use, and the suitability of the products in a bus or rail venue. We reviewed HSIN and found that for a given security product, TSA’s listing provides a categorical definition (such as video motion analysis), a sub-category (such as day/night camera), and the names of products within those categories. However, HSIN neither provides nor indicates how transit agencies can obtain information beyond the product’s name and function. A senior program official with TSA’s TSNM mass transit division told us that mass transit and passenger rail system officials would already know whom to contact at TSA for more information on a product. However, the official acknowledged that the product listing could be enhanced by including the contact information of the TSA officials capable of providing that information. In the absence of more detailed information on security- related technologies, officials from 19 of 30 mass transit and passenger rail systems we interviewed told us that they either (1) asked other operators about their experiences with a particular technology; (2) performed their own research via the Internet or trade publications; or (3) performed their own testing. Making the results of research testing available to industry stakeholders could be a valuable use of federal resources by reducing the need for multiple industry stakeholders to perform the same research and testing. The senior TSA program official with the TSNM mass transit division also acknowledged that HSIN contained limited technology information but noted that the site’s content was largely in the early stages of development. The official attributed some of the limitations to TSA’s reluctance to provide substantive details regarding any particular product, since TSA officials did not want to be perceived as endorsing any particular vendor. Nonetheless, TSA stated that its goal for HSIN was to provide a way for transit agencies to share, receive, and find information on security technology as well as to provide a technology database with performance standards and product capabilities so that mass transit and passenger rail agencies would be well prepared to interact with vendors. Although TSA has set this goal for HSIN, there was no set deadline for the content-related improvements. By taking action to address mass transit and passenger rail agencies’ need for more information, TSA could help provide transit agencies with a consolidated source of information on security technologies and help ensure that limited resources are not used to duplicate research and testing efforts. In response to mass transit and passenger rail industry concerns about its VIPR program, TSA reported taking steps to work with the industry to improve the effectiveness of the program. TSA conducts VIPR operations as a way to introduce security measures (such as random bag searches) at mass transit and passenger rail systems to deter potential terrorist threats, augment local security forces, and promote the visibility of TSA resources. TSA, to date, has conducted over 800 VIPR operations at mass transit and passenger rail systems. TSA also reported that almost all operations were deployed on a random basis or to enhance security at special events or on holidays, rather than in response to specific threat information. Mass transit and passenger rail system officials we interviewed had varying opinions on the effectiveness of the VIPR operations that TSA had conducted on their systems. For example, security and management officials from 5 of the 30 mass transit and passenger rail systems we visited told us that they generally welcomed the additional security resources that the VIPRs provided. In contrast, officials from four other mass transit and passenger rail systems reported that because they were already deploying their own transit police and security personnel on their systems on a daily basis, the addition of a largely unarmed VIPR team on a single day did not add significant security value especially with the additional planning and costs incurred by these operations. In response to VIPR planning and implementation concerns raised by large mass transit and passenger rail systems, in October 2007 TSA issued a Concept of Operations (CONOPS) for its VIPR program that established general guidelines for the planning and execution of a VIPR deployment. TSA developed the guidance in coordination with members of the Transit Policing and Security Peer Advisory Group and issued the guidance to both its field personnel and the mass transit industry. The CONOPS includes general guidelines for 10 core components of collaboration, such as coordination, planning, and communications. In June 2008, the DHS Inspector General (DHS-IG) reported on VIPR planning and implementation concerns and noted that transit system officials reported that TSA’s issuance of the VIPR guidance had led to improvements that addressed many of the VIPR implementation concerns. Nevertheless, our review of TSA after-action reports for 104 VIPR operations TSA conducted from November 2007 through July 2008 on mass transit and passenger rail systems—a nine month period after TSA issued the CONOPS guidance— identified insufficient interoperable radio communications as a key challenge faced during many VIPR operations. According to the after-action reports, TSA’s key challenge has been ensuring that its VIPR teams have reliable interoperable radio communications—both among TSA personnel and with local law enforcement. According to the CONOPS, ensuring interoperable radio communications between VIPR team members and local law enforcement is essential to the safe and effective execution of VIPR programs, including ensuring their ability to communicate information on potential threats encountered during operations. However, in almost half of the after-action reports we reviewed (49 of 104), VIPR participants reported that a lack of reliable communications equipment had hindered their ability to conduct real-time communications with local law enforcement. This challenge has existed since TSA expanded the VIPR program into mass transit and passenger rail systems, where cell phone or other communications systems that previously worked in airports did not effectively operate in a transit environment. In many cases, TSA field personnel reported requests for new interoperable radio systems, but had not had those requests fulfilled by TSA headquarters. These reports indicated the need for a more comprehensive solution in which TSA procures communications systems capable of real time interoperability with security partners in mass transit and passenger rail systems. TSA managers of the VIPR program acknowledged the challenges that the VIPR program had experienced since it expanded into mass transit and passenger rail systems and stated that the agency was taking actions to address them. Examples include: Communications Improvements: TSA reported deploying additional communications equipment to field locations and working with DHS S&T to test new technologies for enhancing communications capability and interoperability in a mass transit or passenger rail environment. Coordination and Awareness: TSA reported that it developed and made available to mass transit and passenger rail systems a brochure with information on scheduling and deploying VIPR operations, including a description of the different options available for systems in utilizing VIPR teams and the planning and operational roles and responsibilities of participating TSA personnel. Further, to improve nationwide coordination of VIPR operations, TSA established a coordination center dedicated solely to VIPR operations and has established dedicated mobile VIPR teams in 10 cities. TSA has reported that it plans to expand the number of these teams nationwide by 2010. Training TSA Personnel: TSA reported in February 2009 that the agency had begun requiring VIPR team personnel to participate in system orientation and safety training from mass transit and passenger rail systems where they deploy in order to familiarize VIPR team members with both the transit agency’s physical structure and operating procedures. TSA also reported offering additional training on surface-based law enforcement tactics and legal authorities. Because TSA plans to further expand the VIPR program in 2009, effectively implementing these actions should better ensure that TSA uses its limited security resources to maximize the security benefit of VIPR operations in mass transit and passenger rail. In February 2007, TSA established a training program to assist mass transit and passenger rail agencies in expanding security training for their frontline transit employees. However, opportunities exist for TSA to strengthen its process for ensuring consistency in the performance of non- federal training vendors that mass transit and passenger rail agencies use to obtain training through the program. After TSA’s initial BASE reviews revealed wide variations in the extent of training that transit agencies were providing to their employees, including limited recurrent training, TSA established a Mass Transit Security Training program to provide curriculum guidelines for basic and follow-on security training areas— training programs and courses largely developed and funded by FTA. It also specified areas in which particular categories of employees should receive recurrent training as well as a matrix tool to enable transit agencies