The Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act) directed DHS to create a plan for sharing transportation security–related information among public and private entities that have a stake in protecting the nation’s transportation system, including passenger and freight rail. This plan—first issued in July 2008— is now called the Transportation Security Information Sharing Environment (TSISE). The TSISE describes, among other things, the information–sharing process. TSA disseminates security information through several information products, including reports, assessments, and briefings, among others. These products are distributed through mechanisms including the Homeland Security Information Network and mechanisms sponsored by industry, such as the Association of American Railroads’ Railway Alert Network, among others. TSA is also specifically responsible for receiving, assessing, and distributing intelligence information related to potential threats and significant security concerns (rail security incidents) related to the nation’s rail system. Specifically, in 2008, TSA issued a regulation requiring U.S. rail systems to report all rail security incidents to TSA’s Transportation Security Operations Center (TSOC), among other things. The TSOC is an operations center open 24 hours a day, 7 days a week, that serves as TSA’s main point of contact for monitoring security–related incidents or crises in all modes of transportation. The regulation also authorizes TSA officials to view, inspect, and copy rail agencies’ records as necessary to enforce the rail security incident reporting requirements. This regulation is supported by TSA policies and guidance, including the Transportation Security Inspector Inspections Handbook, the National Investigations and Enforcement Manual, and the Compliance Work Plan for Transportation Security Inspectors. TSA’s regulation is intended to provide the agency with essential information on rail security incidents so that TSA can conduct comprehensive intelligence analysis, threat assessment, and allocation of security resources, among other things. According to the regulation, potential threats and significant security concerns that must be reported to the TSOC include bomb threats, suspicious items, or indications of tampering with rail cars, among others. Within TSA, different offices are responsible for sharing transportation security–related information and for implementing and enforcing the rail security incident reporting requirement. For instance, TSA’s Office of Security Policy and Industry Engagement (OSPIE) is the primary point of contact for sharing information with private sector stakeholders, and is responsible for using incident reports and analyses, among other things, to develop strategies, policies, and programs for rail security, including operational security activities, training exercises, public awareness, and technology. TSA’s Office of Intelligence and Analysis (OIA) receives intelligence information regarding threats to transportation and designs intelligence products intended for officials in TSA, other parts of the federal government, state and local officials, and industry officials, including rail agency security coordinators and law enforcement officials. The TSOC, managed by TSA’s Office of Law Enforcement/Federal Air Marshal Service, is the TSA entity primarily responsible for collecting and disseminating information about rail security incidents. Once notified of a rail security incident, TSOC officials are responsible for inputting the incident information into their incident management database known as WebEOC, and for disseminating incident reports that they deem high priority or significant to selected TSA officials; other federal, state, and local government officials; and selected rail agencies’ law enforcement officials. Figure 1 shows the intended steps and responsibilities of TSA components involved in the rail security incident reporting process. TSA’s Office of Security Operations (OSO) is responsible for overseeing and enforcing the incident reporting requirement. Responsible for managing TSA’s inspection program for the aviation and surface modes of transportation, the Office of Security Operations’ Surface Compliance Branch deploys approximately 270 transportation security inspectors– surface (TSI-S) nationwide. The TSI-Ss are responsible for, among other things, providing clarification to rail agencies regarding the incident reporting process and for overseeing rail agencies’ compliance with the reporting requirement by conducting inspections to ensure that incidents were properly reported to the TSOC. Six regional security inspectors– surface (RSI-S) within the Compliance Programs Division are responsible for providing national oversight of local surface inspection, assessment, and operational activities. In June 2014, we found that TSA had some mechanisms in place to collect stakeholder feedback on the products it disseminates containing security-related information and had initiated efforts to improve how it obtains customer feedback, but had not developed a systematic process for collecting and integrating such feedback. Specifically, in February 2014, TSA reconvened its Information Sharing Integrated Project Team (IPT), whose charter included, among other things, milestones and time frames for developing a centralized