TSA is the primary federal agency responsible for overseeing the security of the mass transit, passenger rail, and freight rail systems. However, several other agencies, including DOT’s Federal Transit Administration (FTA) and Federal Railroad Administration (FRA), also play a role in helping to oversee these systems. Since it is not practical or feasible to protect all assets and systems against every possible terrorist threat, DHS has called for using risk-informed approaches to prioritize its security- related investments and for developing plans and allocating resources in a way that balances security and commerce. In June 2006, DHS issued the National Infrastructure Protection Plan (NIPP), which established a six-step risk management framework to establish national priorities, goals, and requirements for Critical Infrastructure and Key Resources protection so that federal funding and resources are applied in the most cost-effective manner to deter threats, reduce vulnerabilities, and minimize the consequences of attacks and other incidents. The NIPP, updated in 2009, defines risk as a function of three elements: threat—an indication of the likelihood that a specific type of attack will be initiated against a specific target or class of targets; vulnerability—the probability that a particular attempted attack will succeed against a particular target or class of targets; and consequence—the effect of a successful attack. In August 2007, the Implementing Recommendations of the 9/11 Commission Act (9/11 Commission Act) was signed into law, which included provisions that task DHS with actions related to surface transportation security. Among other things, these provisions include mandates for developing and issuing regulations for transportation security training programs and ensuring that transportation modal security plans include threats, vulnerabilities, and consequences for transportation infrastructure assets including rail. In response to our previous recommendations, TSA has taken steps to conduct comprehensive risk assessments across the transportation sector and within the passenger and freight rail modes that are based on assessments of threat, vulnerability, and consequence. In March 2009, we reported that TSA had taken some actions to implement a risk management approach but had not conducted comprehensive risk assessments that integrate threat, vulnerability, and consequence for each mode or the transportation sector as a whole, as called for by the NIPP. We recommended that TSA conduct risk assessments that combine these three elements to help the agency produce a comparative analysis of risk across the entire transportation sector, which the agency could use to inform current and future investment decisions. DHS concurred with this recommendation, and in June 2010 TSA produced the Transportation Sector Security Risk Assessment (TSSRA), which assessed risk within and across the various aviation and surface transportation modes, including rail, and incorporated threat, vulnerability, and consequence. A September 2009 letter from the Director of DHS’s Office of Risk Management and Analysis noted that in developing the TSSRA, TSA was making progress toward developing a strategic and comprehensive risk management approach that would bett align with DHS’s risk management framework and address our er recommendations. However, TSA noted limitations in the June 2010 TSSRA report that could limit its usefulness in guiding investment decisions across the transportation sector as a whole. For example, the TSSRA excluded the maritime sector and certain types of threats, such as from “lone wolf” operators. In June 2011, agency officials stated that TSA is working to address these limitations in the next version, which is scheduled for completion by the end of calendar year 2011. TSA also said that it is strengthening and enhancing the TSSRA methodology based on an ongoing independent verification and validation that is scheduled for completion later this year. In addition, TSA officials noted that other DHS components, such as the U.S. Coast Guard, conduct risk assessments of the maritime sector that complement the TSSRA. With regard to assessments of mass transit and passenger rail transportation, we reported in June 2009 that although TSA had contributed to DHS’s risk assessment effort, it had not conducted its own risk assessment of mass transit and passenger rail systems. We recommended that TSA conduct a risk assessment that integrates all three elements of risk. DHS officials concurred with the recommendation, and in March 2010 said that they had developed a mass transit risk assessment tool to assess risk to mass transit and passenger rail systems using threat, vulnerability, and consequence, in addition to the TSSRA. According to TSA, they have completed pilot tests of this tool on three transit systems as of June 2011 and anticipate assessing six additional transit systems by the end of the calendar year. Similarly, in April 2009, we reported that TSA’s efforts to address freight rail security were limited and did not focus on a range of threats identified by federal and industry assessments. TSA’s security efforts focused almost entirely on transportation of Toxic Inhalation Hazards (TIH); however, other federal and industry assessments had identified additional potential security threats, such as risks to bridges and tunnels. We reported that although TSA’s focus on TIH had been a reasonable initial approach, there are other security threats for TSA to consider and evaluate, including potential sabotage to critical infrastructure. We recommended that TSA expand its efforts to include all security threats in its freight rail security strategy. TSA concurred and reported that it had developed a Critical Infrastructure Risk Tool to measure the criticality and vulnerability of freight railroad bridges. As of June 2011, the