to determine the costs and timelines for implementing the training. To support delivery of the training courses, TSA aligned the program with the DHS Transit Security Grant Program. The Transit Security Grant Program has made transit agency grant funding for security training a top priority and offers mass transit and passenger rail agencies the option of using grant funding to cover costs for training to employees that is supplied by either (1) training providers that are federally funded or sponsored or (2) other training providers. While TSA has reported that the Mass Transit Security Training Program is providing opportunities for mass transit and passenger rail systems to expand security training to their employees, senior officials from FTA’s Safety and Security Office expressed concern that TSA had not established the necessary criteria to effectively manage the program. According to TSA’s Mass Transit Security Training Program guidance, TSA allows transit systems to obtain DHS grant funding to contract with private security training vendors if TSA has determined that the performance of the vendors’ training curriculum and delivery services is equal to those of the federally sponsored providers. As a result, TSA assumed new responsibility for evaluating whether these security training vendors met the performance standards of federally sponsored training providers and whether they could be used by transit agencies for training under the Transit Security Grant Program. However, opportunities exist for TSA to strengthen its process for making this evaluation. According to TSA, transit agency requests to use non-federally funded or sponsored training vendors under the Transit Security Grant Program are reviewed by TSA’s mass transit training specialist and by FEMA’s Grants Program Directorate for approval. This review includes an analysis of course documentation, such as a description of the course syllabus, cost estimate, and justification for why the course was the preferred solution. However, both FTA and TSA officials acknowledged that additional criteria are needed for TSA to properly evaluate the selection of the training vendors. As the lead federal agency for developing and implementing mass transit employee safety training programs since 1971, FTA is in the process of issuing guidance that could be relevant to TSA’s evaluation of training vendors. According to FTA’s 2009 Training Curriculum Development Guidelines, scheduled for release in 2009, criteria for evaluating the quality of training services should include, among other things, a review of the credentials of the instructors who would deliver the training course, the training vendor’s experience in providing the security course, and any performance evaluations or feedback obtained from organizations and students who previously received training from the vendor. Additionally, as we reported in March 2004, agencies should try to develop clear criteria when determining whether to contract with vendors for training. We identified factors that agencies should consider include the prior experience, capability, and stability of the vendors offering the training. Since implementing the Mass Transit Security Training Program in 2007, TSA reported that about 50 mass transit and passenger rail systems had applied for Transit Security Grant Program funding for employee security training, including one agency that applied to use training vendors that are not federally funded or sponsored. However, more applications for this option are expected as additional grant funding for training becomes available. TSA and FTA officials both noted their preference for transit agencies to use federally-sponsored training providers and expressed concerns that increased demands on the providers may make scheduling training with federally funded or sponsored providers more difficult. Enhancing criteria for evaluating the quality of training services could strengthen DHS’s ability to ensure that the grant money DHS is awarding to mass transit and passenger rail agencies is consistently funding sound and valid security training programs for these employees. In October 2005, we reported that collaborating agencies can identify opportunities to leverage each other’s resources, thus obtaining additional benefits that would not be available by working separately. By coordinating the enhancement of these criteria with other agencies conducting similar efforts, such as FTA, TSA could also leverage the expertise of other agencies to better ensure its efforts result in sound criteria. In March 2009, TSA reported that it had implemented some of the 9/11 Commission Act’s provisions related to mass transit and passenger rail security. While most mass transit and passenger rail industry security actions have been voluntary to date, the 9/11 Commission Act sets forth mandatory requirements for federal and industry stakeholders, and implementing those requirements may pose challenges for TSA and industry stakeholders, particularly for TSA’s Surface Transportation Security Inspection Program. TSA has more than doubled the size of its Surface Transportation Security Inspection Program over the past year, but has not completed a workforce plan to address current and future program needs, and surface inspectors have reported concerns with organizational changes that TSA has made to the program that may affect implementation of new responsibilities. Additionally, officials from the mass transit and passenger rail industry have reported concerns with the cost and feasibility of implementing pending 9/11 Commission Act regulations. The 9/11 Commission Act, enacted in August 2007, contains many provisions that task TSA with implementing various actions related to surface transportation, including mass transit and passenger rail security. Among other things, these provisions identify mandates for developing and issuing reports on TSA’s strategy for securing public transportation, conducting and updating security assessments of mass transit systems, and establishing a program for conducting security exercises for transit and rail agencies. In March 2009, TSA reported that it had satisfied some provisions of the 9/11 Commission Act pertaining to mass transit and passenger rail, including some through actions that had been taken prior to the enactment of the 9/11 Commission Act. For example, TSA reported that it had issued a report on the transportation security enforcement process and that its Mass Transit Modal Annex satisfied the requirement to develop a strategy for securing public transportation. However, TSA also reported that it had not yet implemented a number of other 9/11 Commission Act provisions, including several requiring TSA to issue regulations that would place new requirements on the mass transit and passenger rail industry. The 9/11 Commission Act requires TSA to develop and issue several different regulations for mass transit and passenger rail, including regulations for employee security training programs and requiring high- risk rail carriers to develop and implement security plans. TSA reported that it was in the process of developing these regulations and that for some required regulations it had sought feedback from the transit industry as it developed new regulations. However, as of March 2009, TSA had missed several legislative deadlines for issuing the required mass transit and passenger rail regulations, and in some cases had not established time frames for when it would ultimately do so. For example, TSA was required to issue interim regulations outlining requirements for a mass transit employee security training program by November 2007, with final regulations due by August 2008. TSA was also required to issue regulations by August 2008 requiring high-risk rail carriers to develop and implement security plans. However, TSA did not meet these deadlines. TSA reported that deadlines in the act for developing and issuing new regulations have been difficult to meet because of different factors, including the comprehensive scope of the requirements, the need to coordinate them with various entities, and a lack of resources for completing certain tasks. See table 6 below for a list of key selected 9/11 Commission Act mass transit and passenger rail provisions mandating actions by TSA, along with TSA’s reported status in doing so, as of March 2009. Develop and implement the National Strategy for Public Transportation Security. TSA reported that the Mass Transit Modal Annex to the Transportation System -Sector Specific Plan meets this requirement. Establish a task force to complete (by Feb. 2008) a risk assessment of a terrorist attack on railroad carriers, and based on the assessment, develop and implement the National Strategy for Railroad Transportation Security. TSA reported that the task force has been established and that the National Strategy for Railroad Transportation Security is under development. For passenger rail, TSA reported that the Mass Transit Modal Annex to the Transportation System -Sector Specific Plan meets. the requirement to develop and implement a security strategy. Review and update FTA security assessments of high-risk public transportation agencies, require high-risk public transportation agencies to develop security plans and review, amend as necessary, and approve the security plans. TSA reported that FTA security assessments were provided to TSA and that TSA used