management framework to capture stakeholder satisfaction survey data on all of TSA’s security-related products and the systems used to distribute these products. However, at the time of our June 2014 report, the IPT Charter did not specify how TSA planned to systematically collect, document, and incorporate informal feedback—a key mechanism used by the majority of the stakeholders we surveyed, and a mechanism TSA officials told us they utilize to improve information sharing. For instance, the rail industry provided TSA with a list of areas for emphasis in intelligence analysis in December 2012, and TSA subsequently initiated a product line focusing on indications and warnings associated with disrupted or successful terrorist attacks. TSA officials stated that they further refined one of the products as a result of a stakeholder requesting information on tactics used in foreign rail attacks. In 2013, one TSA component built a system to track informal information sharing with stakeholders at meetings and conferences, and through e-mail, but TSA officials stated that the data were not used for operational purposes, and TSA had no plans to incorporate this system into its centralized management framework because the IPT had decided to focus its initial efforts on developing a survey mechanism. According to our June 2014 survey results, surface transportation stakeholders were generally satisfied with TSA’s security-related products and the mechanisms used to disseminate them. In particular, 63 percent of rail stakeholders (70 of 111) reported that they were satisfied with the products they received in 2013, and 54 percent (59 of 110) reported that they were satisfied with security-related information sharing mechanisms. However, because TSA lacked specific plans and documentation related to improving its efforts to incorporate all of its stakeholder feedback, it was unclear how, or if, TSA planned to use stakeholder feedback to improve information sharing. As a result of these findings, we recommended that TSA include in its planned customer feedback framework a systematic process to document informal feedback, and how it incorporates all of the feedback TSA receives, both formal and informal. TSA concurred, and in response, by April 2015, had taken actions to develop these processes. Specifically, TSA developed a standard operating procedure to organize how its offices solicit, receive, respond to, and document both formal and informal customer feedback on its information-sharing efforts, which delineates a systematic process for doing so. TSA also developed a TSA-wide standard survey for its offices to use to obtain formal and informal feedback on specific products, and created an information-sharing e-mail inbox to which all survey responses will be sent, evaluated, and distributed to the appropriate office for action. We have not evaluated these actions, but if implemented effectively, we believe that TSA will now be better positioned to meet stakeholder needs for security-related information. In December 2012, we found TSA had made limited use of the rail security incident information it had collected from rail agencies, in part because it did not have a systematic process for conducting trend analysis. TSA’s stated purpose for collecting rail security incident information was to allow TSA to “connect the dots” by conducting trend analysis that could help TSA and rail agencies develop targeted security measures. However, the incident information provided to rail agencies by TSA was generally limited to descriptions of specific incidents with minimal accompanying analysis. As a result, officials from passenger rail agencies we spoke with generally found little value in TSA’s incident reporting process, because it was unclear to them how, if at all, the information was being used by TSA to identify trends or threats that could help TSA and rail agencies develop appropriate security measures. However, as we reported in December 2012, opportunities for more sophisticated trend analysis existed. For example, the freight industry, through the Railway Alert Network—which is managed by the Association of American Railroads, a rail industry group—identified a trend where individuals were reportedly impersonating federal officials. In coordination with TSA, the Railway Alert Network subsequently issued guidance to its member organizations designed to increase awareness of this trend among freight rail employees and provide descriptive information on steps to take in response. The Railway Alert Network identified this trend through analysis of incident reporting from multiple freight railroads. In each case, the incident had been reported by a railroad employee and was contained in TSA’s incident management system, WebEOC. On the basis of these findings, in December 2012, we recommended that TSA establish a systematic process for regularly conducting trend analysis of the rail security incident data, in an effort to identify potential security trends that could help the agency anticipate or prevent an attack against passenger rail and develop recommended security measures. TSA concurred with this recommendation and by August 2013 had developed a new capability for identifying trends in the rail security incident data, known as the Surface Compliance Trend Analysis Network (SCAN). SCAN is designed to identify linkages