agency has used this tool to assess 77 bridges, some of which transverse either the Mississippi or Missouri Rivers, and 26 freight rail tunnels. Our prior work has also assessed TSA’s efforts to incorporate risk management principles into the grant allocation process, and we reported that transit grant funding decisions could be improved with better assessments of vulnerability. For example, we reported in June 2009 that the Transit Security Grant Program (TSGP) risk model included all three elements of risk, but could be strengthened by measuring variations in vulnerability. DHS held vulnerability constant in its assessments, which limits the model’s overall ability to assess risk. We recommended that DHS strengthen its methodology for determining risk by developing a cost- effective method for incorporating vulnerability information in its TSGP risk model. DHS concurred with the recommendation, and in April 2010 TSA stated that it is reevaluating the risk model for the fiscal year 2011 grant cycle. In June 2011, TSA stated that it is considering asset-specific vulnerability when looking at risk, although TSA noted that the Federal Emergency Management Agency (FEMA) has ownership of the TSGP risk model. TSA provides input into the model, however. We are currently assessing DHS and FEMA efforts to improve the TSGP grant-allocation process as part of our current review of DHS grant programs being conducted for your committee and expect to issue a report on the results of this effort later this year. Industry stakeholders have examined and implemented various technologies to enhance the security of the rail system. For example, in April 2009, we reported that several freight rail carriers we met with installed security cameras and monitoring equipment at some of their key facilities to better monitor the activities in and around these areas. We also reported that officials from three railroads and two chemical companies we met with stated that they had taken steps to attempt to better track the movements of their TIH rail shipments by installing Global Positioning System technology on their locomotives and tank cars. Similarly, in June 2009, we reported that many mass transit and passenger rail agencies reported making capital improvements to secure their systems. For example, 19 of the 30 transit agencies we interviewed had embarked on programs since 2004 to upgrade their existing security technology, including upgrading closed circuit television at key station locations with video surveillance systems that alert personnel to suspicious activities and abandoned packages and installing chemical, biological, radiological, nuclear, and explosives detection equipment and laser intrusion detection systems in critical areas. While industry has taken these steps to implement technology to enhance rail security, the nature of the rail system has presented challenges to further implementation. For example, we reported in July 2010 that in commuter or light rail systems, many stations may be unmanned outdoor platforms without barriers between public areas and trains. Stations may also have few natural locations to place technologies to be able to screen passengers. With limited existing chokepoints, implementation of certain technologies may require station infrastructure modifications to aid in funneling passengers for screening. Similarly, challenges to using technology to secure the freight rail system include the size and open nature of the system, the need for railcars to be able to continuously move, and limited resources. We have also reported that several technologies are available to help address rail security challenges, but they are at varying levels of maturity and using them involves trade-offs in mobility, cost, and privacy. For example, in July 2010, we reported that the ability of explosives detection technologies to help protect the passenger rail environment depends both upon their detection performance and how effectively the technologies can be deployed in that environment. Detection performance of these technologies varies across the different technologies and additional limitations—such as limited screening throughput, privacy, openness, physical infrastructure, cost, and mobility concerns—have restricted their more widespread or more effective use in passenger rail. More-established explosives detection technologies—such as handheld explosive trace detection systems, x-raying imaging systems, and canines—have demonstrated good performance against many conventional explosives threats but are challenged by threats from certain explosives. Newer technologies—such as Explosive Trace Portals (ETP), standoff detection systems, and Advanced Imaging Technologies (AIT)—while available, are in various stages of maturity and more operational experience would be required to determine whether they can be effectively implemented in a rail environment. For example, AIT technologies have the ability to detect hidden objects; however, they are walk-through devices that would require rail passengers to be funneled through the equipment, limiting passenger throughput with long screening times. Standoff technology can be used to detect hidden objects on an individual from a significant distance and is attractive because it may have less effect on passenger throughput than other new technologies. However, certain types of standoff systems, as well as AIT technologies raise privacy concerns because they create images of individuals underneath their clothing. In our July 2010 report, we did not make any recommendations regarding the explosives detection technologies available or in development that could help secure passenger rail systems, but we raised various policy considerations. Among other things, we noted that securing passenger rail involves multiple security measures, with explosives detection technologies just one of several