Mass transit includes four main components––heavy rail, commuter rail, light rail, and bus. Heavy rail systems—subway systems like New York City’s transit system and Washington, D.C.’s metro—typically operate on fixed rail lines within a metropolitan area and have the capacity for a heavy volume of traffic. Commuter rail systems typically operate on railroad tracks and provide regional service (e.g., between a central city and adjacent suburbs). Light rail systems are typically characterized by lightweight passenger rail cars that operate on track that is not separated from vehicular traffic for much of the way. Large bus transit service is characterized by vehicles powered by diesel, gasoline, battery, or alternative fuel engines contained within the vehicle. According to the American Public Transportation Association (APTA), 10.7 billion trips were taken on mass transportation in 2008 —the highest number of trips taken on U.S. mass transportation in 52 years. According to TSA, transit officials, and transit experts, certain characteristics of mass transit systems, such as multiple access points and limited barriers to access, make them inherently vulnerable to terrorist attack and therefore difficult to secure. High ridership, expensive infrastructure, economic importance, and location in large metropolitan areas or tourist destinations also make them attractive targets for terrorists because of the potential for mass casualties and economic damage. Because of the expense of operating and securing a transit system, the costs are often shared among several entities. According to the Department of Transportation’s (DOT) Federal Transit Administration (FTA), almost all U.S. mass transit systems receive funds from public and private sector sources to maintain a public service that is provided and managed locally, since revenues from customer fares, on average, account for 40 percent of system operating costs. For example, FTA provides financial assistance to public transportation through its Large Urban Cities Grant Program which provides funding to urban areas through a formula- based allocation. Owners and operators of public transit systems are also responsible for ensuring the security of their systems. According to a 2004 APTA survey, transit agencies had more than $6 billion in transit security investment needs. To help defray the costs of securing U.S. transit systems, DHS has provided transit security grant funding to transit agencies since 2003. Beginning in fiscal year 2005, the DHS appropriations acts have provided annual appropriations for mass transit security, including the TSGP, which focused specifically on mass transit security. Table 1 outlines the TSGP allocations for fiscal year 2006 through fiscal year 2009. Both DHS appropriations acts and the Implementing Recommendations of the 9/11 Commission Act (9/11 Commission Act) outline requirements for security funding for mass transit and provide timelines for the issuance of grant program guidance and decisions. In addition to appropriating funding to the TSGP, DHS appropriations acts have provided deadlines for the issuance of grant guidance, the application period, and when DHS must act on applications. The 9/11 Commission Act required the Secretary of Homeland Security to establish a program for making grants to eligible public transportation agencies for security improvements, and DHS fulfilled this requirement through the TSGP. Although the TSGP considered risk prior to the passage of the 9/11 Commission Act, the act created additional requirements for the TSGP, including that recipients of public transportation funds be selected based on risk and that projects address items identified in security assessments or plans. It also outlined permissible use of funds and placed a limitation on the percentage of funds used for operational costs. Responsibility for administering mass transit security funding has changed numerous times within DHS since 2003. DHS’s Office of Domestic Preparedness administered the Urban Area Security Initiative (UASI) grant program from fiscal year 2003 to fiscal year 2005. During fiscal year 2006, the administration of the TSGP was transferred to TSA and the Office of Grants and Training within DHS’s Preparedness Directorate. TSA became the lead federal agency for determining the security priorities eligible for funding and developing the criteria for evaluating applications, while DHS’s Office of Grants and Training became responsible for grant management. The Post-Katrina Emergency Management Reform Act of 2007 transferred most offices within the Preparedness Directorate into FEMA; however, policy responsibilities, such as setting grant priorities and funding decisions, remained with TSA. As a result, during fiscal year 2007, the Office of Grants and Training was transferred to FEMA. In fiscal year 2008, FEMA’s Grant Programs Directorate became responsible for administering TSGP grants. Risk management has been endorsed by Congress, the President, the Secretary of Homeland Security, GAO, and others as a way to direct finite resources to areas that are most at risk of terrorist attack. Risk management is a continuous process that includes the assessment of