Certain characteristics of commercial trucks and buses make them inherently vulnerable to terrorist attacks and therefore difficult to secure. The commercial trucking and bus industries are open by design, with multiple access points and terminals so that vehicles can move large numbers of people and volumes of goods quickly. The openness of this sector and the large numbers of riders and quantities of goods on vehicles with access to metropolitan areas or tourist destinations also make them both difficult to secure and attractive targets for terrorists because of the potential for mass casualties and economic damage and disruption. In addition, the multitude of private commercial truck and bus companies and their diversity in size and cargo complicate efforts to develop security measures and mitigation strategies that are appropriate for the entire industry. Between 1997 and 2008 there were 510 terrorist-related commercial truck and bus bombing attacks worldwide, killing over 6,000 people, with 106 bombings occurring during 2007 alone, killing over 2,500 people. Of the 510 bombings since 1997, 364 have been bus bombings and 146 have been truck bombings; 156 have been in Iraq and 354 have been in countries other than Iraq. In 2007, the use of truck bombs as a terrorist tactic more than tripled and resulted in 2072 deaths. While trucks were involved in just 29 percent of the bombings since 1997, they accounted for 56 percent of the deaths. Vehicle Borne Improvised Explosive Devices (VBIEDs) are vehicles loaded with a range of explosive materials that are detonated when they reach their target. VBIEDs can also be used to explode flammable fuel trucks, and disperse toxic substances. Terrorists have used a variety of trucks—rental, refrigerator, cement, dump, sewerage, gasoline tanker, trucks with chlorine and propane tanks, and fire engines—to attack a broad range of critical infrastructure, including police and military facilities, playgrounds, childcare centers, hotels, and bridges. Worldwide, commercial buses have also been attacked numerous times, including in Israel, England, Iraq, the Philippines, Lebanon, Sri Lanka, India, Russia, and Pakistan. In the United States, terrorists used a commercial truck containing fertilizer-based explosives to attack the World Trade Center in 1993, killing 6 and injuring 1,000 people. Two years later, a similar attack occurred at the Alfred P. Murrah Federal Building in Oklahoma City, Oklahoma, killing 168 people and injuring more than 800. Terrorists have also targeted overseas U.S. military personnel with commercial VBIEDs at the Marine barracks in Lebanon (1983), Khobar Towers in Saudi Arabia (1996), and at U.S. embassies in Kuwait (1983), Lebanon (1984), Kenya (1998), and Tanzania (1998). Figure 2 charts the number of worldwide bombings involving commercial truck or buses since the 1997. See appendix II for more information on truck and bus bombing incidents. DHS and DOT share responsibility for securing the commercial vehicle sector. Prior to the terrorist attacks of September 11, 2001, DOT was the primary federal entity involved in regulating commercial vehicles. In response to September 11, 2001, Congress passed the Aviation and Transportation Security Act (ATSA) of 2001, which created and conferred upon TSA broad responsibility for securing all transportation sectors. In 2002, Congress passed the Homeland Security Act, which established DHS, transferred TSA into DHS, and gave DHS responsibility for protecting the nation from terrorism, including securing the nation’s transportation systems. Although TSA is the lead agency responsible for the security of commercial vehicles, including those carrying hazardous materials, DOT maintains a regulatory role with respect to hazardous materials. Specifically, DOT continues to issue and enforce regulations governing the safe transportation of hazardous materials. In addition, the Homeland Security Act expanded DOT’s responsibility to include ensuring the security, as well as the safety, of the transportation of hazardous materials. Accordingly, within DOT, PHMSA is responsible for developing, implementing, and revising security plan requirements for carriers of hazardous materials, while FMCSA inspectors enforce these regulations through reviews of the content and implementation of these security plans. In 2004, based on a recommendation we made, DHS and DOT entered into a memorandum of understanding (MOU) to delineate the agencies’ roles and responsibilities with respect to transportation security. In 2006, TSA and PHMSA completed an annex to the MOU related to the transportation of hazardous materials. This annex identifies TSA as the lead federal entity for the security of the transportation of hazardous materials, and PHMSA as responsible for promulgating and enforcing regulations and administering a national program of safety and security related to the transportation of hazardous materials. In addition, the 9/11 Commission Act requires that, by August 2008, DHS and DOT complete an annex to the MOU that would govern the roles of the two agencies regarding the security of commercial motor vehicles. State and local governments also play a key role in securing commercial vehicles. States own, operate, and have law enforcement jurisdiction over significant portions of the infrastructure—including highways, tunnels, and bridges—that commercial vehicles use. Further, state and local governments respond to emergencies involving commercial vehicles which travel within and through their jurisdictions daily. Many states also have departments of homeland security with firsthand knowledge