between incidents captured in various sources of data, assemble detailed information about these incidents, and accurately analyze the data to enhance the agency’s ability to detect impending threats. According to TSA officials, SCAN consists of three elements: two OSO surface detailees located at TSOC, enhanced IT capabilities, and a new rail security incident analysis product for stakeholders. According to TSA, one of the key functions of the surface detailees is to continuously look for trends and patterns in the rail security incident data that are reported to TSOC, and to coordinate with OSPIE and OIA to conduct further investigations into potential trends. As I will discuss later in this statement, TSA has also made improvements to WebEOC, including steps to improve the completeness and accuracy of the data and the ability to produce basic summary reports, which we believe should facilitate this type of continuous trend analysis. TSA generates a Trend Analysis Report for any potential security trends the surface detailees identify from the rail security incident data. The Trend Analysis Report integrates incident information from WebEOC with information from multiple other sources, including TSA’s compliance database and media reports, and provides rail agencies and other stakeholders with analysis of possible security issues that could affect operations as a result of these trends. According to TSA officials, since SCAN was established, approximately 13 Trend Analysis Reports have been produced and disseminated to local TSA inspection officials and rail agencies. Although we have not assessed the effectiveness of these efforts to better utilize rail security information, we believe these actions address the intent of our recommendation. Further, if implemented effectively, they should better position TSA to provide valuable analysis on rail security incidents and to develop recommended security measures for rail agencies, as appropriate. In December 2012, we found that TSA had not provided consistent oversight of the implementation of the rail security reporting requirement, which led to considerable variation in the types and number of passenger rail security incidents reported. Specifically, we found that TSA headquarters had not provided guidance to local TSA inspection officials, the primary TSA points of contact for rail agencies, about the types of rail security incidents that must be reported, a fact that contributed to inconsistent interpretation of the regulation by local TSA inspection officials. While some variation was expected in the number of rail security incidents that rail agencies reported because of differences in agency size, geographic location, and ridership, passenger rail agencies we spoke with at the time reported receiving inconsistent feedback from their local TSA officials regarding certain types of incidents, such as those involving weapons. As a result, we found that, for 7 of the 19 passenger rail agencies included in our review, the number of incidents reported per million riders ranged from 0.25 to 23.15. This variation we identified was compounded by inconsistencies in compliance inspections and enforcement actions, in part because of limited utilization of oversight mechanisms at the headquarters level. For example, in December 2012, we found that TSA established the RSI-S position as a primary oversight mechanism at the headquarters level for monitoring rail security compliance inspections and enforcement actions to help ensure consistency across field offices. However, at the time of our report, the RSI-S was not part of the formal inspection process and had no authority to ensure that inspections were conducted consistently. We also found that the RSI-S had limited visibility over when and where inspections were completed or enforcement actions were taken because TSA lacked a process to systematically provide the RSI-S with this information during the course of normal operations. As a result, our analysis of inspection data from January 1, 2011, through June 30, 2012, showed that average monthly inspections for the 19 rail agencies in our review ranged from about eight inspections to no inspections, and there was variation in the regularity with which inspections occurred. We also found that TSA inconsistently applied enforcement actions against passenger rail agencies for not complying with the reporting requirement. For example, TSA took enforcement action against an agency for not reporting an incident involving a knife, but did not take action against another agency for not reporting similar incidents, despite having been inspected. On the basis of these findings, in December 2012, we recommended that TSA: (1) develop and disseminate written guidance for local TSA inspection officials and rail agencies that clarifies the types of incidents that should be reported to the TSOC and (2) enhance and utilize existing oversight mechanisms at the headquarters level, as intended, to provide management oversight of local compliance inspections and enforcement actions. TSA concurred with both of these recommendations and has taken actions to implement them. Specifically, in September 2013, TSA disseminated written guidance to local TSA inspection officials and passenger and freight rail agencies that provides clarification about the requirements of the rail security incident