the BASE program to update the assessments. TSA stated that it will use the BASE results in developing regulations implementing this requirement. TSA reported that a regulatory project has been initiated. Conduct security assessments to determine the specific needs of local bus- only transportation systems. TSA reported that the assessments have been completed and that information is being prepared for use by the transportation system operators. Issue regulations (by Aug. 2008) that require each railroad carrier, including passenger rail carriers, determined to be high-risk to conduct a vulnerability assessment and to prepare, submit for approval, and implement a security plan. TSA reported that a regulatory project has been initiated. Establish a program for conducting security exercises for public transportation agencies and for railroad carriers. Establish a program for conducting security exercises for railroad carriers, including passenger rail carriers. TSA reported that its Intermodal Security Training and Exercise Program meets this requirement. The agency further reported a multi-phased, multi-jurisdictional pilot of this exercise program was held in the National Capitol Region from January through June 2008, northern New Jersey in September 2008, and Los Angeles from February to June 2009. Issue interim (by Nov. 2007) and final regulations (by Aug. 2008) for a public transportation security training program and issue regulations (by Feb. 2008) for a security training program for frontline railroad, including passenger railroad, employees. TSA reported that a consolidated regulatory project including public transportation, railroad, and over-the-road bus has been initiated. TSA reported that it anticipates issuing a Notice of Proposed Rulemaking in late calendar year 2009 or early calendar year 2010. Complete a name-based security background check for all public transportation frontline employees and frontline railroad employees. TSA reported that it has begun to develop a project plan for a rulemaking needed to satisfy this requirement, but that significant funding and time will be required to meet this requirement. TSA reported that it tracks the implementation status of mass transit and passenger rail security provisions of the 9/11 Commission Act on a monthly basis as part of a DHS-managed working group and was identifying processes needed to implement the provisions. TSA provided us with progress reports for completing these provisions which, in certain cases, identified challenges it faced in doing so, including a lack of resources. But the reports did not include a plan for addressing these challenges or milestones for implementing several 9/11 Act Commission provisions, as called for by project management best practices. TSA officials reported that before they could move forward on the 9/11 Commission Act requirements, they needed to allow the new administration time to review TSA’s efforts to date. However, until TSA develops a plan with milestones, it will be difficult to provide reasonable assurance that the provisions of the act are being developed and that a strategy is in place for overcoming identified challenges. While the majority of industry actions to secure mass transit and passenger rail have been taken on a voluntary basis, the pending 9/11 Commission Act regulations outline a new approach that sets forth mandatory requirements, the implementation of which may create challenges for TSA and industry stakeholders. With the exception of the 2004 passenger rail security directives, TSA had not, until recently, imposed security requirements on the mass transit and passenger rail industry. Instead TSA took a collaborative approach in encouraging passenger rail systems to voluntarily participate and address security gaps through its BASE review program. With TSA’s pending issuance of regulations required by the 9/11 Commission Act, TSA will fundamentally shift this approach, and establish a new regulatory regime for mass transit and passenger rail security. Once TSA issues the pending regulations for mass transit and passenger rail security, TSA’s Surface Transportation Security Inspection Program would have responsibility for enforcing industry compliance—further expanding and evolving the roles and responsibilities these inspectors have for mass transit and passenger rail, in addition to their responsibilities for other surface modes, such as freight rail, highway, and motor carrier security. TSA officials have raised concerns about their ability to meet the growing inspection requirements for mass transit and passenger rail and other surface modes that will be incurred by the new regulations required by the 9/11 Commission Act, particularly because TSA’s Surface Transportation Security Inspection Program is already challenged to meet its existing workload. For example, 10 of 11 Surface Transportation Security Inspection Program field office supervisors— Assistant Federal Security Directors for Surface Transportation (AFSD- S)—whom we interviewed reported that while they were meeting their primary inspection responsibilities for mass transit and other surface modes, resource constraints were routinely leading them to delay secondary activities, such as conducting stakeholder outreach with mass transit and passenger rail agencies. These field office supervisors attributed their resource constraints to a significantly expanded Surface Transportation Security Inspection Program workload from fiscal year 2006 through 2008 without a corresponding increase in its workforce. During this time, TSA expanded the responsibilities of the surface transportation security inspectors to include additional surface transportation modes, including conducting various voluntary security inspections for mass transit bus and freight rail, and participating in VIPR operations. TSA’s Surface Transportation Security Inspection Program is at risk of being unable to meet its expanding responsibilities if it does not plan for how to meet them. TSA reported that the agency had been appropriated funding to hire an additional 125 surface inspectors that would more than double its surface inspector workforce—including 75 in fiscal year 2008 and 50 more in fiscal year 2009—and planned to complete their hiring, training, and deployment by the end of fiscal year 2009. TSA reported plans to largely dedicate its newly hired surface inspectors to conducting VIPR activities, assessing security activities on surface modes, and monitoring newly issued freight rail security rules, such as ensuring a secure chain of custody for certain hazardous materials. However, as reported by the DHS Inspector General, beyond supporting current activities, the additional manpower TSA plans to put into its Surface Transportation Security Inspection Program may provide only limited relief. As a result, even with these additional resources, TSA’s surface inspectors may face challenges in fulfilling their responsibilities. GAO guidance on strategic human capital management reinforces that high performing organizations conduct workforce planning and analysis to identify and prepare for current and future workforce needs. Accordingly, a workforce plan that includes an analysis of a program’s workforce needs can help to ensure that the program has the right amount of resources to achieve program goals, allowing program managers to spotlight areas for attention before problems develop. In February 2009, we reported that TSA did not have a human capital or other workforce plan for its Transportation Security Inspection Program, but the agency had plans to conduct a staffing study to identify the optimal workforce size to address its current and future program needs. TSA reported that it had hired a contractor to conduct a full workforce analysis of its security inspectors, including both its aviation and surface inspectors, to determine the number needed to fulfill expanded roles and responsibilities and ensure effective deployment. TSA reported that it had initiated the study in January 2009 to be completed in late fiscal year 2009. This study, if completed, should provide TSA with a more reasonable basis for determining the surface inspector workforce needed to achieve its current and future workload needs in light of the new requirements of the 9/11 Commission Act. Surface inspectors have raised concerns about recent organizational changes that TSA has made to the Surface Transportation Security Inspection Program that may affect the implementation of its expanded roles and responsibilities. These concerns were reported by Surface Transportation Security Inspection Program field officials we interviewed, two recent DHS-IG reports, and an internal TSA report prepared by several Surface Transportation Security Inspection Program field officials. Specifically, in April 2008, TSA announced plans to expand the number of Surface Transportation Security Inspection field offices nationwide, from 22 to 54. Under a re-organized reporting structure, TSA placed 31 of the 32 new field offices under the command of Federal Security Directors and Assistant Federal Security Directors for Inspections—aviation-focused positions that historically have not had an active role in conducting mass transit, passenger rail, or other surface transportation inspection duties. TSA’s Surface Transportation Security Inspection Program headquarters officials continue to set strategy and annual