components that policymakers can consider as part of the overall security environment. In determining whether and how to implement these technologies, federal agencies and rail operators will likely be confronted with challenges related to the costs versus the benefits of a given technology and the potential privacy and legal implications of using explosives detection technologies. In 2007 TSA officials identified the need for increased security training at mass transit and passenger rail systems because the extent of training provided varied greatly—with a majority providing an introductory level of safety and security training for new hires, but not refresher training. In addition, TSA identified security awareness training and a lack of a robust, standardized corporate security planning for freight railroads as systematic security gaps. The 9/11 Commission Act mandates TSA to develop and issue regulations for a public transportation security training program and for a railroad security training program. In June 2009, we reported that TSA had not implemented this requirement or several others related to mass transit and passenger rail security, and recommended that DHS develop a plan with milestones for doing so. DHS concurred with this recommendation, and in June 2011, TSA stated that it had developed a plan and milestones for addressing uncompleted 9/11 Commission Act requirements. TSA also stated that it is finalizing the security training program regulations and expects to issue a Notice of Proposed Rulemaking for public comment by November 2011. A TSA official indicated that the delay was due, in part, to difficulties incurred in trying to address multiple modes of transportation in one regulation. To address identified training deficiencies, TSA supports security training through its TSGP and voluntary security awareness programs. TSA established a Mass Transit Security Training program in 2007 to provide curriculum guidelines for basic and follow-on security training areas and makes funding available through TSGP. For example, TSA offers mass transit and passenger rail agencies the option of using grant funding to cover costs for training to employees that is supplied by either (1) training providers that are federally funded or sponsored or (2) other training providers. However, in June 2009 we reported that opportunities exist for TSA to strengthen its process for ensuring consistency in the performance of nonfederal training vendors that mass transit and passenger rail agencies use to obtain training through the program. We recommended that to better ensure that DHS consistently funds sound and valid security training delivery programs for mass transit and passenger rail employees, TSA should consider enhancing its criteria for evaluating whether security training vendors meet the performance standards of federally sponsored training providers and whether the nonfederally sponsored providers could be used by transit agencies for training under the transit security grant program. DHS concurred with the recommendation, noting that TSA would work with the FTA through an existing joint working group to develop criteria for reviewing new vendor-provided training courses. In February 2010, TSA stated that it had proposed a joint task group with the FTA to define evaluation criteria for courses submitted by mass transit or passenger rail agencies, academic institutions, or other entities. In June 2011, TSA stated that the joint task group—which is being led by TSA and will include members from the FTA and industry—is in the process of organizing its first meeting. According to TSA, the group will use the criteria it develops to evaluate vendor training courses by the fall of 2011. DHS, DOT, and others have also taken steps to enhance rail and transit security awareness in partnership with the public and private entities that own and operate the nation’s transit and rail systems through voluntary security awareness programs. For example, the Transit Watch Program, co-led by TSA and the FTA, provides a nationwide safety and security awareness program designed to encourage the active participation of transit passengers and employees. By means of this program, the federal government, in collaboration with industry, created templates for transit agencies to develop or enhance their own public awareness programs. In July 2010, DHS launched the “If You See Something, Say Something,” campaign as a way to raise public and frontline employee awareness of indicators of terrorism, crime, and other threats and emphasize the importance of reporting suspicious activity to the proper transportation and law enforcement authorities. While TSA is taking steps to improve information sharing with freight and passenger rail stakeholders, potential overlap could complicate stakeholder efforts to discern relevant information and take appropriate actions to enhance security. In September 2010, we identified the potential for overlap among three federal information-sharing mechanisms: the public transit portal on the Homeland Security Information Network (HSIN-PT), TSA Office of Intelligence’s page on HSIN, and the Public Transit Information Sharing and Analysis Center (PT-ISAC). Each of these receives funding from DHS to share security threats and other types of security-related information with public transit agencies. We recommended that DHS establish time frames for a working group of federal and industry officials to assess opportunities to streamline information-sharing mechanisms to reduce any unneeded overlap. DHS concurred with this recommendation. In response to our recommendation, DHS and the rail industry have taken steps to streamline the information distributed to stakeholders. TSA and key industry groups have developed the Transit and Rail Intelligence Awareness Daily (TRIAD) Report and associated Transportation Information Library. The