On May 22, 1998, President Clinton issued a pair of directives to guide federal efforts to address critical infrastructure vulnerabilities. Presidential Decision Directive 62 (PDD 62) highlighted the growing threat of unconventional attacks against the United States. It described a new and more systematic approach to fighting terrorism through interagency efforts to prepare for response to incidents involving weapons of mass destruction. Presidential Decision Directive 63 (PDD 63) further directed federal agencies to conduct risk assessments and planning efforts to reduce exposure to attack. Specifically, the assessments were to consider attacks that could significantly diminish the abilities of (1) the federal government to perform essential national security missions and ensure the general public health and safety; (2) state and local governments to maintain order and to deliver minimum essential public services; and (3) the private sector to ensure the orderly functioning of the economy and the delivery of essential telecommunications, energy, financial, and transportation services. PDD 63 called for the government to complete these assessment efforts no later than May 2003. According to the Office of Intelligence and Security’s (OIS) Associate Director for National Security (hereafter referred to as the Associate Director), the Transportation Infrastructure Assurance (TIA) program is, in part, DOT’s effort to meet these Presidential Decision Directive requirements. RSPA concentrates on multimodal issues (research that applies to more than one mode of transportation) that affect the entire U.S. transportation system rather than on a specific sector of the system. RSPA’s Office of Innovation, Research and Education is responsible for managing the TIA program. The Volpe National Transportation Systems Center, located in Cambridge, Massachusetts, is the research arm of RSPA and is conducting the program’s vulnerability assessments. OIS is the key transportation security stakeholder within DOT responsible for analyzing, developing, and coordinating departmental and national policies addressing national defense, border security, and transportation infrastructure assurance and protection issues. Other OIS responsibilities include: coordinating with the public and private sectors, international organizations, academia, and interest groups regarding issues of infrastructure protection; acting as the Secretary of Transportation’s liaison with the intelligence, law enforcement, and national defense communities and assisting departmental organizations in establishing and maintaining direct ties with those communities; and serving as the Secretary of Transportation’s primary advisor on significant intelligence issues affecting the traveling public, the transportation industry, and national security. According to OIS’s Associate Director, OIS has historically been involved in the department’s transportation security research efforts. He added that OIS’s lead role in fulfilling the department’s critical infrastructure responsibilities, including the implementation of Presidential Decision Directives addressing critical infrastructure vulnerabilities, is likely to change as the roles and responsibilities of the Transportation Security Administration (TSA) and the newly created Department of Homeland Security are defined. Congress established TSA in November 2001 to be responsible for ensuring transportation security, including identifying and undertaking research and development activities necessary to enhance transportation security. For fiscal year 2003, TSA received $110 million to fund transportation security research activities for all modes of transportation. Further, on November 25, 2002, the President signed the Homeland Security Act of 2002, which established the Department of Homeland Security with the responsibility of, among other tasks, coordinating efforts in securing America’s critical infrastructure. On March 1, 2003, TSA became part of the newly created Department of Homeland Security. The TIA program is scheduled to end in December 2003, resulting in the completion of four vulnerability assessments aimed at identifying and finding ways to mitigate threats against the nation’s transportation infrastructure. RSPA officials said that two of these assessments (the interdependency of the transportation system with other critical infrastructures and transportation and logistical requirements for emergency response teams in dealing with weapons of mass destruction) were selected, in part, to meet DOT’s PDD 62 and 63 requirements, and are scheduled for completion in mid-2003 to meet the deadlines outlined in the presidential directives. The other two assessments (the feasibility of alternative backup systems for the global positioning system, and an assessment of the options to transition from hazardous materials transportation security guidelines to security requirements) were selected based upon a perceived need for assessments in these areas as defined by officials from RSPA’s Office of Hazardous Materials Safety and the Volpe National Transportation Systems Center, and are scheduled for completion in December 2003. RSPA’s Volpe Center is conducting the TIA program’s four assessments and has conducted research related to transportation infrastructure since 1996. (See app. I for a summary of the Volpe Center’s Workshops and Studies related to transportation infrastructure assurance from fiscal years 1996 to 2000.) Figure 1 shows the TIA program’s beginning and completion dates by specific vulnerability assessment. RSPA officials told us that it has no plans