Congressional concerns over the protection of passenger rail systems are a priority in the 110 th Congress. Congress greatly expanded the federal role in passenger rail security in Title XIV (the National Transit Systems Security Act of 2007) and Title XV (Surface Transportation Security) of the Implementing Recommendations of the 9/11 Commission Act of 2007 ( H.R. 1 / P.L. 110-53 ). Multiple bombings of passenger trains in India in 2006 and 2007, preceded by the bombings of London subway trains on July 7, 2005, the alleged attempt to bomb London subway trains again on July 21, 2005, and the bombing of Spanish commuter trains in 2004, provide a backdrop to Congress's efforts to reduce the risk of attacks against passenger rail operations in the United States. The 9/11 Commission characterized the federal emphasis on aviation security spending as "fight[ing] the last war," noting that "opportunities to do harm are as great, or greater, in maritime or surface transportation." This report summarizes the challenges of securing passenger rail systems, options for making decisions about security funding, industry requests for funding, and passenger-rail related legislative action. It does not address the security of freight rail operations. However, since some passenger rail operations use the same track and facilities as freight rail, these topics cannot be completely separated. Passenger rail systems have vulnerabilities that are difficult to mitigate. But the risk to passengers on these systems from terrorist attack is quite small, relative to the number of trips these systems provide daily, and travel on passenger rail systems is safer overall than the primary alternative, the automobile. Passenger rail service takes four forms: heavy rail (e.g., subway systems like Washington D.C.'s Metro), commuter rail (e.g., Maryland's Maryland Rail Commuter, or MARC, and Virginia's Virginia Railway Express, or VRE, trains), light rail (e.g., Dallas's DART), and intercity passenger rail (Amtrak). The first three are forms of public transit, which, along with Amtrak, share certain characteristics that make them vulnerable to attack: (1) they make scheduled stops along fixed routes; (2) their operations depend on people having quick and easy access to stations and trains; (3) the number of access points, volume of ridership, and pace of operations make it impractical to subject all rail passengers to the type of screening that airline passengers undergo; and (4) the number of operators and scale of operations of all forms of passenger rails systems in the United States make it difficult to provide uniform levels of security to each and every rail system. Congress remains concerned about rail security in part because in recent years there have been a number of attacks on passenger rail systems in other countries. The 9/11 Commission noted in its final report, "Surface transportation systems such as railroads and mass transit remain hard to protect because they are so accessible and extensive." With one possible exception, CRS has been unable to find a case of a terrorist attack on a passenger rail system in the United States in recent history. This does not mean, however, that these systems are not vulnerable to attack. The recent attacks on passenger rail systems in other countries have resulted in hundreds of deaths. Yet in the context of millions of people riding passenger rail every day, the risk to a rail passenger of dying in any country as the result of a terrorist attack continues to be extremely small. Conversely, during the years 2003-2005, more than 80 passengers died in accidents on rail systems in the United States. Given that Americans take more than 3.5 billion trips on passenger rail systems each year, the risk of dying in a rail accident is also extremely small, but it is not zero. The goal of a terrorist attack is not simply to kill people, but, as the name implies, to sow terror, to disrupt the social order by spreading fear and uncertainty about the future. People have died as a result of accidents on passenger rail systems, which are more common than acts of terror against such systems, but a terrorist attack would have greater shock value. One possible consequence of such an attack could be for people to switch from using rail to other modes of transportation. Switching to one likely alternative, driving, would actually raise the risk of death, due to the higher risk of accident and injury faced by drivers compared to rail passengers. In short, while rail systems and their passengers may be vulnerable to attack, the risk of attack is smaller than other risks those passengers face, including the relatively remote risk of death by accident. Perhaps more vulnerable to attack is the nation's sense of the social order. In the aftermath of an attack, people experience fear, especially as they consider the possibility of further attacks. While government can do things to reduce the risk of an attack on passenger rail systems, such attacks cannot absolutely be prevented. If an attack on a passenger rail system were to occur, the psychological impact could be reduced by restoring a sense of normalcy as quickly as possible. This could be accomplished by, among other things, resuming passenger rail operations and apprehending the persons responsible for the attack. As