overall intent of TRIAD is to streamline the analysis, sharing, and exchange of intelligence and security information that had been disseminated by multiple sources. TRIAD includes a daily publication to enhance situational awareness, an alert message to provide immediate awareness of a developing threat or incident, and a catalogue of supporting reports and related documents. According to TSA and its industry partners, HSIN-PT will supplement TRIAD by serving as a reference source to house cross-sector best practices, additional intelligence, and threat information as well as transit security standards and all-hazards information. The TSA Office of Intelligence stated that it will continue to have a portal on HSIN that supplements the information on the PT-ISAC and HSIN-PT. While the TRIAD report may reduce the number of security-related e-mails that transit agencies receive, it does not reduce overlap among the three information-sharing mechanisms. In June 2011, TSA officials stated that they are continuing to coordinate with other members of the working group to identify actions and time frames for addressing our recommendation. Our recent work indicates that some rail stakeholders do not receive security information from TSA. In September 2010, we reported that less than half of public transit agencies (34 of 77) responding to our 2010 survey reported that they had log-in access to HSIN, TSA’s primary mechanism for sharing open-source security-related information with transportation stakeholders, and had not lost or forgotten their log-in information. Our survey also identified that, of the 19 transit agencies that did not have HSIN access, 12 had never heard of the mechanism, and an additional 11 agencies did not know whether they had access to HSIN. We recommended that TSA establish time frames for the transit-sector public-private working group to conduct targeted outreach efforts to increase awareness of HSIN among agencies that are not currently using or aware of this system. DHS officials concurred with this recommendation and in January 2011 provided an implementation plan with target dates for addressing it. However, the plan was insufficiently detailed for us to determine whether it fully addresses the recommendation. For example, the plan stated that TSA officials created a consolidated “superlist” of current PT-ISAC and HSIN-PT members and transit agencies on a TSA distribution list and intend to encourage all entities on this superlist to join the PT-ISAC and HSIN-PT. However, the plan did not indicate how TSA would target its outreach efforts to those entities not already on one of those lists. In June 2011, a TSA official stated that the public-private working group plans to reach out to other transit entities, such as small agencies, to encourage them to join the PT-ISAC and HSIN-PT. As noted above, TSA officials stated that they are continuing to coordinate with other members of the working group to identify actions and time frames for addressing our recommendation. Preliminary observations from our ongoing work also indicate that some freight rail stakeholders would prefer to receive more analysis or actionable security information from TSA. The federal government’s National Strategy for Information Sharing discusses the need to improve the two-way sharing of terrorism-related information on incidents, threats, consequences, and vulnerabilities, including enhancing the quantity and quality of specific, timely, and actionable information provided by the federal government to critical infrastructure sectors. According to three Class I rail stakeholders that we interviewed, TSA distributes information on rail security that is generally used for situational awareness. However, rail security stakeholders from three of the seven Class I railroads that we surveyed indicated that TSA’s security information products lack analysis, such as trend analysis, that could help predict how certain events may affect freight rail. In follow-up interviews, security officials at three Class I railroads stated that security information provided by TSA does not offer actionable information that could allow them to develop or adjust their current countermeasures against potential terrorist threats. These security officials added that they have often received the same information that TSA provides from the media or other sources before it is distributed from TSA. For example, two of these officials told us that they received little or no security-related information from TSA in the aftermath of Osama bin Laden’s death. However, security officials at two of the three rail carriers that we interviewed stated that they felt confident that someone from the federal government would alert them of any direct threat to that carrier. TSA officials agree that improvements are needed in the products and mechanisms by which they alert rail agencies of security-related information and intelligence. For example, a TSA official stated in June 2011 that the agency is in the process of revising its reports on suspicious incidents to regionalize the information provided to rail carriers, in response to feedback from those carriers. We will continue to assess TSA’s efforts related to security information-sharing and will report the final results later this year. Chairman Rockefeller, Ranking Member Hutchison, and members of the Committee, this completes my prepared statement. I look forward to responding to any questions you may have. For further information on this testimony, please contact Steve Lord at (202) 512-8777 or at lords@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony include Jessica Lucas-Judy, Assistant Director; Robert Rivas, analyst-in- charge; Charles Bausell; Orlando Copeland; Chris Ferencik; Kevin Heinz; Dawn Hoff; Tracey King; Daniel Klabunde; Stan Kostyla; Landis Lindsey; Ying Long; Robert Lowthian; Marvin McGill; Lauren