of hazardous materials shippers and routing, local smuggling operations, and individuals and groups to be monitored for security reasons. Some states also have fusion centers that collect relevant law enforcement and intelligence information to coordinate the dissemination of alerts and assist in emergency response. State transportation and law enforcement officials also conduct vehicle safety inspections and compliance reviews, sometimes in coordination with FMCSA. Although all levels of government are involved in the security of commercial vehicles, primary responsibility for securing commercial vehicles rests with the individual commercial vehicle companies themselves. Truck and bus companies have responsibility for the security of day-to-day operations. As part of these operations, they ensure that company personnel, vehicles, and terminals---as well as all of the material and passengers they transport----are secured. Faced with tight competition, low margins, and, in some sectors, high driver turnover, some industry officials that we interviewed stated that devoting resources to security has remained a challenge. A variety of national organizations represent commercial trucking and motor coach industry interests. Many of these organizations disseminate pertinent security bulletin information from DHS and DOT to their members. Some have also developed and provided their members with security information and tools—such as security check lists and handbooks—to meet members’ security needs. See appendix III for a list of the major industry associations representing the truck and motor coach industries interviewed by GAO. Although ATSA, passed in November 2001, includes numerous requirements for TSA regarding securing commercial aviation, it does not include any specific requirements related to the security of land transportation sectors. However, with regard to all sectors of transportation, ATSA generally requires TSA to: receive, assess, and distribute intelligence information related to transportation security; assess threats to transportation security and develop policies, strategies, and plans for dealing with those threats, including coordinating countermeasures with other federal organizations; and, enforce security-related regulations and requirements. Other legislation, specifically the USA PATRIOT Act and the 9/11 Commission Act, requires TSA to take specific actions to ensure the security of commercial vehicles. The USA PATRIOT Act provides that a state may not issue to any individual a license to transport hazardous materials unless that individual is determined not to pose a security risk. TSA regulations require that drivers who transport hazardous materials undergo a security threat assessment that consists of an evaluation of a driver’s criminal history, immigration status, mental capacity, and connections to terrorism to determine if the driver poses a security risk. The 9/11 Commission Act also requires that the Secretary of Homeland Security, by August 2008, submit a report to Congress that includes, among other things, a security risk assessment on the trucking industry, an assessment of industry best practices to enhance security, and an assessment of actions already taken by both public and private entities to address identified security risks. The act also mandates that the Secretary develop a tracking program for motor carrier shipments of hazardous materials by February 2008. With regard to intercity buses, the act requires that the Secretary issue regulations by February 2009 requiring high-risk, over-the-road bus operators to conduct vulnerability assessments and develop and implement security plans. The act further mandates that the Secretary of Homeland Security issue regulations by February 2008 requiring all over-the-road bus operators to develop and implement security training programs for frontline employees, and that the Secretary establish a security exercise program for over-the-road bus transportation. The act also requires DOT to take specific actions related to the security of commercial vehicles. For example, the Act requires that the Secretary of Transportation, by August 2008, analyze the highway routing of hazardous materials, and develop guidance to identify and reduce safety and security risks. DOT’s PHMSA has issued regulations intended to strengthen the security of the transportation of hazardous materials. The regulations require persons who transport or offer for transportation certain hazardous materials to develop and implement security plans. Security plans must assess the security risks associated with transporting these hazardous materials and include measures to address those risks. At a minimum, the plan must include measures to (1) confirm information provided by job applicants hired for positions that involve access to and handling of hazardous materials covered by the security plan, (2) respond to the assessed risk that unauthorized persons may gain access to hazardous materials, and (3) address the assessed risk associated with the shipment of hazardous materials from origin to destination. The regulations also require that all employees who directly affect hazardous materials transportation safety receive training that provides awareness of security risks associated with hazardous materials transportation and of methods designed to enhance transportation security. Such training is also to instruct employees on how to recognize and respond to possible security threats. Additionally, each employee of a firm required to have a security plan must be trained concerning the plan and its implementation.