Passenger Rail Security: TSA Engages with Stakeholders but Could Better Identify and Share Standards and Key Practices

Recent physical and cyberattacks on rail systems in U.S. and foreign cities highlight the importance of strengthening and securing passenger rail systems around the world. TSA is the primary federal agency responsible for securing transportation in the United States.

GAO was asked to review TSA's efforts to assess passenger rail risk, as well as its role in identifying and sharing security standards and key practices. This report addresses (1) TSA's efforts to assess risk; (2) the extent to which TSA works with U.S. and foreign passenger rail stakeholders to identify security standards and key practices; and (3) the extent to which TSA shares passenger rail security standards and key practices with stakeholders.

GAO analyzed TSA risk assessments from fiscal years 2015 through 2019 and reviewed TSA program documents and guidance. GAO interviewed officials from TSA, and from seven domestic rail agencies, three foreign rail agencies, and two foreign government agencies. The results from these interviews are not generalizable but provide perspectives on topics in this review.

The Transportation Security Administration (TSA) assesses passenger rail risks through the Transportation Sector Security Risk Assessment, the Baseline Assessment for Security Enhancement (BASE), and threat assessments. TSA uses the risk assessment to evaluate threat, vulnerability, and consequence for attack scenarios across various transportation modes. TSA surface inspectors use the baseline assessment, a voluntary security review for mass transit, passenger rail, and highway systems, to address potential vulnerabilities and share best practices, among other things.

TSA works with U.S. stakeholders to identify security standards and key practices and identifies foreign standards and practices through multilateral and bilateral exchanges. However, TSA Representatives (TSARs), the primary overseas point of contact for transportation security matters, lack specific guidance on foreign rail stakeholder engagement. As a result, TSA is less likely to be fully aware of key practices in other countries, such as station security guidance. Specific guidance would provide TSARs with clear expectations and encourage more consistent engagement with foreign rail stakeholders.

Emphasize security awareness Detection of vapor from explosives

TSA shares standards and key practices with stakeholders, including those related to cybersecurity, through various mechanisms including BASE reviews; however, this assessment does not fully reflect current industry cybersecurity standards and key practices. For example, it does not include any questions related to two of the five functions outlined in the National Institute of Standards and Technology's Cybersecurity Framework—specifically the Detect and Recover functions. Updating the BASE questions to align more closely with this framework would better assist passenger rail operators in identifying current key practices for detecting intrusion and recovering from incidents.

GAO is making two recommendations: (1) that TSA update TSAR guidance to include engaging with foreign passenger rail stakeholders; and (2) that TSA update the BASE cybersecurity questions to ensure they reflect key practices. DHS concurred with both recommendations.

Passenger rail systems are inherently difficult to secure and vulnerable to  attack due to factors such as their open infrastructure, multiple access  points, and high ridership. Recent attacks in London, Brussels, and New  York City, as well as planned attacks in New York and other U.S. cities,  highlight the importance of strengthening and securing passenger rail  systems around the world. In addition, cyberattacks, such as those that  affected San Francisco’s mass transit system in 2016 and Deutsche Bahn  in Germany in 2017, as well as derailment attempts in Germany in 2018,  demonstrate the evolving nature of the threat to passenger rail. In 2017,  there were more than 4.8 billion passenger trips on rail systems in the  United States. Rail operators and federal agencies are faced daily with  the challenge of protecting passengers without compromising the  accessibility and efficiency of rail travel. The Department of Homeland  Security’s (DHS) Transportation Security Administration (TSA) is the  primary federal agency responsible for securing all modes of  transportation in the United States, including passenger rail.

We previously reported on domestic and foreign passenger rail security  practices and lessons learned in 2005 and 2012. In 2005, we reported  on, among other things, security practices that federal agencies and  domestic and foreign rail operators had implemented, including foreign  rail security practices that were not in use domestically at the time. In  2012, we reported on the influence of foreign attacks on domestic rail  security procedures, among other things. Further, though not specific to  passenger rail cybersecurity, federal cyber asset security has been on our  High Risk list since 1997. In 2003, we expanded this area to include  protecting systems supporting our nation’s critical infrastructure, such as  passenger rail systems. We issued an update to the information security  high-risk area in September 2018 that identified actions needed to  address cybersecurity challenges facing the nation.

The FAA Reauthorization Act of 2018 includes a provision for us to review  TSA’s efforts to identify and share domestic and foreign passenger  transportation security standards and key practices, particularly as they  relate to shared terminal facilities, which we refer to as intermodal  stations throughout this report, and cybersecurity. In addition, we were  asked to review how TSA assesses passenger rail security risks. This  report addresses the following objectives:  1.  How does TSA assess risks to the U.S. passenger rail system?  2.  To what extent does TSA work with U.S. and foreign passenger rail  stakeholders to identify security standards and key practices,  including intermodal station and cybersecurity practices?  3.  To what extent does TSA share passenger rail security standards and  key practices with stakeholders?

To address the first objective, we reviewed agency assessments and  documentation pertaining to the elements of risk (threat, vulnerability, and  consequence), as defined in the National Infrastructure Protection Plan  (NIPP). Specifically, we reviewed TSA’s Transportation Sector Security  Risk Assessment (TSSRA) from fiscal years 2015 through 2017,  documents related to TSA’s Baseline Assessment for Security  Enhancement (BASE), and TSA’s annual and semiannual threat  assessments from calendar years 2015 through 2019. In addition to  reviewing general risks to the passenger rail system identified in these  documents, we analyzed the extent to which they address intermodal  station and cybersecurity risk. We conducted interviews with TSA officials  responsible for TSA’s passenger rail risk assessment efforts. We also  conducted interviews with officials from DHS’s Cybersecurity and  Infrastructure Security Agency (CISA) to understand additional efforts to  assess the cybersecurity risk in passenger rail, and how the agency  coordinates with TSA.