threats, vulnerabilities, and consequences to determine what actions should be taken to reduce or eliminate one or more of these elements of risk. DHS released the NIPP, which created, in accordance with Homeland Security Presidential Directive 7 (HSPD-7), a risk-based framework. The NIPP, issued in 2006 and updated in 2009, sets forth guidance for agencies with critical infrastructure protection responsibilities, such as TSA, for the prioritization of protection initiatives and investments across sectors to ensure that government and private sector resources are applied where they offer the most benefit for mitigating risk. TSA created six transit security fundamentals that it states are the foundations for a successful security program, and the agency uses these fundamentals to prioritize TSGP projects. For the fiscal year 2008 and 2009 grant cycles, TSA established a systematic process to rank these priorities in awarding grant funds. To do this, TSA established project effectiveness groupings—groups of project types that TSA ranked in order of priority based on their ability to reduce risk—into which transit agency projects were placed. For example, in fiscal year 2008, there were four possible groupings (project types) for agency projects. The highest priority for that year focused on projects aimed at developing security plans and providing employee security training. See appendix II for the project effectiveness groupings for fiscal year 2008. DHS uses a risk model to help determine the transit agencies eligible for TSGP funds. Both TSA and FEMA share responsibility for the TSGP risk model, with TSA providing most of the data inputs to the model that is managed by FEMA. The TSGP’s risk methodology is similar to the methodology used to determine eligibility for other DHS state and local grant programs. For example, the methodology for determining basic eligibility for the TSGP is derived from the UASI grant program—both models identify and use the same urban areas and both the UASI and the TSGP risk models calculate risk scores for each urban area. See appendix III for additional details on the TSGP model. There are three stages of the TSGP grant cycle; allocation, award, and distribution, as discussed in figure 1. TSGP grant guidance is created annually by TSA and FEMA and provides an overview of the TSGP, the application materials needed to apply for funding under the program, and DHS management requirements. Tier II gencie compete for nd. Agencie’ project re reviewed y NRP nd Exective Commitee nd rnked based on rind other fctor. TSA nd T I gennd. DHS nno llon, bu not flied. When trit gencielfill ll grnt reqirement nd FEMA complete review, fnd re released. their project when the rd nnonced. Tier I gencieve 90 d to detil how they will implement the project. For fiscal year 2007, DHS had 75 days to release the grant guidance once the appropriations act had passed, and for fiscal year 2008, DHS had 30 days to release the grant guidance once the appropriations act had passed. Beginning in fiscal year 2009, Tier I transit agencies submit specific project information for award decisions prior to DHS award announcements. Using the TSGP risk analysis model, DHS develops risk scores, which are used to identify the highest-risk regions and the transit agencies within those regions that are eligible for funding. These regions are then placed into one of two tiers based on their risk scores to determine initial funding allocations; however, these allocations may change when DHS begins reviewing projects. Tier I: DHS determines the regions at the highest risk of a terrorist attack and selects transit agencies within those regions eligible to receive Tier I funding. Each Tier I region is given a target allocation based on its share of risk (as determined by the model). Each region, through discussions among transit agencies and TSA officials in the regional transit security working groups (RTSWG), decides which projects to fund on a collaborative basis. Each Tier I region has a RTSWG that includes eligible transit agencies, law enforcement agencies, and Amtrak (if stations exist in the region). Tier II: Lower-risk regions and certain transit agencies in those regions make up the Tier II group. The Tier II allocation is a set amount of funding allocated for all Tier II regions combined. Transit agencies in this tier apply for funding on a competitive basis—whereby their projects are evaluated against all other Tier II agency projects proposals, instead of funding decisions being determined collaboratively, as with the Tier I RTSWGs. After DHS announces target allocation amounts through the release of the grant guidance, Tier I and Tier II transit agencies have 45 days from the release of the guidance to apply for funding. During the award process, DHS evaluates transit agencies’ projects and determines which projects to fund, although the evaluation process for Tier I and Tier II agencies is different. Once the application period closes for Tier I and II, the DHS appropriations act states that DHS has 60 days to act upon the application, which DHS has defined as the length of time taken to review the applications, make the award decisions, and announce final allocations.