goals, while in most field offices the surface inspectors report to the Federal Security Directors and Assistant Federal Security Directors for Inspections, who have day-to-day management lead and hiring responsibilities for surface inspectors. Reported field official concerns include: Balancing aviation and surface transportation priorities: A January 2008 report that 6 of 12 of TSA’s Assistant Federal Security Directors for Surface submitted to TSA headquarters cited concerns that placing the Surface Transportation Security Inspection program under the Federal Security Directors had resulted in the surface transportation mission being diluted by TSA’s aviation mission. The report also stated that the current reporting line of surface inspectors is less efficient and may create confusion among surface inspectors, because Federal Security Directors’ priorities and needs differ from those of the surface program. Establishing and maintaining credibility with industry stakeholders: Eight of the 11 Assistant Federal Security Directors for Surface we interviewed reported concerns that Federal Security Directors were not sufficiently focused on mass transit and passenger rail and the different challenges that surface inspectors face in overseeing the industry’s voluntary participation in non-regulatory security assessment activities. For example, one Assistant Federal Security Director for Surface commented that Federal Security Directors had tasked aviation security officers to participate in surface assessments and that doing so had caused some frustration among transit agency officials because of their lack of knowledge about the transit environment. A June 2008 DHS-IG report also noted surface inspectors’ concerns that Federal Security Directors were hiring surface inspectors who had no prior surface transportation experience, and that in some cases, Assistant Federal Security Directors reported that they were not included in hiring decisions. TSA disagreed with the DHS-IG and Assistant Federal Security Directors reports’ findings that the present Surface Transportation Security Inspection Program field office command structure had inhibited the program’s effectiveness. For example, TSA did not concur with the DHS- IG’s recommendation that TSA place the Surface Transportation Security Inspection Program under the direct authority of a TSA headquarters official responsible for surface transportation, rather than under the Federal Security Directors. TSA reported that they had selected their current command structure because Federal Security Directors were best equipped to make full use of the security network in their geographical location because they frequently interacted with state and local law enforcement and mass transit operators, and were aware of vulnerabilities in these systems. While TSA has not yet issued the new 9/11 Commission Act regulations for mass transit and passenger rail, 12 of 30 mass transit and passenger rail agencies we interviewed raised potential implementation concerns associated with one expected regulatory requirement regarding training for mass transit and passenger rail employees. Among other comments, mass transit and passenger rail agency officials reported that unless these new regulations were accompanied by funding to address implementation costs, they would be challenged to comply since mass transit agencies face tight budgetary constraints. For example, one transit agency official reported in feedback to TSA that an agency with 5,000 employees would incur labor costs of $1.5 million to have its employees participate in an 8- hour training program. Another transit agency official reported that it would be an achievement to get 30 to 40 percent of frontline employees through training in a year due, in part, to the costly overtime for backfilling those employees’ positions while they are in training. Additionally, these 12 agencies also reported concerns about the logistical feasibility of implementing the training requirement. For instance, under the act, mass transit and passenger rail agencies would be required to complete security training for all of their frontline employees within one year of DHS’s approving the transit agency’s training program. However, several mass transit and passenger rail agencies reported having thousands of employees and said it would be difficult to schedule training for all employees within one year without disrupting operations because they did not have the staff needed to backfill the positions of the employees undergoing training. As terrorist attacks on mass transit and passenger rail systems overseas have made clear, even with a variety of security precautions in place, mass transit and passenger rail systems that move high volumes of passengers on a daily basis remain vulnerable to attack. Since 2004, TSA has introduced a variety of initiatives aimed at enhancing the security of the nation’s mass transit and passenger rail systems, including conducting security assessments, implementing new security programs, and implementing some provisions of the 9/11 Commission Act. However, given the importance of the mass transit and passenger rail systems, the inherent vulnerabilities that could be exploited by terrorist threats, and the broadening requirements that will result in a shift to a regulatory approach, addressing management and coordination challenges should help ensure that current and future actions effectively improve the security of these systems. TSA has taken key steps to help secure the nation’s mass transit and passenger rail systems; however, additional actions to more effectively target resources would strengthen TSA’s security approach. To ensure that TSA’s efforts best prioritize and address risks, TSA should conduct a risk assessment for the mass transit and passenger rail systems that combines the results of threat, vulnerability, and consequence assessments. Until the overall risk to the entire system is identified through such an assessment, TSA cannot best determine how and where to target its limited resources to achieve the greatest security gains. TSA’s 2007 Mass Transit Modal Annex represents a positive step toward documenting TSA’s strategy for securing the mass transit and passenger rail systems, but further refinements to the strategy documented in future updates to the Modal Annex would help ensure that it provides all stakeholders with a clear and measurable path forward. For example, including relevant performance metrics will allow stakeholders to better evaluate their progress in achieving the strategy’s vision. In addition, incorporating information on what the strategy will cost, to the extent possible, would help implementing parties allocate budgets according to priorities and constraints, and would help stakeholders shift such investments and resources as appropriate. Federal and industry efforts to work together in securing mass transit and passenger rail in the absence of any significant federal security regulations have been commendable. In particular, TSA’s BASE reviews have been a positive step as they enhanced the awareness of security vulnerabilities at mass transit and passenger rail agencies throughout the country, while strengthening relationships among transit stakeholders. Notwithstanding TSA’s progress, TSA’s efforts remain largely in the early stages and opportunities exist for TSA to strengthen the implementation of some of its security programs. Expanding its outreach with mass transit and passenger rail officials will be particularly important for TSA in gathering security technology information and disseminating it to the systems and enabling officials to identify and deploy new security technologies to better secure their systems. In addition, with HSIN, TSA already has a venue in place for expanding the dissemination process and should explore the feasibility of populating this site with better and more relevant technology information to help meet the needs of mass transit and passenger rail agencies regarding information on available security technology. Such action should help ensure that limited resources are not used to duplicate research and testing efforts. Finally, by providing guidance and funding to cover mass transit and passenger rail agency costs for providing employee security training, TSA has taken steps to reduce a key vulnerability it identified during its BASE reviews. However, with the anticipated increase in demand for employee security training, it is important that TSA have an effective evaluation process in place to ensure it is consistently funding sound and valid training programs for mass transit and passenger rail agencies seeking funding to pay for non- federal training providers. Finally, a significant transition lies ahead. While TSA reports making progress in implementing the provisions of the 9/11 Commission Act, the agency has fallen behind in issuing required mass-transit and passenger- rail security regulations. The implementation of these regulations will be a fundamental shift in approach for TSA as it assumes more of a regulatory role in securing mass transit and passenger rail. This shift—combined with an expanding Surface Transportation Security Inspector workforce that has more than doubled in size in the past year and shifting deployment and field reporting structures—will challenge TSA to manage its new responsibilities. However, this transition will be important