Tim O'Toole, Managing Director of London's subway system, testified, "we believe our greatest defence comes from our rapid response and restoration of service, denying terrorists the chaos and fear they are seeking and thereby discouraging their return." Immediately after the attacks of September 11, 2001, the Federal Transit Administration (FTA) of the U.S. Department of Transportation (DOT) conducted vulnerability assessments of the 37 largest transit agencies, and the Federal Railroad Administration (FRA) conducted security inspections of commuter railroads. Subsequently, additional assessments of the same agencies and others were performed with assistance from the Transportation Security Administration (TSA) and the Office of Grants and Training of the Department of Homeland Security (DHS). Transit agencies have used these assessments to help identify and prioritize security actions. William Millar, president of the American Public Transportation Association (APTA), testified in January 2007 that the transit industry has spent $2.5 billion since September 11, 2001, on security and emergency preparedness measures. In the Intelligence Reform and Terrorism Prevention Act of 2004 ( P.L. 108-458 ), Congress directed DHS to prepare a national strategy for transportation security and security plans for each transportation mode. The national strategy was completed in 2005; the mode-specific security plans were released in May 2007. Congress has provided a total of $1.09 billion for grants to passenger rail systems since September 11, 2001, mostly through DHS annual appropriations acts. These funds can be used for security-related planning, acquisition of equipment, training, exercises, and administrative expenses. On May 20, 2004, after the bombings of commuter trains in Madrid, TSA issued security directives for U.S. passenger rail systems. Although these directives were not made public, they reportedly reflected actions already taken by many U.S. rail systems. These included removing or hardening trash containers on boarding platforms that could be used to hide bombs, increasing the presence of security officers, using video surveillance in and around stations, conducting random inspections of passengers and baggage (sometimes with the help of bomb-sniffing dogs), and encouraging riders to look for suspicious activity. The Government Accountability Office (GAO) has noted that "the issuance of these directives was an effort to take swift action in response to a current threat." However, the GAO goes on to write that because the rail industry and federal stakeholders were afforded only limited input and review, the directives "may not provide the industry with baseline security standards based on industry best practices." Furthermore, GAO "recommended that TSA collaborate with the Department of Transportation and the passenger rail industry to develop rail security standards that reflect industry best practices and that can be measured, monitored, and enforced." The FRA and the passenger rail industry have raised concerns about some of these directives, including at least one that seems to conflict with other federal safety regulations. According to GAO, "in January 2007, TSA stated that it recognizes the need to closely partner with the passenger rail industry to develop security standards and directives." Since September 2005, TSA has hired 100 surface transportation inspectors to monitor and enforce compliance with TSA rail security directives. In September 2006, FRA's and TSA's roles and responsibilities for compliance inspections were outlined in an annex to the existing memorandum of understanding between DHS and DOT. Additionally, according to TSA, their "inspectors have developed relationships with security officials in passenger rail and transit systems, coordinated access to operations centers, participated in emergency exercises, and provided assistance in enhancing security." In studying the security measures taken by U.S. and some foreign transit agencies, GAO found that the domestic and foreign agencies were doing many of the same things. But GAO identified three practices used by a limited number of nations that are not currently in general use in the United States. These are (1) covert testing of employee response to incidents by placing suspicious items throughout the system or setting off alarms, (2) random screening of passengers and baggage, and (3) a national government clearinghouse of security technologies and best practices. GAO noted that attempts to implement these three practices in the U.S. could face political, legal, fiscal, and cultural challenges. GAO also identified government centralization of the process for researching and developing passenger rail security technologies as a potentially useful practice. GAO found that no U.S. federal agency has collected or distributed information on research and development of passenger rail security technologies, or other best practices for passenger rail security. TSA is using a risk-based methodology to guide its security efforts. GAO and the 9/11 Commission recommended the use of a risk-based methodology to guide security actions, and the Homeland Security Act of 2002 ( P.L. 107-296 ) directed that this approach be used for protecting key resources and critical infrastructure assets.