To address objectives two and three, we obtained information in person  or via telephone from officials at seven domestic rail agencies, including  Amtrak. We also conducted site visits to two foreign countries and  interviewed government officials and officials from three passenger rail  agencies in these countries. We conducted these interviews and visits  to obtain perspectives on both domestic and foreign passenger rail  security standards and key practices, as well as TSA engagement in this  area. To select domestic rail agencies, we first identified agencies with  the largest passenger volume by type of agency (heavy, light, or  commuter rail). We then selected specific agencies to interview based on  the following factors: type of system, geographic diversity, the presence  of a large intermodal station, expert referral, and experience with security  threats or incidents. We selected the foreign countries we visited based  on the size of passenger rail operations, presence of a large intermodal  station, expert referral, and experience with security threats or incidents.  While the perspectives of rail agencies and officials we interviewed are  not generalizable to all rail agencies and countries, they provided a range  of perspectives on the topics within the scope of our review.

To further address our second objective, we reviewed documentation  from domestic and international rail security working groups and  meetings, such as those hosted by the American Public Transportation  Association (APTA), and the International Working Group on Land  Transport Security, among others. We further reviewed all available  security-related standards and recommended practice documents APTA  produced from calendar years 2009 through 2019 to determine whether  TSA participated in developing or reviewing the documents. In addition,  we interviewed TSA officials as well as representatives from APTA, the  Association of American Railroads, and the Mineta Transportation  Institute to identify current threats, existing key practices in passenger rail  security, and TSA’s role in identifying these practices. To further  understand TSA’s efforts to engage with foreign passenger rail  stakeholders, we interviewed TSA Representatives (TSARs) located in  two countries we visited. We evaluated TSA’s efforts against the NIPP,  which outlines government and private sector partnerships needed to  achieve security goals, TSA’s 2018 Administrator’s Intent, and TSA  program documentation.

To further address our third objective, we reviewed documentation from  rail security working groups and meetings, such as those identified above.  We also reviewed relevant documentation related to TSA programs such  as the BASE, the Intermodal Security Training and Exercise Program,  and the Visible Intermodal Prevention and Response program, to identify  whether TSA shares key practices, including those learned from foreign  stakeholders, through these programs. We interviewed TSA officials to  discuss their efforts to share key practices with stakeholders. We also  analyzed questions in the BASE assessment to identify the extent to  which they incorporate cybersecurity key practices as identified in the  National Institute of Standards and Technology’s (NIST) Framework for  Improving Critical Infrastructure Cybersecurity. We further assessed  these efforts against TSA’s Transportation Systems Sector-Specific Plan,  which calls for the adoption of the NIST Framework across all  transportation modes.

We conducted this performance audit from July 2019 to April 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Background TSA and Industry Roles in Securing Passenger Rail

The Aviation and Transportation Security Act designated TSA as the  primary federal agency responsible for security in all modes of  transportation, which includes physical security and cybersecurity.  Passenger rail operators, however, have the day to day responsibility for  carrying out safety and security measures for their systems. Unlike the  aviation environment, where TSA has operational responsibility for  screening passengers and baggage for prohibited items prior to boarding  a commercial aircraft, the agency has a limited operational role for  securing mass transit (including rail). To secure passenger rail, TSA  primarily partners with public and private transportation operators to  address their security needs by conducting vulnerability assessments and  sharing intelligence information and key practices, among other  measures. The agency also engages with the passenger rail industry  through associations, such as APTA and Association of American  Railroads. Additionally, TSA is responsible for assessing the risk from  terrorism and cyber threats to passenger rail, as well as other  transportation modes.

In addition to engaging with domestic passenger rail stakeholders, TSA’s  Office of Policy, Plans, and Engagement is responsible for coordinating  domestic and international multimodal transportation security polices,  programs, directives, strategies, and initiatives, including conducting  outreach to foreign stakeholders. TSA also engages with foreign  stakeholders through TSARs. TSARs are primarily located in posts  overseas and communicate with foreign government officials to address  transportation security matters involving all modes of transportation,  including aviation, rail, mass transit, highways, and pipelines. The TSAR  role was originally created in response to the 1988 bombing of Pan Am  Flight 103 over Lockerbie, Scotland, when the Aviation Security  Improvement Act of 1990 was enacted, which provided that foreign  security liaison officers were to serve as liaisons to foreign governments  in carrying out U.S. government security requirements at specific  airports. TSARs are responsible for ensuring the implementation of  TSA’s requirements primarily as they relate to passenger and cargo air  transportation departing the specific country en route to the United States.  The primary focus of the role remains on aviation; however it has evolved  over time to include maritime and land transportation.

Physical and Cybersecurity Threats to Passenger Rail

According to TSA, recent attacks overseas and online terrorist messaging  point to public transportation systems, which include passenger rail  systems, as continued high-value targets for terrorists. In general,  passenger rail systems are open and designed to expedite the free  flowing movement of large numbers of passengers through multiple  stations. As such, these systems are inherently vulnerable to physical  attacks (such as improvised explosive devices, active shooters, and  chemical or biological attacks) due in part to factors such as high  ridership, open access points, limited exit lanes, and fixed, publically  available schedules. In addition, TSA has reported that risks increase in  urban areas where multiple transportation systems and high volumes of  travelers merge at intermodal stations.