for both TSA and industry stakeholders to manage successfully to ensure that new requirements are met and that TSA and stakeholders continue to work together to secure mass transit and passenger rail. One approach that could help DHS manage these many changes is to develop a schedule with milestones for implementing the remaining 9/11 Commission Act requirements pertaining to mass transit and passenger rail. Without such a plan, it will be difficult for TSA to provide reasonable assurance that the provisions of the act are being implemented and that a strategy is in place for overcoming identified challenges. We recognize the inherent challenges to securing these systems given the continuing terrorist threat, openness of the system, and difficulties posed by attempting to secure and patrol numerous points of entry. However, given the criticality of mass transit and passenger rail systems to our way of life and the economy, and the inherent risks to them, TSA should continue to strive to strengthen its security efforts for the systems. To help ensure that the Transportation Security Administration is successfully prioritizing resources and collaborating with federal and industry stakeholders in implementing actions to secure the mass transit and passenger rail systems from acts of terrorism, and that its strategy is consistent with the characteristics of a successful national strategy, we are making six recommendations to the Assistant Secretary for the Transportation Security Administration: To help ensure that the federal strategy to secure the mass transit and passenger rail systems considers assessment information within the context of risk, TSA, as the sector-specific agency for mass transit and passenger rail, should conduct a risk assessment that integrates all three elements of risk—threat, vulnerability, and consequence. As part of this assessment, TSA should, to the extent feasible, fully leverage existing assessment information from its own sources as well as those provided by other federal and industry stakeholders, as appropriate, and use this information to inform its security strategy. To better achieve the security strategy laid out in its Mass Transit Modal Annex—TSA’s security strategy for the mass transit and passenger rail systems—TSA should, to the extent feasible, incorporate into future updates of the Modal Annex the characteristics of a successful national strategy and the elements outlined in Executive Order 13416, including: measuring the agency’s and industry’s performance in achieving the goals of preventing and deterring acts of terrorism and enhancing the resiliency of mass transit and passenger rail systems and incorporating information on what the strategy will cost along with the specifying the sources and types of resources and investments needed, and identifying where those resources and investments should be targeted. To help ensure that DHS security technology research and development efforts reflect the security technology needs of the nation’s mass transit and passenger rail systems, TSA should expand its outreach to the mass transit and passenger rail industry in the planning and selection of related security technology research and development projects. To meet the needs of mass transit and passenger rail agencies regarding information on available security technologies, TSA should explore the feasibility of expanding the security technology product information on the Public Transit Portal of the Homeland Security Information Network, and consider including information such as product performance in a rail or bus venue, cost, maintenance needs, and other information to support mass transit and passenger rail agencies purchasing and deploying new security technologies. To better ensure that DHS consistently funds sound and valid security training delivery programs for mass transit and passenger rail employees, TSA should consider enhancing its criteria for evaluating whether security training vendors meet the performance standards of federally sponsored training providers and whether the criteria could be used by transit agencies for training under the transit security grant program. As part of this effort, TSA should consider coordinating with other federal agencies that have developed criteria for similar programs, such as the Federal Transit Administration. To better ensure DHS’s ability to satisfy the provisions of the 9/11 Commission Act related to mass transit and passenger rail, DHS should develop a plan with milestones for implementing provisions of the 9/11 Commission Act related to mass transit and passenger rail security. We provided a draft of this report to DOT, Amtrak, and DHS for review and comment. DOT did not provide comments. Amtrak provided written comments on June 16, 2009. In its letter, Amtrak provided additional information on security actions they were taking, noted collaboration with federal agencies, and expressed some concern about the cumbersome nature and cost share requirements of the Transit Security Grant Program. Amtrak’s comments are presented in appendix VII. DHS provided written comments on June 17, 2009, which are presented in appendix VIII. In commenting on the report, DHS stated that it concurred with all six recommendations and identified actions planned or under way to implement them. In comments related to our first recommendation, that DHS conduct a risk assessment that integrates all three elements of risk, DHS stated that it recognized the importance of conducting risk assessments to inform agency priorities, security enhancement programs, and resource allocations. It also reported that in addition to the various assessments already completed and the BASE reviews conducted on a continuous cycle, an assessment pilot program is planned for later in 2009. Under this pilot, TSA will evaluate the effectiveness of and provide lessons learned from its new risk assessment tool for mass transit and passenger rail to enhance the tool’s capability prior to its implementation. In comments related to our second recommendation that DHS incorporate in future updates of the Modal Annex the characteristics of a successful national strategy and the elements outlined in Executive Order 13416, DHS reported that it planned to revise its Mass Transit Modal Annex and incorporate these characteristics and elements to improve its ability to measure agency and industry progress toward achieving mass transit and passenger rail security performance goals. In response to our third recommendation that TSA expand its outreach to the mass transit and passenger rail industry in the planning and selection of related security technology research and development projects, DHS reported on several planned coordination efforts including its intent to coordinate the Modal Annex update with mass transit and passenger rail stakeholders, and work to ensure that stakeholders have ample opportunities to provide input on security technology development and testing priorities. With regard to our fourth recommendation that TSA explore the feasibility of expanding the security technology product information on the Public Transit Portal of the Homeland Security Information Network, DHS reported that it expects to expand both the scope and quality of security technology information provided to stakeholders through the Public Transportation Information Sharing and Analysis Center—which has a principal objective of aligning and integrating analytical and information sharing activities with relevant federal processes to enhance the information-sharing environment for the mass transit and passenger rail community. In comments related to our fifth recommendation that TSA consider enhancing its criteria for evaluating security training vendors under the Transit Security Grant Program and consider coordinating with other federal agencies that have developed such criteria, DHS stated that TSA will work with FTA through an existing joint working group to develop criteria for reviewing new vendor-provided training courses. Lastly, with regard to our sixth recommendation that DHS develop a plan with milestones for implementing provisions of the 9/11 Commission Act related to mass transit and passenger rail security, DHS reported that TSA will produce a plan that identifies necessary actions and sets milestones to evaluate its effectiveness in meeting statutory requirements associated with the 9/11 Commission Act. DHS and Amtrak also provided us with technical comments, which we considered and incorporated into the report where appropriate. As agreed with your office, unless you publicly announce the contents of this report, we plan no further distribution for 30 days from the report date. At that time, we will send copies of this report to the Secretary of Homeland Security, the Secretary of Transportation, Amtrak, interested congressional committees, and other interested parties. The report will also be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions concerning this report, or wish to discuss these matters further, please contact me at (202) 512-3404 or berrickc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix IX. The objectives of this report were to: (1) determine the extent that federal and industry stakeholders assessed or supported assessments of the security risks to mass transit and passenger rail since 2004, and how, if at all, TSA used risk assessment information to inform and update