TSA is the primary federal agency responsible for overseeing the security of the mass transit, passenger rail, and freight rail systems. However, several other agencies, including DOT’s Federal Transit Administration (FTA) and Federal Railroad Administration (FRA), also play a role in helping to oversee these systems. Since it is not practical or feasible to protect all assets and systems against every possible terrorist threat, DHS has called for using risk-informed approaches to prioritize its security- related investments and for developing plans and allocating resources in a way that balances security and commerce. In June 2006, DHS issued the National Infrastructure Protection Plan (NIPP), which established a six-step risk management framework to establish national priorities, goals, and requirements for Critical Infrastructure and Key Resources protection so that federal funding and resources are applied in the most cost-effective manner to deter threats, reduce vulnerabilities, and minimize the consequences of attacks and other incidents. The NIPP, updated in 2009, defines risk as a function of three elements: threat—an indication of the likelihood that a specific type of attack will be initiated against a specific target or class of targets; vulnerability—the probability that a particular attempted attack will succeed against a particular target or class of targets; and consequence—the effect of a successful attack. In August 2007, the Implementing Recommendations of the 9/11 Commission Act (9/11 Commission Act) was signed into law, which included provisions that task DHS with actions related to surface transportation security. Among other things, these provisions include mandates for developing and issuing regulations for transportation security training programs and ensuring that transportation modal security plans include threats, vulnerabilities, and consequences for transportation infrastructure assets including rail. In response to our previous recommendations, TSA has taken steps to conduct comprehensive risk assessments across the transportation sector and within the passenger and freight rail modes that are based on assessments of threat, vulnerability, and consequence. In March 2009, we reported that TSA had taken some actions to implement a risk management approach but had not conducted comprehensive risk assessments that integrate threat, vulnerability, and consequence for each mode or the transportation sector as a whole, as called for by the NIPP. We recommended that TSA conduct risk assessments that combine these three elements to help the agency produce a comparative analysis of risk across the entire transportation sector, which the agency could use to inform current and future investment decisions. DHS concurred with this recommendation, and in June 2010 TSA produced the Transportation Sector Security Risk Assessment (TSSRA), which assessed risk within and across the various aviation and surface transportation modes, including rail, and incorporated threat, vulnerability, and consequence. A September 2009 letter from the Director of DHS’s Office of Risk Management and Analysis noted that in developing the TSSRA, TSA was making progress toward developing a strategic and comprehensive risk management approach that would bett align with DHS’s risk management framework and address our er recommendations. However, TSA noted limitations in the June 2010 TSSRA report that could limit its usefulness in guiding investment decisions across the transportation sector as a whole. For example, the TSSRA excluded the maritime sector and certain types of threats, such as from “lone wolf” operators. In June 2011, agency officials stated that TSA is working to address these limitations in the next version, which is scheduled for completion by the end of calendar year 2011. TSA also said that it is strengthening and enhancing the TSSRA methodology based on an ongoing independent verification and validation that is scheduled for completion later this year. In addition, TSA officials noted that other DHS components, such as the U.S. Coast Guard, conduct risk assessments of the maritime sector that complement the TSSRA. With regard to assessments of mass transit and passenger rail transportation, we reported in June 2009 that although TSA had contributed to DHS’s risk assessment effort, it had not conducted its own risk assessment of mass transit and passenger rail systems. We recommended that TSA conduct a risk assessment that integrates all three elements of risk. DHS officials concurred with the recommendation, and in March 2010 said that they had developed a mass transit risk assessment tool to assess risk to mass transit and passenger rail systems using threat, vulnerability, and consequence, in addition to the TSSRA. According to TSA, they have completed pilot tests of this tool on three transit systems as of June 2011 and anticipate assessing six additional transit systems by the end of the calendar year. Similarly, in April 2009, we reported that TSA’s efforts to address freight rail security were limited and did not focus on a range of threats identified by federal and industry assessments. TSA’s security efforts focused almost entirely on transportation of Toxic Inhalation Hazards (TIH); however, other federal and industry assessments had identified additional potential security threats, such as risks to bridges and tunnels. We reported that although TSA’s focus on TIH had been a reasonable initial approach, there are other security threats for TSA to consider and evaluate, including potential sabotage to critical infrastructure. We recommended that TSA expand its efforts to include all security threats in its freight rail