reporting process. This guidance includes examples and descriptions of the types of incidents that should be reported under the regulatory criteria, as well as details about the type of information that should be included in the incident report provided to the TSOC. Further, as of August 2013, TSA had established an RSI- dashboard report that provides weekly, monthly, and quarterly information about the number of inspection reports that have been reviewed, accepted, and rejected. According to TSA officials, this helps ensure that rail agencies are inspected regularly, by providing the RSI-Ss with greater insight into inspection activities. TSA has also enhanced the utilization of the RSI-Ss by providing them with the ability to review both passenger and freight rail inspections before the inspection reports are finalized and enforcement action is taken. According to TSA officials, this allows the RSI-Ss to ensure that enforcement actions are applied consistently by local TSA inspection officials. TSA also developed a mechanism for tracking the recommendations RSI-Ss make to local TSA inspection officials regarding changes to local compliance inspections, as well as any actions that are taken in response. Collectively, we believe that these changes should allow the RSI-Ss to provide better management oversight of passenger and freight rail regulatory inspections and enforcement actions, though we have not assessed whether they have done so. We also believe these actions, if implemented effectively, will help ensure that the rail security incident reporting process is consistently implemented and enforced, and will address the intent of our recommendations. In December 2012, we also found that TSA’s incident management data system, known as WebEOC, had incomplete information, was prone to data entry errors, and had other limitations that inhibited TSA’s ability to search and extract basic information. These weaknesses in WebEOC hindered TSA’s ability to use rail security incident data to identify security trends or potential threats. Specifically, at the time of our 2012 report, TSA did not have an established process for ensuring that WebEOC was updated to include information about rail security incidents that had not been properly reported to the TSOC. As a result, of the 18 findings of noncompliance we reviewed that were a result of failure to report an incident, 13 were never entered into WebEOC, and consequently could not be used by TSA to identify potential security trends. In addition, in December 2012, we found that TSA’s guidance for officials responsible for entering incident data was insufficient, a fact that may have contributed to data entry errors in key fields, including the incident type and the mode of transportation (such as mass transit or freight rail). At the time of our report, because of data errors and technical limitations in WebEOC, TSA also could not provide us with basic summary information about the rail security incident data contained in WebEOC, such as the number of incidents reported by incident type (e.g., suspicious item or bomb threat), by a particular rail agency, or the total number of rail security incidents that have been reported to the TSOC. Without the ability to identify this information on the number of incidents by type or the total number of incidents, we concluded that TSA faced challenges determining if patterns or trends exist in the data, as the reporting system was intended to do. On the basis of these findings, in December 2012 we recommended that TSA (1) establish a process for updating WebEOC when incidents that had not previously been reported are discovered through compliance activities, and (2) develop guidance for TSOC officials that includes definitions of data entry options to reduce errors resulting from data entry problems. TSA concurred with both of these recommendations and has taken actions to implement them. Specifically, in March 2013, TSA established a process for the surface detailee position, discussed earlier in this statement, to update WebEOC when previously unreported incidents are discovered through compliance activities. Additionally, in October 2014, TSA officials reported they have updated the guidance used by TSOC officials responsible for entering incident data into WebEOC to include definitions of incident types. TSA has also made changes to WebEOC that will allow for officials to search for basic information, such as the total number of certain types of incidents, required to facilitate analysis. We have not reevaluated the data contained in WebEOC, but we believe that the changes TSA has made should allow the agency to conduct continuous analysis of the rail security incident data to identify potential trends. We believe these actions address the intent of our recommendations and, if implemented effectively, should improve the accuracy and completeness of the incident data in WebEOC. This should provide TSA with a more comprehensive picture of security incidents as well as allow it to better identify any trends or patterns. Chairmen Katko and King, Ranking Members Rice and Higgins, and members of the subcommittees this concludes my prepared statement. I would be happy to respond to any questions you may have at this time. For questions about this statement, please contact Jennifer Grover at (202) 512-7141 or groverj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this statement include Chris Ferencik (Assistant Director), Michele Fejfar, Paul Hobart, Adam Hoffman, Tracey King, Elizabeth Kowalewski, Brendan Kretzschmar, Kelly Rubin, and Christopher Yun. Key contributors to the previous work that this testimony is based on are listed in those reports. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The U.S. surface transportation system's size and importance to the country's safety, security, and economic well-being make it an attractive target for terrorists. Within the federal government, TSA–a component of the Department of Homeland Security–is the primary federal agency responsible for overseeing and enhancing the security of the surface transportation system. A key component of this responsibility is ensuring that security-related information is collected, analyzed, and shared effectively across all modes, including rail. In 2008, TSA issued a regulation requiring U.S. passenger rail agencies to report all potential threats and significant security concerns to TSA, among other things. This testimony addresses the extent to which TSA has (1) developed systematic processes for integrating stakeholder feedback about security-related information it provides and analyzing trends in reported rail security incidents and (2) ensured consistent implementation of rail security incident reporting requirements. This statement is based on related GAO reports issued in June 2014 and December 2012, including selected updates on TSA's efforts to implement GAO's prior recommendations related to rail security and information sharing. For the selected updates, GAO reviewed related documentation, including tools TSA developed to provide oversight. GAO also interviewed TSA officials. In June 2014, GAO found that the Transportation Security Administration (TSA) did not have a systematic process for incorporating stakeholder feedback to improve security-related information sharing and recommended that TSA systematically document and incorporate stakeholder feedback. TSA concurred with this recommendation and, in April 2015, TSA developed a standard operating procedure to help ensure proper evaluation and consideration of all feedback TSA receives. In December 2012, GAO found TSA had made limited use of the rail security incident information it had collected from rail agencies, in part because it did not have a systematic process for conducting trend analysis. TSA's purpose for collecting this information was to allow TSA to "connect the dots" through trend analysis. However, the incident information provided to rail agencies by TSA was generally limited to descriptions of specific incidents. As a result, officials from passenger rail agencies GAO spoke with reported that they generally found little value in TSA's incident reporting requirement. On the basis of these findings, GAO recommended that TSA establish a systematic process for regularly conducting trend analysis of the rail security incident data. Although GAO has not assessed the effectiveness of TSA's efforts, by August 2013, TSA had developed a new analysis capability that, among other things, produces Trend Analysis Reports from the incident data. In December 2012, GAO found that TSA had not provided consistent oversight of its rail security reporting requirement, which led to variation in the types and number of passenger rail security incidents reported. Specifically, GAO found that TSA headquarters had not provided guidance to local TSA inspection officials, the primary TSA points of contact for rail agencies, about the types of rail security incidents that must be reported, which contributed to inconsistent interpretation of the regulation. The variation in reporting was compounded by inconsistencies in compliance inspections and enforcement actions, in part because of limited utilization of oversight mechanisms at the headquarters level. GAO also found that TSA's incident management data system, WebEOC, had incomplete information, was prone to data entry errors, and had other limitations that inhibited TSA's ability to search and extract basic information. On the basis of these findings, GAO recommended that TSA (1) develop and disseminate written guidance on the types of incidents that should be reported, (2) enhance existing oversight mechanisms for compliance inspections and enforcement actions, (3) establish a process for updating WebEOC with previously unreported incidents, and (4) develop guidance to reduce data entry errors. TSA concurred with these recommendations and has taken actions to implement them. Specifically, in September 2013, TSA disseminated written guidance to local TSA inspection officials and passenger and freight rail agencies that provides clarification about the rail security incident reporting requirement. In August 2013, TSA enhanced existing oversight mechanisms by creating an inspection review mechanism, among other things. TSA also established a process for updating WebEOC in March 2013, and in October 2014, officials reported that they have updated the guidance used by officials responsible for entering incident data to reduce data entry errors associated with incident types. Although GAO has not assessed the effectiveness of these efforts, they address the intent of the recommendations. GAO is making no new recommendations in this statement.