its security strategy; (2) describe key actions, if any, that federal and industry stakeholders implemented or initiated, since 2004, to strengthen the security of mass transit and passenger rail systems, the extent to which federal actions were consistent with TSA’s security strategy, and what challenges, if any, TSA faces in implementing these actions; and (3) describe TSA’s reported status in implementing provisions of the Implementing Recommendations of the 9/11 Commission Act of 2007 related to mass transit and passenger rail security, and discuss challenges, if any, TSA and the mass transit and passenger rail industry face in implementing the actions required by the act. To determine the extent that federal and industry stakeholders have assessed or supported assessments of the security risks to mass transit and passenger rail since 2004, and how, if at all, TSA has used risk assessment information to inform and update its security strategy, we obtained and analyzed various reports that address some or all elements of security risk (threat, vulnerability, and consequence) from DHS component agencies, including TSA, the DHS Office of Infrastructure Protection within the National Protection and Programs Directorate (NPPD), and the Homeland Infrastructure Threat Reporting and Analysis Center (HITRAC). We also reviewed information on risk-related assessments conducted by federal agencies, including mass transit and passenger rail security vulnerability assessments conducted by DOT’s Federal Transit Administration (FTA), and a variety of federally developed security risk assessment tools for the mass transit and passenger rail industry. Additionally, we reviewed TSA’s Baseline Assessment for Security Enhancement (BASE) review checklist and fiscal year 2007 BASE report of the results of BASE reviews that TSA conducted at 44 of the top 50 largest mass transit and passenger rail agencies—by ridership—as a measure of TSA’s efforts to gather vulnerability information. We gathered information on TSA’s consequence assessments through interviews with Transportation Sector Network Management (TSNM) officials. We also interviewed TSNM officials in order to assess how risk assessments were informing TSA’s security strategy for mass transit and passenger rail and then compared TSA’s actions to GAO and DHS reports on risk assessment. Because of the scope of our work, we relied on TSA to identify its assessment activities but did not assess the extent to which its assessment activities meet the National Infrastructure Protection Plan criteria for threat, vulnerability, and consequence assessments. To further assess risk assessment efforts, we interviewed federal officials from DHS’s HITRAC, TSA’s Office of Intelligence, TSA’s Surface Transportation Security Inspection Program, and, at DOT, FTA’s Office of Safety and Security to understand what additional assessment information or assistance on risk assessments was available to either TSA or the transit agencies. Further, we interviewed security officials from Amtrak and 30 mass transit and passenger rail agencies across the nation. This sample allowed us to meet with agencies of varying sizes and types to determine their perspectives on federal and mass transit and passenger rail industry risk assessment efforts to date (see objective 2 for how these agencies and cities were selected). Additionally, we reviewed TSA’s strategic planning document—the Mass Transit Modal Annex to the Transportation System - Sector Specific Plan (TS-SSP) issued in May 2007—and identified federal guidelines for developing a risk-based security strategy. Specifically, to determine the extent to which TSA’s strategy conformed to requirements and best practices, we reviewed relevant statutory requirements of the Government Performance and Results Act of 1993 (GPRA) that included general requirements that are applicable in the establishment of government strategies and programs, and the Implementing Recommendations of the 9/11 Commission Act of 2007, which included requirements for establishing a security strategy. For example, we reviewed existing Executive Directives, including Homeland Security Presidential Directives 1, 7, and 8, and Executive Order 13416: Strengthening Surface Transportation Security to determine the extent to which TSA’s Mass Transit Modal Annex conformed to these requirements. We also analyzed executive guidance documents outlining best practices for effectively implementing a risk management framework, and in particular, risk assessment best practices, including both the DHS National Infrastructure Protection Plan (NIPP) and the TS-SSP. We also reviewed GAO best practice criteria for developing a successful national strategy and compared the Mass Transit Modal Annex against it. Finally, to identify the extent to which TSA is measuring its performance in implementing its mass transit and passenger rail security programs, we reviewed DHS and TSA documents, including the Modal Annex, DHS Critical Infrastructure and Key Resources Annual Reports, and Surface Transportation Regulatory Activities Plan, as well as the Office of Management and Budget’s Program Assessment Rating Tool (PART), which assessed the adequacy and effectiveness of these program measures. To identify and describe the key actions federal and industry stakeholders have implemented or initiated since 2004 to strengthen the security of mass transit and passenger rail systems, the extent to which federal actions are consistent with TSA’s security strategy, and the challenges, if any, that TSA has faced in making these actions effective, we interviewed officials from DHS and DOT. From DHS, we interviewed officials from TSA’s Surface Transportation Security Inspection Program within the Office of Security Operations, TSA’s Office of Security Technology, and, within TSA’s Office of Law Enforcement, the Federal Air Marshal Service (which plays a lead role in implementing VIPR Operations). We also interviewed officials from DHS’s Science and Technology Directorate and Federal Emergency Management Agency’s Grants Programs Directorate. Within DOT, we interviewed officials from FTA’s Office of Safety and Security and also the Federal Railroad Administration. We also interviewed officials from the three federally sponsored mass transit employee training providers—the National Transit Institute, Transportation Safety Institute, and Johns Hopkins University—to obtain information on training they offered to mass transit and passenger rail employees and their perspectives on TSA’s Mass Transit Security Training Program. To obtain information on industry security actions and perspectives on federal mass transit and passenger rail security actions, we conducted site visits at, or held teleconferences with, officials representing 30 mass transit and passenger rail systems across the nation—representing 75 percent of the nation’s total mass transit and passenger rail ridership— based on information we obtained from the Federal Transit Administration’s National Transit Database and the American Public Transportation Association (APTA). We selected this non-probability sample of mass transit and passenger rail systems and cities because of their high levels of ridership, geographic dispersion, experience with TSA security assessments, eligibility for grant funding, and expert recommendation. Because we selected a non-probability sample of mass transit and passenger rail agencies, the information obtained from these site visits cannot be generalized to all transit agencies nationwide. However, we determined that the selection of these sites was appropriate for our design and objectives and that the selection would provide valid and reliable evidence. The information we obtained provided us with a broad overview of the types of actions taken to strengthen security. Table 1 lists the mass transit and passenger rail systems we interviewed. We also interviewed Amtrak headquarters officials and visited three Amtrak station locations in the Northeast Corridor. During site visits to mass transit and passenger rail agencies, we interviewed security officials, toured stations and other facilities such as control centers, and observed security practices. Further, we interviewed TSA surface transportation security inspectors from the 13 field offices responsible for overseeing the passenger rail and mass transit systems we visited, and in one case, observed the inspectors conduct a BASE review of a mass transit system. We also interviewed state officials with homeland security responsibilities, representatives of the American Public Transportation Association, and where applicable, regional transportation authority officials. To determine the extent to which federal and industry actions were consistent with TSA’s security strategy, we reviewed TSA and FTA documentation describing ongoing programs and compared them with the strategic objectives, programs, and actions TSA described in its Mass Transit Modal Annex. To further assess federal and industry actions, and identify potential challenges, we reviewed DHS and DOT documents relevant to federal and industry stakeholder actions to secure passenger rail and mass transit systems. For example, we reviewed program documentation for TSA’s Mass Transit Security Training Program, as well as FTA’s 2009 Final Draft of Training Curriculum Development Guidelines and federal transit employee training curricula. We also