Transportation systems, including passenger rail systems, rely on  technology and internet-connected devices to manage and secure certain  business/enterprise functions, such as the operation’s website,  communications, and reservations and ticketing mechanisms. They also  increasingly rely on computer-networked systems for tracking, signals,  and operational controls of transportation equipment and services. As  dependence on these systems increases, so does risk to the system.  Cyberattacks have the potential to significantly affect both  business/enterprise systems and operational control systems.

Business/Enterprise systems. Cybersecurity threats include  ransomware, malware, phishing, and website attacks that may  compromise sensitive information and affect an operator’s ability to  communicate with passengers or engage in day-to-day business  functions.

Operational control systems. Cybersecurity threats, which may  include malware or physical manipulation of a system, such as  jamming signals or damaging equipment, include threats to the  systems that control signaling and train speed. For example,  attackers could attempt to access positive train control systems, a  computer-based system designed to automatically slow or stop a train  that is not being operated safely, to disrupt services.

Unintentional cybersecurity threat sources may include failures in  equipment or software due to aging or user errors, such as unintentionally  inserting a flash drive infected with malware or clicking on a phishing  email. Intentional cybersecurity threats may include corrupt employees,  criminal groups, terrorists, and nations and may be used, for example, to  achieve monetary gain, or for political or military purposes. Figure 1  shows examples of the types of physical and cyber threats passenger rail  systems face.

The NIPP outlines a risk management framework for critical infrastructure  protection. In accordance with the Homeland Security Act of 2002, as  amended, DHS created the NIPP in 2006 to guide the national effort to  manage security risk to the nation’s critical infrastructure, including  through coordination of agencies and 16 various critical infrastructure  sectors, including transportation systems. Most recently updated in  2013, the NIPP uses a risk management framework as a planning  methodology intended to inform how decision makers take actions to  manage risk. The framework calls for public and private partners to  conduct risk assessments. The NIPP defines risk as a function of three  elements: threat, vulnerability, and consequence, as shown in Figure 2.  Threat is an indication of the likelihood that a specific type of attack will be  initiated against a specific target or class of targets. Vulnerability is the  probability that a particular attempted attack will succeed against a  particular target or class of targets. Consequence is the effect of a  successful attack.

In 2010, DHS, through TSA and the U.S. Coast Guard, developed the  Transportation Systems Sector-Specific Plan to conform to requirements  in the NIPP. Most recently updated in 2015, this plan describes shared  goals, priorities, and activities to mitigate critical infrastructure risks, and  acknowledges the increasing dependence of transportation companies on  cyber systems for business, security, and operational functions.

Regarding cybersecurity risks, DHS produced the Cybersecurity Strategy  in 2018 to help execute its cybersecurity responsibilities during the next 5  years. In order to meet one of its objectives, DHS is to encourage the  adoption of applicable cybersecurity best practices, including the NIST  Framework for Improving Critical Infrastructure Cybersecurity (referred to  as the NIST Cybersecurity Framework). The framework is a set of  voluntary industry standards and best practices to help organizations  manage security risks specific to cybersecurity. The framework consists  of five functions: Identify, Protect, Detect, Respond, and Recover. When  considered together, these functions provide a high-level view of an  organization’s management of cybersecurity risk. NIST issued the  framework in 2014 and updated it in April 2018.

CISA, formerly DHS’s National Protection and Programs Directorate,  manages the national effort to secure and protect against critical  infrastructure risks, including cybersecurity risk, for all 16 critical  infrastructure sectors, including transportation. CISA’s responsibilities  include coordinating with sector-specific agencies to carry out its  cybersecurity and critical infrastructure activities.

TSA Conducts Passenger Rail Risk Assessments and Coordinates with CISA on Cybersecurity Risk

TSA Uses Three Mechanisms to Assess Passenger Rail Risk

According to TSA officials, TSA uses the TSSRA, the BASE, and threat  assessments to assess risk elements for physical and cyber security in  passenger rail. Such assessments may address different elements of  risk—threat, vulnerability, or consequence—or the total risk for specific  assets, such as airport perimeters and pipeline critical facilities. Table 1  below shows the type of risk element each assessment addresses, and  whether the assessment addresses risks to intermodal stations or  cybersecurity risk.

TSSRA. TSA uses the TSSRA, a periodic risk assessment, to assess  threat, vulnerability, and consequence for various attack scenarios across  the five transportation modes for which TSA is responsible. The  scenarios define a type of threat actor—including homegrown violent  extremists and transnational extremists, such as Al Qaeda and its  affiliates—a target, and an attack mode. For example, a scenario might  assess the risk of attacks using varying types of weapons on passenger  rail system assets. As part of the assessment process, TSA engages with  subject matter experts from TSA and industry stakeholder representatives  to compile vulnerabilities for each mode, and TSA analyzes both direct  and indirect consequences of the various attack scenarios. According to  TSA, the agency uses the TSSRA to provide strategic insights to inform  the administration’s risk mitigation strategies, policy considerations,  security countermeasures and programs, and resource allocation  decisions.