to include any additional or future assessments under the TIA program. The TIA program is assessing four vulnerabilities: Interdependency of the transportation system with other critical infrastructures: According to TIA program documentation, the development of alternative fuels, changes in telecommunication technologies, and the evolving financial role of the federal government in the security of privately operated transportation systems are affecting the relationship between the nation’s transportation infrastructure and some of the nation’s other critical infrastructures. The purpose of this assessment is to describe the current and evolving dependence between the nation’s transportation infrastructure and some of the nation’s other critical infrastructures including energy, electronic-commerce, banking and finance, and telecommunications. For example, the nation’s air traffic control system relies on telecommunications to manage the safety and efficiency of air transportation, as shown in figure 2. Researchers plan to determine the costs, in terms of economic disruption and loss of lives, associated with terrorists exploiting transportation infrastructure vulnerabilities. Transportation and logistical requirements for emergency response teams in dealing with weapons of mass destruction: The purpose of this assessment is to evaluate the transportation and logistics assets required in responding to terrorist activities. The assessment will include an analysis of transportation operations and procedures, personnel, supplies, and transportation assets such as vehicles, containers, and pallets. Specifically, researchers plan to analyze the institutional and economic implications of terrorist activities involving weapons of mass destruction in order to develop emergency transportation action plans and compile emergency transportation procedure best practices. Emergency teams were transported to respond to the terrorist attack on the World Trade Center on September 11, 2001, as shown in figure 3. Feasibility of alternative backup systems for the global positioning system: The purpose of this assessment is to provide a continuation of the August 2001 report by the Volpe National Transportation Systems Center, Vulnerability of the Transportation Infrastructure Relying On The Global Positioning System. The report concluded that the global positioning system is vulnerable to both intentional and nonintentional disruption, and identified a need for a backup for the global positioning system. To follow- up on the August 2001 report, researchers plan to analyze and describe the performance, cost, and practicality of backup systems and procedures. Figure 4 shows a picture of a global positioning satellite. Options to transition hazardous materials transportation security guidelines to security requirements: The purpose of this assessment is to evaluate the tradeoffs in the transportation of hazardous materials that exist between security, economic, proprietary, and delivery factors. RSPA plans to provide an analysis and description of these tradeoffs in different threat scenarios for different modes of transportation. Figure 5 provides an overview of the types of transportation being assessed. RSPA plans to work with OIS to disseminate the results of the program to private transportation system operators and to stakeholders in DOT and other federal agencies through 11 formal reports, presentations, workshops, and the Internet. Table 1 provides an overview of the program’s planned products and progress to date. Congress appropriated $1 million each year to RSPA for the TIA program in fiscal years 2001, 2002, and 2003. Figure 6 provides an overview of the TIA program funding for fiscal years 2001 through 2003 for each of the four vulnerability assessments. RSPA has not fully coordinated their activities with OIS—DOT’s key transportation security stakeholder—in selecting the vulnerabilities to be assessed or in implementing the assessments for the TIA program. RSPA coordinated with OIS in selecting two vulnerability assessments in fiscal year 2001. Specifically, in fiscal year 2001, RSPA worked with OIS to select one vulnerability for assessment and notified OIS of its selection of a second vulnerability for assessment. RSPA, however, did not coordinate with OIS officials in the selection of two additional vulnerability assessments in fiscal year 2002. RSPA’s coordination with OIS during the program’s implementation has been limited to only one of the four vulnerability assessments under review. RSPA coordinated with OIS and used various criteria, such as PDD 62 and 63, in selecting only two of the four vulnerabilities to be assessed in the TIA program. For example, RSPA consulted with OIS to select one of the two vulnerabilities for assessment in fiscal year 2001 and notified OIS of its selection of a second vulnerability. Specifically, in a memorandum dated March 6, 2001, OIS identified and proposed a list of critical infrastructure protection research requirements for assessment and requested that RSPA address them as a high priority. In this initial proposal, the Director of OIS said that significant OIS involvement would be required to effectively implement the program given its responsibilities for defining transportation security vulnerabilities, ensuring that vulnerability assessments are conducted, and implementing actions to mitigate those vulnerabilities. On April 9, 2001, RSPA issued a memorandum to OIS outlining its research agenda for fiscal year 2001 and stating that OIS’s involvement in assuring the program’s quality, credibility, and review was critical.