reviewed TSA’s Surface Transportation Security Inspection Program Standard Operating Procedures, strategic and annual plans, and documentation of completed mass transit and passenger rail security assessments. We also reviewed TSA’s Concept of Operations (CONOPS) for its Visible Intermodal Prevention and Response (VIPR) program—TSA’s program for deploying security personnel to augment security on mass transit and passenger rail systems—to identify guidelines TSA has established for implementing the program. We then obtained a list of VIPR operations, by location and date, that TSA reported conducting in mass transit and passenger rail systems immediately following its issuance of the CONOPS in October 2007. We obtained and matched this list with information found in electronic copies of all TSA VIPR operation plan after-action reports (AAR)—describing the results and challenges encountered during VIPR operations that TSA conducted at mass transit and passenger rail systems from November 2007 through July 2008. We chose to review after-action reports for this period to determine the impact of guidance TSA issued in October 2007, to improve its implementation of the VIPR program. Both the initial list and after-action reports identified 108 VIPR operations; however, we reviewed 104 of these. Two analysts independently coded the challenges noted on each of the reports. They discussed differences until agreement could be reached on the most appropriate challenge category. We also conducted a site visit to the Transportation Security Operations Center to interview officials with TSA’s Federal Air Marshal Service within the Office of Law Enforcement—which manages the VIPR program—to discuss the challenges identified in the after-action reports. We also obtained access to, and reviewed, the DHS Homeland Security Information Network - Public Transit Portal secure Web communication system to identify the type and extent of security technology information that TSA had made available to industry users of the system, and identified and reviewed best practices applicable to R&D programs identified by leading research organizations, such as the National Research Council of the National Academy of Sciences, in order to establish criteria for evaluating federal and industry coordination in research and development efforts. We also reviewed two DHS-IG reports and found the quality of the methods used to develop these reports sufficient for use as a source in this report. For the final objective, to determine the status of TSA’s implementation of 9/11 Commission Act requirements for mass transit and passenger rail, and challenges, if any, that TSA and the mass transit and passenger rail industry face in meeting these requirements, we reviewed the 9/11 Commission Act to identify DHS and industry requirements related to mass transit and passenger rail security. We also reviewed TSA status reports outlining the agency’s reported status in satisfying various 9/11 Commission Act provisions related to mass transit and passenger rail security. However, we did not verify the accuracy of TSA’s reported status in implementing these 9/11 Commission Act requirements. To identify potential challenges TSA and the mass transit and passenger rail industry may face in implementing various 9/11 Commission Act requirements, we interviewed TSA headquarters officials from the Transportation Security Network Management—Mass Transit division, including the Deputy General Manager, and officials from TSA’s Surface Transportation Security Inspection Program, including the headquarters based Program Chief, and Surface Transportation Security Inspectors from 13 of 54 field offices, including 11 of 12 Assistant Federal Security Directors for Surface. We also reviewed TSA program documents relating to its inspection program including strategic and annual inspection plans, standard operating procedures, and memorandums and directives documenting organizational and staffing plans. Moreover, to obtain information on industry perspectives of potential challenges, we interviewed officials from 30 mass transit and passenger rail systems and Amtrak as well as APTA. In addition, we obtained and reviewed various reports which discuss the federal or industry role in implementing the 9/11 Commission Act, including recent reports issued by the DHS-IG, Congressional Research Service, and a January 2008 report prepared by six Assistant Federal Security Directors for Surface. We conducted this performance audit from September 2007 through June 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The following list of voluntary Security and Emergency Management Action Items is an update to the Federal Transit Administration's Top 20 Security Program Action Items originally released in January 2003. The update has been developed by FTA and the Department of Homeland Security's Transportation Security Administration and Office of Grants & Training in consultation with the public transportation industry through the Mass Transit Sector Coordinating Council, for which the American Public Transportation Association serves as Executive Secretary. The updated action items address current security threats and risks that confront transit agencies, with particular emphasis on priority areas where gaps need to be closed in security and emergency preparedness programs. Though this update consolidates the previous 20 items into 17, the purpose, scope, and objectives remain consistent. 1. Establish written security plans and emergency management plans. 2. Define roles and responsibilities for security and emergency management. 3. Ensure that operations and maintenance supervisors, forepersons, and managers are held responsible for security issues under their control. 4. Coordinate security and emergency management plan(s) with local and regional agencies. 5. Establish and maintain a security and emergency training program. 6. Establish plans and protocols to respond to the DHS Homeland Security Advisory System threat levels. 7. Implement and reinforce a Public Security and Emergency Awareness Program. 8. Conduct tabletop and functional drills. 9. Establish and use a risk management process to assess and manage threats, vulnerabilities and consequences. 10. Participate in an information sharing process for threat and intelligence information. 11. Establish and use a reporting process for suspicious activity (internal and external). 12. Control access to security critical facilities with ID badges for all visitors, employees, and contractors. 13. Conduct physical security inspections. 14. Conduct background investigations of employees and contractors. 15. Control access to documents of security critical systems and facilities. 16. Ensure existence of a process for handling and access to Sensitive Security Information (SSI). 17. Conduct security program audits. To help the federal government develop sound national strategies, we have previously identified six desirable characteristics of successful national strategies, including (1) purpose, scope, and methodology of the strategy; (2) risk assessment; (3) goals, subordinate objectives, activities, and performance measures; (4) resources and investments; (5) organizational roles, responsibilities, and coordination; (6) integration and implementation. We discussed four of these characteristics in the body of the report, and below we discuss the other two characteristics. Where applicable, we link relevant sections of Executive Order 13416 to highlight the importance of these measures to strengthen the passenger rail and mass transit security national strategy. This characteristic addresses why the strategy was produced, the scope of its coverage, and the process by which it was developed. For example, a strategy might discuss the specific impetus that led to its creation, such as statutory requirements, executive mandates, or other events—such as terrorist attacks. In addition to describing what the strategy is meant to do and the major functions, mission areas, or activities it covers, a national strategy would ideally also outline its methodology. For example, a strategy might discuss the principles or theories that guided its development, what organizations or offices drafted the document, whether it was the result of a working group, or which parties were consulted in its development. TSA’s Mass Transit Modal Annex identifies the purpose and scope of the Modal Annex and references several principle documents used to develop the Modal Annex—including the Presidential Executive Order 13416: Strengthening Surface Transportation Security, the Transportation System- Sector Specific Plan (TS-SSP), and the National Infrastructure Protection Plan. It also describes the process or methodology that was used and who developed the Annex. For example, the Modal Annex states that TSA’s vision is to provide a secure, resilient transit system that leverages public awareness, technology, and layered security programs while maintaining the efficient flow of passengers and encouraging the expanded use of the nation’s transit services. The Modal Annex also discusses the scope and type of various federal and industry mass transit and passenger rail security efforts and aligns them with three broad DHS security goals for the transportation sector, as outlined in the TS-SSP. In addition, the Modal Annex references the National Infrastructure Protection Plan as a source for developing