Membreno; Jessica Orr; and Michael Silver. Public Transit Security Information Sharing: DHS Could Improve Information Sharing through Streamlining and Increased Outreach. GAO-10-895. Washington, D.C.: September 22, 2010. Technology Assessment: Explosives Detection Technologies to Protect Passenger Rail. GAO-10-898. Washington, D.C.: July 28, 2010. Surface Transportation Security: TSA Has Taken Actions to Manage Risk, Improve Coordination, and Measure Performance, but Additional Actions Would Enhance Its Efforts. GAO-10-650T. Washington, D.C.: April 21, 2010. Transportation Security: Key Actions Have Been Taken to Enhance Mass Transit and Passenger Rail Security, but Opportunities Exist to Strengthen Federal Strategy and Programs. GAO-09-678. Washington, D.C.: June 24, 2009. Transit Security Grant Program: DHS Allocates Grants Based on Risk, but Its Risk Methodology, Management Controls, and Grant Oversight Can Be Strengthened. GAO-09-491. Washington, D.C.: June 8, 2009. Freight Rail Security: Actions Have Been Taken to Enhance Security, but the Federal Strategy Can Be Strengthened and Security Efforts Better Monitored. GAO-09-243. Washington, D.C.: April 21, 2009. Transportation Security: Comprehensive Risk Assessments and Stronger Internal Controls Needed to Help Inform TSA Resource Allocation. GAO-09-492. Washington, D.C.: March 27, 2009. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Alleged terrorist plots against rail systems in major U.S. cities have increased focus on these systems. The Transportation Security Administration (TSA), within the Department of Homeland Security (DHS), is the primary federal agency responsible for rail security. This testimony addresses the following: (1) the extent that DHS has conducted comprehensive risk assessments for the transportation sector, including for rail, (2) technologies available to enhance rail security, (3) TSA's efforts regarding rail security training, and (4) rail stakeholders' satisfaction with security-related information TSA is providing. GAO's testimony is based on GAO reports issued from March 2009 through September 2010, selected updates conducted in May through June 2011, and preliminary results from ongoing work on information sharing. As part of the ongoing work, GAO surveyed the seven largest freight rail carriers (based on revenue) and interviewed security officials from three of these rail carriers selected for location, as well as TSA officials. TSA has taken steps to conduct comprehensive risk assessments across the transportation sector and within passenger and freight rail modes that combine the three elements of risk--threat, vulnerability, and consequence. For example, in March 2009, GAO reported that TSA had taken actions to implement a risk management approach but had not conducted comprehensive risk assessments for the transportation sector as a whole, and recommended that TSA do so to help ensure that resources are allocated to the highest-priority risks. DHS concurred and in June 2010 produced the Transportation Sector Security Risk Assessment, which assessed risk as a factor of all three risk elements within and across the transportation sector, including rail. GAO has also made recommendations to strengthen risk assessments within individual modes, such as expanding TSA's efforts to include all security threats in its freight rail assessments, including potential sabotage to bridges, tunnels, and other critical infrastructure. DHS concurred and is addressing the recommendations. Several technologies are available to address rail security, such as security cameras, handheld explosive trace detection systems, x-raying imaging systems, and canines. However, technologies are at varying levels of maturity and involve trade-offs in mobility, cost, and privacy. In July 2010, for example, we reported that the ability of explosives detection technologies to help protect the passenger rail environment depends on detection performance and how effectively they can be deployed. TSA has not issued regulations for public transportation and railroad security training programs, as required by the Implementing Recommendations of the 9/11 Commission Act of 2007. In June 2009, GAO reported that TSA had not implemented the training requirement and recommended that DHS develop a plan with milestones for doing so, as called for by project management best practices. DHS concurred, and in June 2011 TSA stated that it had developed a timeline for uncompleted 9/11 Commission Act requirements. TSA also stated that it is finalizing the security training program regulations and expects to issue a Notice of Proposed Rulemaking for public comment by November 2011. Opportunities exist to streamline security information for transit agencies, and preliminary results of ongoing work indicate that some freight rail agencies do not receive actionable information from TSA. In September 2010, GAO recommended that DHS assess opportunities to streamline information-sharing mechanisms to reduce overlap. DHS concurred, and in response it and the rail industry have developed a streamlined product. However, preliminary observations from GAO's ongoing work indicate that some rail stakeholders would prefer to receive actionable security information and analysis from TSA that could allow them to adjust to potential terrorist threats. TSA officials agreed that improvements are needed in the products and mechanisms by which they alert rail agencies of security-related information. GAO will continue to monitor this issue and expects to issue a report by the end of 2011. GAO has made recommendations in prior work to enhance DHS's and TSA's rail security efforts. DHS generally concurred with the recommendations and has actions under way to address them. DHS generally agreed with the preliminary observations in this statement, and provided technical comments, which were incorporated as appropriate.