Our analysis of the TSSRAs issued during calendar years 2015 through  2017 indicates that TSA included intermodal station attack scenarios, but  did not include cybersecurity scenarios. Specifically, the assessments  featured various scenarios that targeted intermodal stations, which could  include rail systems. For example, a scenario might describe attacks  using various numbers of improvised explosive devices on an intermodal  station. TSA did not include cybersecurity attack scenarios in the calendar  year 2015, 2016, or 2017 assessments. According to the 2016  assessment and TSA officials we interviewed, threat experts have  indicated that cyber threats, due to their unique nature and other factors,  do not lend themselves to traditional TSSRA attack scenarios. However,  as discussed below, the agency does conduct cyber threat assessments.  Further, TSA’s Cybersecurity Roadmap 2018, states that, as one  objective, the agency will include cybersecurity in its risk assessments for  all modes. According to TSA officials, the implementation plan for the  Roadmap, which was approved in September 2019, provides guidance  and direction for meeting this objective. TSA officials confirmed that they  plan to include basic cybersecurity scenarios for all modes in the 2020  TSSRA, and that they plan to engage with TSA mass transit experts and  consult with industry experts as needed to inform future cyberattack  scenarios.

BASE. The BASE is a voluntary security assessment of national mass  transit, passenger rail, and highway systems conducted by TSA surface  transportation inspectors that addresses potential vulnerabilities, among  other things. It consists of an assessment template with 17 security  action items developed by TSA and the Federal Transit Administration  that address, among other best practices, security training programs, risk  information sharing, and cybersecurity. TSA developed this assessment  in 2006 to increase domain awareness, enhance prevention and  protection capabilities, and further response preparedness of passenger  transit systems nationwide. The agency uses the BASE assessments to  track progress in implementing specific security measures over time, offer  technical assistance and share best practices to help improve the overall  security posture of agencies, and inform transportation security grant  funding by, among other things, identifying actions agencies have taken  to reduce vulnerability.

TSA officials stated that the most recent formal update to the assessment  template began in 2014 and was fully implemented in 2015. The update  included, among other changes, revised guidance for TSA surface  inspectors and the addition of questions concerning active shooter  events. In fiscal year 2016, the agency also developed a more targeted  BASE assessment that focuses the assessment on an entity’s areas of  concern as identified by surface inspectors in a previous BASE review of  that operator. As of 2017, TSA had completed initial and follow-up  assessments for the top 100 mass transit agencies in the country, which  comprise approximately 80 percent of the ridership in the United States.  TSA officials told us that their goal is to conduct follow-up assessments  every one to three years.

As previously shown in table 1, our analysis of the BASE template for  mass transit and passenger rail indicates that it includes questions that  address selected rail agency concerns about intermodal station security,  and questions related to cybersecurity issues. Specifically, we found that  while the template does not contain security action items or questions that  directly refer to intermodal stations, questions in the template do  correspond to topics that domestic rail agencies we interviewed identified  as significant to intermodal station security, such as coordination among  security forces, visible security measures, and establishing roles and  responsibilities. For example, one BASE question asks if the agency’s  system security plan has procedures or protocols for responding to  security events with external agencies such as law enforcement or fire  departments. This question corresponds to the challenge of coordination  among security forces in intermodal stations identified by six of the seven  agencies we interviewed.

Cybersecurity is the focus of one of the security action items, which  includes a series of general questions related to whether the transit  agency has developed a comprehensive cybersecurity strategy.  According to TSA officials, the agency added cybersecurity questions to  the BASE in 2013 and the questions are intended to be a high level  review. For example, the BASE addresses whether the transit agency has  conducted a cybersecurity risk assessment, ensured employee training  covers cybersecurity roles and threats, and established a protocol for  reporting cyber incidents. It also provides a list of available cybersecurity  resources for agencies to consult.

Threat Assessments. TSA’s Intelligence and Analysis Office identifies  security threats to mass transit and passenger rail systems through  various threat assessments, including annual and semiannual Mass  Transit and Passenger Rail Terrorism Threat Assessments and annual  Cyber Modal Threat Assessments.

TSA’s Mass Transit and Passenger Rail Terrorism Threat  Assessment is produced annually and establishes the current mass  transit passenger rail threat level and reviews terrorist threats against  mass transit passenger rail for the past year. Threat information  includes terrorist attacks on passenger rail trains, train tracks, buses,  bus stops, and various stations. Additionally, the threat assessment  analyzes intelligence gaps for the mass transit mode. TSA  supplements the annual assessment with a semiannual threat  assessment that reviews terrorist threats against mass transit and  passenger rail for a 6-month period. Our analysis of threat  assessments TSA issued for calendar years 2015 through 2019  indicates that they addressed stations, in general, and intermodal  stations specifically, when they are the subject of an attack. For  example, an attack on Manchester, England’s Victoria station, an  intermodal station, was included in the 2018 Mass Transit and  Passenger Rail Terrorism Threat Assessment.

TSA’s Cyber Modal Threat Assessment reviews cyber threats to  transportation over the course of the previous year, establishes cyber  threat levels for the transportation modes for which TSA is  responsible, and evaluates the threat through the next year or two.  This annual assessment examines cyber threats to business and  industrial control systems from state and non-state actors, including  terrorist groups, pro-terrorist hacker groups, and hacktivists.  Moreover, it analyzes incidents of cyberattacks and cyber espionage  against U.S. and foreign transportation.

Both assessments analyze threat actors and their capabilities, intent, and  activities—including attacks occurring internationally—as well as tactics,  techniques, and procedures that could be employed in future attacks.  TSA calculates threat levels for transportation and cyber modes based on  assessments of threat actor intent and capability. It may also issue  additional situation-based products on emerging threats. TSA routinely  shares these threat assessments with rail agencies and other  stakeholders, such as industry security professionals.

