The Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act) directed DHS to create a plan for sharing transportation security–related information among public and private entities that have a stake in protecting the nation’s transportation system, including passenger and freight rail. This plan—first issued in July 2008— is now called the Transportation Security Information Sharing Environment (TSISE). The TSISE describes, among other things, the information–sharing process. TSA disseminates security information through several information products, including reports, assessments, and briefings, among others. These products are distributed through mechanisms including the Homeland Security Information Network and mechanisms sponsored by industry, such as the Association of American Railroads’ Railway Alert Network, among others. TSA is also specifically responsible for receiving, assessing, and distributing intelligence information related to potential threats and significant security concerns (rail security incidents) related to the nation’s rail system. Specifically, in 2008, TSA issued a regulation requiring U.S. rail systems to report all rail security incidents to TSA’s Transportation Security Operations Center (TSOC), among other things. The TSOC is an operations center open 24 hours a day, 7 days a week, that serves as TSA’s main point of contact for monitoring security–related incidents or crises in all modes of transportation. The regulation also authorizes TSA officials to view, inspect, and copy rail agencies’ records as necessary to enforce the rail security incident reporting requirements. This regulation is supported by TSA policies and guidance, including the Transportation Security Inspector Inspections Handbook, the National Investigations and Enforcement Manual, and the Compliance Work Plan for Transportation Security Inspectors. TSA’s regulation is intended to provide the agency with essential information on rail security incidents so that TSA can conduct comprehensive intelligence analysis, threat assessment, and allocation of security resources, among other things. According to the regulation, potential threats and significant security concerns that must be reported to the TSOC include bomb threats, suspicious items, or indications of tampering with rail cars, among others. Within TSA, different offices are responsible for sharing transportation security–related information and for implementing and enforcing the rail security incident reporting requirement. For instance, TSA’s Office of Security Policy and Industry Engagement (OSPIE) is the primary point of contact for sharing information with private sector stakeholders, and is responsible for using incident reports and analyses, among other things, to develop strategies, policies, and programs for rail security, including operational security activities, training exercises, public awareness, and technology. TSA’s Office of Intelligence and Analysis (OIA) receives intelligence information regarding threats to transportation and designs intelligence products intended for officials in TSA, other parts of the federal government, state and local officials, and industry officials, including rail agency security coordinators and law enforcement officials. The TSOC, managed by TSA’s Office of Law Enforcement/Federal Air Marshal Service, is the TSA entity primarily responsible for collecting and disseminating information about rail security incidents. Once notified of a rail security incident, TSOC officials are responsible for inputting the incident information into their incident management database known as WebEOC, and for disseminating incident reports that they deem high priority or significant to selected TSA officials; other federal, state, and local government officials; and selected rail agencies’ law enforcement officials. Figure 1 shows the intended steps and responsibilities of TSA components involved in the rail security incident reporting process. TSA’s Office of Security Operations (OSO) is responsible for overseeing and enforcing the incident reporting requirement. Responsible for managing TSA’s inspection program for the aviation and surface modes of transportation, the Office of Security Operations’ Surface Compliance Branch deploys approximately 270 transportation security inspectors– surface (TSI-S) nationwide. The TSI-Ss are responsible for, among other things, providing clarification to rail agencies regarding the incident reporting process and for overseeing rail agencies’ compliance with the reporting requirement by conducting inspections to ensure that incidents were properly reported to the TSOC. Six regional security inspectors– surface (RSI-S) within the Compliance Programs Division are responsible for providing national oversight of local surface inspection, assessment, and operational activities. In June 2014, we found that TSA had some mechanisms in place to collect stakeholder feedback on the products it disseminates containing security-related information and had initiated efforts to improve how it obtains customer feedback, but had not developed a systematic process for collecting and integrating such feedback. Specifically, in February 2014, TSA reconvened its Information Sharing Integrated Project Team (IPT), whose charter included, among other things, milestones and time frames for developing a centralized management framework to capture stakeholder satisfaction survey data on all of TSA’s security-related products and the systems used to distribute these products. However, at the time of our June 2014 