security programs for mass transit and passenger rail systems, and it also discusses several domestic and international terrorist attacks that have occurred as evidence of the various security risks to the mass transit and passenger rail systems. Furthermore, the Modal Annex explains the methodology used in its development, as called for in our prior work on characteristics of a national strategy. In addition to referencing the National Infrastructure Protection Plan and the TS-SSP as literatures providing the principles or theories that guided the development of the Modal Annex, the Modal Annex also describes the process and information that were used to develop the strategy and identified entities that contributed to its development. For example, the strategy describes how mass transit and passenger rail security programs and initiatives are developed and implemented and how they are aligned with the overall transportation sector goals and objectives and mass transit and passenger rail modal strategies and objectives. Also, the Modal Annex identifies the Transit, Commuter and Long Distance Rail Government Coordinating Council (TCLDR-GCC), the Mass Transit Sector Coordinating Council (SCC), the Critical Infrastructure Partnership Advisory Council, and TSA’s Mass Transit Division as entities involved in developing the transportation security strategic policy. This characteristic addresses both how a national strategy relates to other strategies’ goals, objectives, and activities and to subordinate levels of government and their plans to implement the strategy. For example, a national strategy could discuss how its scope complements, expands upon, or overlaps with other national strategies, such as DHS efforts to mitigate transportation risks. Also, related strategies could highlight their common or shared goals, subordinate objectives, and activities. Similarly, the Executive Order requires that the Modal Annex identify existing security guidelines and requirements. To meet these requirements and because protecting the mass transit and passenger rail systems is a shared responsibility among many stakeholders, the Modal Annex could identify regulations and programs that affect the security of the mass transit and passenger rail systems. In addition, a strategy could address its relationship to other agency strategies using relevant documents from implementing organizations, such as strategic plans, annual performance plans, or annual performance reports that GPRA requires of federal agencies. A strategy might also discuss, as appropriate, various strategies and plans produced by the state, local, or private sectors and could provide guidance such as the development of national standards to more effectively link together the roles, responsibilities, and capabilities of the implementing parties. TSA’s Modal Annex delineates mechanisms to facilitate stakeholders coordination, specifically the TCLDR-GCC and the Mass Transit SCC, discusses other relevant industry security plans, and identifies regulations and programs such as the regulation on designating a rail security coordinator and security programs related to public awareness and training that affect the security of the mass transit and passenger rail systems. The Modal Annex also addresses its relationship with strategic documents or activities of other federal agencies that have a role in mass transit and passenger rail security, such as those that guide FTA, which has a supporting role along with TSA for protecting mass transit and passenger rail systems. For example, the Modal Annex mentions how FTA’s activities, such as the State Safety Oversight Agencies audit program and FTA’s Section 5307 grant program fit into TSA’s overall strategy for securing mass transit and passenger rail systems. The Modal Annex also mentions DHS-DOT collaborative efforts through their memorandum of understanding such as the development of public transportation annex delineating areas of coordination to assist transit agencies in prioritizing and addressing security related needs. In addition, the Modal Annex points out how it relates to the National Strategy for Transportation Security required by the Intelligence Reform and Terrorism Prevention Act of 2004. For example, it explains how TSA’s effort in building security force multipliers through security training for front-line employees of mass transit and passenger rail systems directly supports the National Priorities, the National Preparedness Goal, and the National Strategy for Transportation Security. By providing such information, the agency is identifying linkages with other developed strategies and other organizational roles and responsibilities. This appendix expands on the list of key actions identified in the body of the report in table 5. This table presents a more comprehensive list of federal actions taken to enhance mass transit and passenger rail security since 2004. In addition to the contact named above, Dawn Hoff, Assistant Director, and Daniel Klabunde, Analyst-in-Charge, managed this assignment. Jay Berman, Martene Bryan, Charlotte Gamble, and Su Jin Yon made significant contributions to the work. Chuck Bausell and Rudy Chatlos, assisted with design, methodology, and data analysis. Lara Kaskie and Linda Miller provided assistance in report preparation; and Tracey King provided legal support.

Summary: Terrorist incidents worldwide have highlighted the need for securing mass transit and passenger rail systems. The Department of Homeland Security's (DHS) Transportation Security Administration (TSA) is the primary federal entity responsible for securing these systems. GAO was asked to assess (1) the extent to which federal and industry stakeholders have assessed risks to these systems since 2004, and how TSA has used this information to inform its security strategy; (2) key actions federal and industry stakeholders have taken since 2004 and the extent to which federal actions are consistent with TSA's security strategy, and the challenges TSA faces in implementing them; and (3) TSA's reported status in implementing 9/11 Commission Act provisions for mass transit and passenger rail security. GAO reviewed documents including TSA's mass transit and passenger rail strategic plan, and interviewed federal officials and industry stakeholders from 30 systems and Amtrak--representing 75 percent of U.S. mass transit and passenger rail ridership. Since 2004, federal and industry stakeholders have conducted assessments of individual elements of risk--threat, vulnerability and consequence--for mass transit and passenger rail systems and this information has informed TSA's security strategy; however, TSA has not combined information from these three elements to conduct a risk assessment of these transportation systems. By completing a risk assessment, TSA would have reasonable assurance that it is directing its resources toward the highest priority needs. Further, while TSA's mass transit and passenger rail security strategy contains some information, such as goals and objectives, that is consistent with GAO's prior work on characteristics of a successful national strategy, it could be strengthened by including performance measures to help TSA track progress in securing these systems, among other things. Federal and industry stakeholders have taken several key actions to strengthen the security of mass transit and passenger rail systems since 2004, and while federal actions have been generally consistent with TSA's security strategy, TSA faces coordination challenges, and opportunities exist to strengthen some programs. TSA has deployed surface inspectors to assess industry security programs and worked with DHS to develop security technologies, among other actions. Mass transit and passenger rail systems, including Amtrak, also reported taking actions to increase security, such as implementing passenger and baggage screening programs. Although TSA has taken steps to enhance its efforts, it can further strengthen security programs by, for example, expanding its efforts to obtain and share security technology information with industry. By improving information sharing with industry, TSA can help to ensure that its and industry's limited resources are used more productively to secure mass transit and passenger rail systems. As of March 2009, TSA reported implementing some of the 9/11 Commission Act provisions related to securing mass transit and passenger rail such as developing a strategy for securing transportation, but had missed deadlines, for example, for issuing new regulatory requirements for mass-transit and passenger-rail employee security training. In addition, TSA's progress reports that track its implementation of 9/11 Act provisions lack milestones to guide this effort as called for by project management best practices. Additionally, in some cases, TSA progress reports identify challenges to meeting 9/11 Act provisions, but these reports do not include a plan for addressing these challenges. Until TSA develops a plan with milestones, it will be difficult for TSA to provide reasonable assurance that the act's provisions are being implemented and that a plan is in place for overcoming challenges that arise. Additionally, officials from almost half of the mass transit and passenger rail systems GAO visited reported concerns with the potential costs and the feasibility of implementing pending employee security training requirements.