TSA Coordinates with CISA to Facilitate Voluntary Cybersecurity Assessments and Industry Outreach

In addition to TSA’s risk assessment efforts, the agency coordinates with  CISA, which conducts voluntary cybersecurity assessments as needed  and requested by TSA and industry stakeholders. Specifically, CISA  offers eight different voluntary cyber assessment options for public and  private sector stakeholders, including mass transit and passenger rail  agencies. Because CISA provides services to all 16 critical  infrastructure sectors, including the transportation systems sector,  officials noted that it must balance the resources it devotes to each  sector. For example, CISA officials stated that they have conducted six  Validated Architecture Design Review assessments on rail agencies  since 2015, and currently have four pending requests from transportation  agencies. The Validated Architecture Design Review evaluates  systems, networks, and security services to determine if they are  designed, built, and operated in a reliable and resilient manner. CISA  officials also stated that they have conducted weekly vulnerability scans  for one rail agency since 2015.

While CISA coordinates with federal and private sector stakeholders to  identify and address significant risks to critical infrastructure through its  assessments, agency officials stated that they defer to TSA (as the co- sector specific agency for transportation) to take the lead in broader cyber  initiatives and outreach to the transportation sector. For example, TSA  officials stated that the agency included CISA in planning its cybersecurity  workshops, a series of half-day workshops for surface transportation  agencies to learn about cybersecurity resources from DHS and discuss  nontechnical cybersecurity actions to improve their cybersecurity posture.  According to TSA’s Cybersecurity Roadmap 2018, the agency plans to assess the resilience of the transportation modes to malicious cyber  activity in conjunction with CISA, among other things.

According to officials, TSA and CISA are collaborating or planning to  collaborate on several cybersecurity assessments for passenger rail  systems, including a cyber risk assessment for passenger rail cars and a  cyber assessment of the mass transit and passenger rail mode. CISA  officials told us that TSA, DHS’s Science and Technology Directorate,  and CISA’s National Risk Management Center are in early phases of  developing a cyber risk assessment for select passenger rail cars that  they plan to produce in fiscal year 2020. CISA officials stated that they  intend to address cyber vulnerability in the rail car assessments and plan  to reach out to operators to discuss results.

TSA officials told us that TSA and CISA also are considering a mass  transit and passenger rail cyber assessment similar to one being  developed for the pipeline mode. CISA officials stated that the planned  pipeline assessment effort will include a total of 10 Validated Architecture  Design Review assessments, in which TSA will help make arrangements  with industry and will observe the process. TSA officials explained that  expanding this effort to include passenger rail would depend on CISA’s  availability to conduct assessments and balance demands in other  sectors. CISA officials noted that they currently do not have the resources  to support a similar plan for rail.

TSA Actively Works with Domestic Stakeholders to Identify Standards and Key Practices but Provides Limited Guidance on Foreign Stakeholder Engagement TSA Works with Stakeholder Groups to Develop Domestic Standards and Recommended Practices

TSA participates in APTA working groups that review and develop  standards and recommended practices for passenger rail security,  including those that apply to intermodal station security and  cybersecurity. Specifically, from 2009 through 2019, APTA produced 45  documents related to security and emergency management standards  and recommended practices, among other things. TSA is listed as a  participant in 37 of the 45 documents. TSA officials noted that APTA  working groups regularly review documents and issues related to security  topics, including through monthly phone calls in some cases, and update  them as needed. According to APTA’s Manual for the Standards  Development Program, standards address safety-critical subjects and  establish requirements that must be met by industry; recommended  practices describe an established or generally recommended approach  that does not rise to the level of a standard; and white papers are  intended to provide information about complex issues that present the  industry’s prevailing philosophy on the subject matter. For example:

APTA offers a series of general standards, recommended practices,  and white papers targeted at physical infrastructure protection at  passenger facilities. These documents are not specifically directed at  intermodal stations, but, according to our analysis and APTA officials,  apply to such facilities as well as others. The documents address  factors such as exterior door and window security, as well as securing  mailrooms and utility openings, among other issues. Another APTA  standard addresses security and emergency management  considerations during planned special events, such as identifying  transit hubs that are likely to be inundated with passengers going to  and from the event.

APTA offers cybersecurity recommended practices that are targeted  at transit agencies in the early stages of starting a cybersecurity  program, including how to obtain executive-level awareness and  support and how to develop a cybersecurity awareness and training  program. APTA also offers recommended practices for securing  control and communications systems in transit environments, such as  train control systems and fare collection systems.

Table 2 provides additional examples of industry standards and key  practice documents, as they relate to threats identified by domestic  passenger rail stakeholders we interviewed.

In addition to working with industry through APTA to develop standards  and practices, TSA officials stated that the Surface Transportation  Security Advisory Committee, which was established in 2019 to provide  advice and recommendations to the TSA Administrator on transportation  security matters, may serve as a mechanism for discussing or  recommending key practices as the Committee develops. Officials  noted that the Committee, which includes industry and community  groups, could serve as a source for identifying forward looking best  practices for rail security. The Committee held initial meetings in July  2019, October 2019, and January 2020, and proposed establishing  subcommittees on topics such as cybersecurity and insider threats.