security strategy. TSA concurred and reported that it had developed a Critical Infrastructure Risk Tool to measure the criticality and vulnerability of freight railroad bridges. As of June 2011, the agency has used this tool to assess 77 bridges, some of which transverse either the Mississippi or Missouri Rivers, and 26 freight rail tunnels. Our prior work has also assessed TSA’s efforts to incorporate risk management principles into the grant allocation process, and we reported that transit grant funding decisions could be improved with better assessments of vulnerability. For example, we reported in June 2009 that the Transit Security Grant Program (TSGP) risk model included all three elements of risk, but could be strengthened by measuring variations in vulnerability. DHS held vulnerability constant in its assessments, which limits the model’s overall ability to assess risk. We recommended that DHS strengthen its methodology for determining risk by developing a cost- effective method for incorporating vulnerability information in its TSGP risk model. DHS concurred with the recommendation, and in April 2010 TSA stated that it is reevaluating the risk model for the fiscal year 2011 grant cycle. In June 2011, TSA stated that it is considering asset-specific vulnerability when looking at risk, although TSA noted that the Federal Emergency Management Agency (FEMA) has ownership of the TSGP risk model. TSA provides input into the model, however. We are currently assessing DHS and FEMA efforts to improve the TSGP grant-allocation process as part of our current review of DHS grant programs being conducted for your committee and expect to issue a report on the results of this effort later this year. Industry stakeholders have examined and implemented various technologies to enhance the security of the rail system. For example, in April 2009, we reported that several freight rail carriers we met with installed security cameras and monitoring equipment at some of their key facilities to better monitor the activities in and around these areas. We also reported that officials from three railroads and two chemical companies we met with stated that they had taken steps to attempt to better track the movements of their TIH rail shipments by installing Global Positioning System technology on their locomotives and tank cars. Similarly, in June 2009, we reported that many mass transit and passenger rail agencies reported making capital improvements to secure their systems. For example, 19 of the 30 transit agencies we interviewed had embarked on programs since 2004 to upgrade their existing security technology, including upgrading closed circuit television at key station locations with video surveillance systems that alert personnel to suspicious activities and abandoned packages and installing chemical, biological, radiological, nuclear, and explosives detection equipment and laser intrusion detection systems in critical areas. While industry has taken these steps to implement technology to enhance rail security, the nature of the rail system has presented challenges to further implementation. For example, we reported in July 2010 that in commuter or light rail systems, many stations may be unmanned outdoor platforms without barriers between public areas and trains. Stations may also have few natural locations to place technologies to be able to screen passengers. With limited existing chokepoints, implementation of certain technologies may require station infrastructure modifications to aid in funneling passengers for screening. Similarly, challenges to using technology to secure the freight rail system include the size and open nature of the system, the need for railcars to be able to continuously move, and limited resources. We have also reported that several technologies are available to help address rail security challenges, but they are at varying levels of maturity and using them involves trade-offs in mobility, cost, and privacy. For example, in July 2010, we reported that the ability of explosives detection technologies to help protect the passenger rail environment depends both upon their detection performance and how effectively the technologies can be deployed in that environment. Detection performance of these technologies varies across the different technologies and additional limitations—such as limited screening throughput, privacy, openness, physical infrastructure, cost, and mobility concerns—have restricted their more widespread or more effective use in passenger rail. More-established explosives detection technologies—such as handheld explosive trace detection systems, x-raying imaging systems, and canines—have demonstrated good performance against many conventional explosives threats but are challenged by threats from certain explosives. Newer technologies—such as Explosive Trace Portals (ETP), standoff detection systems, and Advanced Imaging Technologies (AIT)—while available, are in various stages of maturity and more operational experience would be required to determine whether they can be effectively implemented in a rail environment. For example, AIT technologies have the ability to detect hidden objects; however, they are walk-through devices that would require rail passengers to be funneled through the equipment, limiting passenger throughput with long screening times. Standoff technology can be used to detect hidden objects on an individual from a significant distance and is attractive because it may have less effect on passenger throughput than other new technologies. However, certain types of standoff systems, as well as AIT technologies raise privacy concerns because they create images of individuals underneath their clothing.