report, the IPT Charter did not specify how TSA planned to systematically collect, document, and incorporate informal feedback—a key mechanism used by the majority of the stakeholders we surveyed, and a mechanism TSA officials told us they utilize to improve information sharing. For instance, the rail industry provided TSA with a list of areas for emphasis in intelligence analysis in December 2012, and TSA subsequently initiated a product line focusing on indications and warnings associated with disrupted or successful terrorist attacks. TSA officials stated that they further refined one of the products as a result of a stakeholder requesting information on tactics used in foreign rail attacks. In 2013, one TSA component built a system to track informal information sharing with stakeholders at meetings and conferences, and through e-mail, but TSA officials stated that the data were not used for operational purposes, and TSA had no plans to incorporate this system into its centralized management framework because the IPT had decided to focus its initial efforts on developing a survey mechanism. According to our June 2014 survey results, surface transportation stakeholders were generally satisfied with TSA’s security-related products and the mechanisms used to disseminate them. In particular, 63 percent of rail stakeholders (70 of 111) reported that they were satisfied with the products they received in 2013, and 54 percent (59 of 110) reported that they were satisfied with security-related information sharing mechanisms. However, because TSA lacked specific plans and documentation related to improving its efforts to incorporate all of its stakeholder feedback, it was unclear how, or if, TSA planned to use stakeholder feedback to improve information sharing. As a result of these findings, we recommended that TSA include in its planned customer feedback framework a systematic process to document informal feedback, and how it incorporates all of the feedback TSA receives, both formal and informal. TSA concurred, and in response, by April 2015, had taken actions to develop these processes. Specifically, TSA developed a standard operating procedure to organize how its offices solicit, receive, respond to, and document both formal and informal customer feedback on its information-sharing efforts, which delineates a systematic process for doing so. TSA also developed a TSA-wide standard survey for its offices to use to obtain formal and informal feedback on specific products, and created an information-sharing e-mail inbox to which all survey responses will be sent, evaluated, and distributed to the appropriate office for action. We have not evaluated these actions, but if implemented effectively, we believe that TSA will now be better positioned to meet stakeholder needs for security-related information. In December 2012, we found TSA had made limited use of the rail security incident information it had collected from rail agencies, in part because it did not have a systematic process for conducting trend analysis. TSA’s stated purpose for collecting rail security incident information was to allow TSA to “connect the dots” by conducting trend analysis that could help TSA and rail agencies develop targeted security measures. However, the incident information provided to rail agencies by TSA was generally limited to descriptions of specific incidents with minimal accompanying analysis. As a result, officials from passenger rail agencies we spoke with generally found little value in TSA’s incident reporting process, because it was unclear to them how, if at all, the information was being used by TSA to identify trends or threats that could help TSA and rail agencies develop appropriate security measures. However, as we reported in December 2012, opportunities for more sophisticated trend analysis existed. For example, the freight industry, through the Railway Alert Network—which is managed by the Association of American Railroads, a rail industry group—identified a trend where individuals were reportedly impersonating federal officials. In coordination with TSA, the Railway Alert Network subsequently issued guidance to its member organizations designed to increase awareness of this trend among freight rail employees and provide descriptive information on steps to take in response. The Railway Alert Network identified this trend through analysis of incident reporting from multiple freight railroads. In each case, the incident had been reported by a railroad employee and was contained in TSA’s incident management system, WebEOC. On the basis of these findings, in December 2012, we recommended that TSA establish a systematic process for regularly conducting trend analysis of the rail security incident data, in an effort to identify potential security trends that could help the agency anticipate or prevent an attack against passenger rail and develop recommended security measures. TSA concurred with this recommendation and by August 2013 had developed a new capability for identifying trends in the rail security incident data, known as the Surface Compliance Trend Analysis Network (SCAN). SCAN is designed to identify linkages between incidents captured in various sources of data, assemble detailed information about these incidents, and accurately analyze the data to enhance the agency’s ability to detect impending threats. According to TSA officials, SCAN consists of three elements: two OSO surface detailees located at TSOC, enhanced IT capabilities, and a new rail security incident analysis product for stakeholders.