None of the seven domestic rail agencies we contacted identified any  security areas in which they felt recommended practices were missing.  Officials from five agencies specifically commented on the usefulness of  APTA publications. Officials from three agencies however, noted that  many transit and rail agencies are still in the early stages of starting a  cybersecurity program and that cybersecurity recommended practices are  generally targeted at those agencies, as compared to agencies that  already have a more sophisticated approach to cybersecurity. Officials  from one agency further noted that publications related to the more  technical aspects of cybersecurity (such as industrial control systems)  can become outdated quickly as industry outpaces the development of  security standards. TSA, CISA, and passenger rail agency officials we  interviewed identified the NIST Cybersecurity Framework as the primary  key practices document they reference for cybersecurity.

Domestic and foreign rail agency, and industry association officials, as  well as academic experts we interviewed noted that the possibility or  likelihood of a cyberattack causing physical damage or harm to rail  passengers or infrastructure is unlikely and largely hypothetical at this  time. Academic experts we interviewed pointed to an incident in Poland in  2008 as one of the few, if only, known incidents in which a cyber-related  attack on rail resulted in physical harm. In this incident, according to news  reports, a Polish teenager modified a television remote control so that it  could be used to control signals and switch points in a local tram system.  Four vehicles derailed and 12 people were injured in the incident.

Several rail agency officials and stakeholders we spoke with noted that  successfully hacking into train control systems would require a highly  sophisticated knowledge of the system. Officials further noted that train  systems are designed to fail to safe mode and stop a train in the event of  an abnormal signal, and that train operators have the ability to take over  controls and manually stop trains if necessary. Officials from three rail  agencies, however, stated that as agencies continue to adopt new  technologies and systems become more interconnected, the potential for  a cyberattack increases. Additionally, CISA officials and officials from one  rail agency stated that, despite the lack of many incidents to date,  protecting control systems is critical given the potential catastrophic  impact of a successful attack.

TSA Identifies Foreign Standards and Key Practices through Multilateral Working Groups and Bilateral Relationships, but Provides Limited Guidance to TSARs on Engaging with Foreign Rail Stakeholders

According to TSA officials, TSA identifies foreign passenger rail security  standards and key practices through engagement in multilateral groups  and by leveraging bilateral relationships. Examples of multilateral groups  include the International Working Group on Land Transport Security and  the European Association of Railway Police Forces (RAILPOL). The  working group, established in 2006, consists of 19 member states,  including the United States. It is intended as a framework for members  to openly share best practices, exchange information, and contribute to  the development of surface transportation security initiatives. For  example, TSA and members of the working group developed a  searchable database of international surface transportation security  measures (known as the SMARTbox) as a resource for surface  transportation professionals to gain insights into security practices used  by their peers. RAILPOL, founded in 2004, is an international  association of government railway police organizations. It has 22  members, including TSA and the Amtrak Police Department. Information  about intermodal stations and cybersecurity can be identified and  exchanged through both of these mechanisms. For example,  representatives from the United Kingdom delivered a presentation on  securing intermodal stations at a 2016 working group meeting, and both working group and RAILPOL meetings have included cybersecurity  discussions.

Figure 3 provides an image of St. Pancras International Station in  London, an intermodal station where international, local, and long  distance trains converge with the London Underground.

Regarding bilateral engagement, TSA identifies foreign rail security  standards and practices through one-on-one relationships with other  countries. TSA officials noted that their level of engagement with other  countries can depend on a variety of factors, including how much the  countries have in common regarding transportation systems and threats,  and whether or not there are formal agreements in place that allow for  regular, detailed information sharing. While some relationships are  ongoing, officials stated that TSA interactions with other countries are  often situational or transactional—countries may reach out either directly  to TSA or through the TSAR for information about a specific issue, such  as perimeter protection for surface transportation. For example:

TSA holds biannual meetings with Transport Canada, the Canadian  government department responsible for transportation policies and  programs. Discussion topics from the meetings in 2017 and 2018  included Canadian efforts to develop passenger rail regulations,  results from TSA derailment device testing, and opportunities for  collaboration.

According to TSA officials, TSARs in several countries have facilitated  engagement with foreign surface transportation officials, including  passenger rail officials. For example, officials stated that one TSAR  facilitated the use of TSA’s Exercise Information System for an  exercise on the metro system in a foreign city, as well as joint rail  security training at TSA facilities in the United States. Officials further  noted that another TSAR has taken initiative to facilitate quarterly  meetings between foreign government and TSA surface  transportation officials, including research and development and  passenger rail officials.

In addition to quarterly meetings facilitated by the TSAR, TSA officials  stated that they are in regular contact with research and development  officials in one country to share testing information, such as the  results of derailment device testing and explosives testing on railcars,  and to discuss security issues related to unmanned aircraft systems.

TSA officials also reported that representatives attended an APTA- sponsored study trip to Brussels and London after the 2016 and 2017  rail attacks in those cities, in part, to observe lessons learned from the  attacks.

Foreign governments and international rail associations also produce a  variety of passenger rail security standards and key practice documents.  Table 3 below provides examples of these documents and the types of  threats they address.

TSA officials noted that while multilateral forums provide valuable  opportunities to communicate with other countries about evolving threats,  emerging security technologies, and potential key practices, interest in  forums such as the International Working Group on Land Transport  Security has been in decline. For example, while the working group  charter calls for annual meetings and quarterly conference calls, the full  group has not met since 2016. TSA and foreign government officials we  spoke with stated that interest in the working group may be in decline due  to factors such as retirements of key officials and lack of engagement  from certain countries. These officials also noted that, as leaders in rail  security, they typically provide more information about key practices to  other countries in large forums than they receive. Additionally, TSA  officials noted that other countries frequently used the working group- developed SMARTbox initially, but that use declined in recent years in  part due to its location on the Homeland Security Information Network  because users may find it difficult to navigate. Further, eight of the 10  domestic and foreign rail agencies we interviewed said they were either  unfamiliar with the application or did not use it. For example, officials  from one domestic agency said that there was little incentive to contribute  and that they found informal networks to be more useful for sharing  information. In contrast, TSA and other officials we spoke to stated that  bilateral relationships with trusted partners with similar sophisticated rail  operations may allow for more detailed exchanges of current and  emerging key security practices.

TSA Provides Limited Guidance to TSARs on Engaging with Foreign Rail Stakeholders

TSA has provided limited guidance to TSARs on engagement with foreign  passenger rail stakeholders through the TSAR Toolkit (or handbook),  which states that TSARs should engage with officials involved in multiple  modes of transit, including rail; however, the primary focus of the  document is engagement with aviation stakeholders. TSA further provides  comprehensive and specific guidance for TSAR aviation engagement as  part of its foreign airport assessments and air carrier inspections, but  does not do so for surface transportation. As discussed above,  according to TSA officials, some TSARs have taken the initiative to  facilitate meetings and share testing and training information related to  surface transportation, including passenger rail. Passenger rail officials  we talked to in one country stated that these TSAR-led initiatives served  as a valuable source of information and communication with TSA. In  addition, one TSA official cited the value of discussing preliminary testing  findings, as well as new guidelines on topics such as security in station  designs, which address concerns about security in public spaces. These  efforts, however, are dependent on the individual initiative of each TSAR  and are not universal. For example, one TSAR we interviewed stated that  TSA’s expectations and priorities for surface transportation engagement  were unclear and, as a result, he focused almost exclusively on aviation.

TSA officials stated that they have focused TSAR guidance on aviation  engagement because of the agency’s regulatory role in this area, which,  as discussed above, includes foreign airport assessments and air carrier  inspections. In lieu of detailed guidance on surface transportation, officials  noted they defer to the individual TSARs on how or whether to engage  foreign surface transportation stakeholders. Officials emphasized this  individual approach and stated that in some countries, TSAR engagement  on passenger rail security issues may be limited by legal or cultural  barriers. Because rail (unlike aviation) does not directly connect to the  United States in most cases, officials noted that there may be less  incentive for some host countries to engage. Further, some countries may  not have a rail system, or may not be as advanced in rail security policies  and procedures, and therefore may be less able to offer key practices.

In November 2019, TSA officials noted that they were considering adding  guidance for engaging with surface transportation officials and addressing  intermodal concerns to TSAR Regional Operational Implementation  Plans. According to officials, these plans provide targeted guidance to  TSARs for engagement within their specific regions. As of February 2020,  officials stated that draft plans for two regions (Western Hemisphere and  Africa/Middle East) were under review at TSA. Officials further stated  that these drafts, and drafts for the remaining regions currently in  development, would include surface transportation-related guidance. TSA  officials stated that they hoped to complete all regions’ plans by the end  of calendar year 2020, but they did not provide documentation for us to  verify that the final plans would contain surface transportation guidance  for TSARs.

The 2018 TSA Administrator’s Intent document includes a goal to  promote security partnerships across surface transportation systems by,  in part, identifying and communicating best practices and lessons learned  to stakeholders and international partners. In addition, the NIPP states  that officials should share actionable and relevant information across the  critical infrastructure community to build awareness and enable risk  informed decision making. The TSAR Toolkit further states that, even in  locations without modal connections to the United States, there is still  great value in establishing key points of contact who can share best  practices or facilitate the exchange of information in the event of an  emergency in modes of transit outside of aviation. As the primary  overseas point of contact for security matters involving all modes of  transportation, TSARs are responsible for developing bilateral  relationships and facilitating information sharing with foreign stakeholders,  among other things.

Further leveraging formal or informal bilateral relationships could allow  TSA to obtain additional passenger rail security information. While several  TSARs have individually taken initiative with regard to rail, without  additional guidance from TSA, there is no assurance that they will engage  in these exchanges with modes outside of aviation. As a result, TSA is  less likely to be fully aware of key passenger rail security practices in  other countries, such as those listed in table 3 above, among others.  Moreover, specific guidance will also provide TSARs with clear  expectations for engaging with stakeholders, and provide TSA with  greater assurance that they are engaging in a consistent manner. TSA’s  new Regional Operational Implementation Plans provide an opportunity  for TSA to more clearly incorporate targeted guidance to encourage  TSAR outreach and information sharing in specific areas. Recent efforts  by TSARs in several countries demonstrate practices, such as opening  lines of regular communication on surface transportation, including  passenger rail, which could be replicated in other countries.

TSA Uses Various Mechanisms to Share Security Standards and Key Practices but Does Not Fully Incorporate NIST Cybersecurity Standards in the BASE TSA Shares Information about Standards and Key Practices through Its Participation in Working Groups, and through Assessments and Exercises

According to TSA officials and domestic rail stakeholders we interviewed,  TSA uses various mechanisms such as the Transit Policing and Security  Peer Advisory Group, monthly conference calls with rail stakeholders,  and the annual APTA roundtable meeting to share and discuss a range of  security information with stakeholders, including information about  standards and key practices. These mechanisms provide opportunities  to discuss issues related to intermodal stations and cybersecurity key  practices.

TSA also shares information about key practices with domestic  stakeholders through voluntary TSA programs such as BASE, the  Intermodal Security Training and Exercise Program, and the Visible  Intermodal Prevention and Response program. TSA officials provided  information about how they incorporate information from foreign threats  and attacks into these programs. Specifically:

TSA officials noted that TSA initially developed the BASE program  around standards that were produced by APTA and other industry  partners following the 2004 terrorist attacks on commuter trains in  Madrid and the 2005 terrorist attacks on the London subway system.  According to TSA officials, the APTA standards and recommended  practices, which evolve based on threats and lessons learned, form  the basis for the BASE assessment template. One way in which TSA  helps communicates these standards and practices to agencies is  through the questions in the template. Officials noted that lessons  learned from foreign rail security incidents have been used to further  support certain security concepts in the BASE, such as assessment  questions related to whether agencies engage in public outreach for  security awareness (e.g. “If You See Something, Say Something”)  and report suspicious activity.

TSA officials reported that they consider overseas and domestic  attack methods and tactics when planning Intermodal Security  Training and Exercise Program exercises to raise awareness of  emerging tactics and threats. These exercises are intended to share  best practices and lessons learned, among other things. Officials  noted that they recently incorporated cyber, chemical, and vehicle- ramming attacks into the program’s objectives based on recent  domestic and overseas incidents, and that they shared resources,  information, and best practices for security solutions. For example,  officials reported conducting two regional exercises that focused on  chemical threat elements as the result of a 2017 plot in Australia.

TSA further reported hosting a series of vehicle ramming program  workshops in the wake of attacks in New York City and Europe.

According to TSA officials, TSA has not made any recent changes to  the Visible Intermodal Prevention and Response program directly as a  result of lessons learned or key practices resulting from a foreign rail  security incident; however, officials said they regularly integrate  information about foreign incidents and threats when planning  program deployments. Officials also noted that the majority of current  deployments are for surface transportation, which includes rail.

Regarding cybersecurity, TSA has shared information about cybersecurity  key practices, including the NIST Cybersecurity Framework, through a  series of regional cybersecurity Intermodal Security Training and Exercise  Program workshops since 2017. These “5N5” workshops listed five  nontechnical cybersecurity actions an agency could take in 5 days,  including: (1) develop familiarity with the NIST Cybersecurity Framework;  (2) implement a unique password change policy; (3) understand the latest  phishing and spam trends and how to message awareness; (4)  differentiate access control among staff; and (5) report cybersecurity  incidents.

Six of the seven domestic rail agencies we spoke with were generally  satisfied with TSA’s efforts to share security and key practice  information; however officials from two of these six agencies also  expressed concerns about timeliness and quality of cybersecurity  information provided by TSA. For example, officials from one agency  stated that they received limited cybersecurity information from TSA and  that the information they did receive was of limited use because it was  targeted at agencies without a sophisticated cybersecurity program. An  official from another agency noted that while there were opportunities to  discuss cybersecurity, the information provided was often general in  nature and there was limited time for discussion in certain mechanisms  because of the large number of people involved. This official also noted  that while the information TSA provides is valuable and there are  mechanisms available to share information about a range topics,  discussions are typically related to security incidents and threats, as  opposed to key practices.

TSA officials acknowledged that the agency’s cybersecurity efforts were  still in the early stages. They further noted that the implementation plan  for the 2018 Cybersecurity Roadmap, which, among things, calls for  improving information sharing and partnering with stakeholders to  promote the adoption of best practices and industry and/or international  standards, was only recently signed in September 2019.

In addition to TSA’s information sharing mechanisms, domestic rail  agency officials we spoke to reported learning about foreign key practices  through personal experience and direct engagement with foreign rail  counterparts. For example, officials from two agencies we spoke to  hosted visits from foreign rail officials to study security measures, among  other things. Officials from one agency noted they provided information to  Hong Kong through APTA on key practices for managing large protest  crowds in an urban transit environment. Officials from another agency  noted that they participate in international information sharing surveys  and research to learn about cybersecurity practices by foreign rail  operators, and sent representatives to an international mass transit  training forum on the development of threat, vulnerability, and risk  assessments.

Domestic rail agencies also identified several changes they have made to  their physical security systems as a result of key practices or lessons  learned from foreign rail incidents. For example: increasing random  patrols and high visibility deployments of security officers, changing  security camera placement to better capture station exits, and increasing  security awareness messaging to employees and passengers.  Additionally, officials from one agency noted that they revised subway  evacuation plans to direct people towards areas less vulnerable to an  attack after reviewing lessons learned from recent vehicle-based attacks  in Europe. With regard to cybersecurity, one domestic agency we spoke  to noted that recent wide-spread global cyberattacks reinforced  challenges they have securing legacy Information Technology systems  against threats such as ransomware threats. As a result, the agency is  focused on identifying expiring technologies and replacing those that can  no longer be patched or updated. Officials from another agency noted  that they have increased the number of firewalls they use to further  segment and protect systems.

Table 4 below provides information on mechanisms that can be used to  identify and share rail security key practice information, as identified by  TSA and domestic stakeholders.

TSA Does Not Fully Incorporate NIST Cybersecurity Standards into Its BASE Assessments

While TSA has taken initial steps to share cybersecurity key practices and  other information with passenger rail stakeholders, the BASE  assessment, does not fully reflect the updated cyber key practices  presented in the NIST Cybersecurity Framework, nor does it include the  framework in a list of available cyber resources. As discussed above,  TSA uses the BASE assessment to share security best practices with  transit agencies, among other things. Our review of the BASE  cybersecurity questions in the template found that they cover selected  activities associated with three of the five functions outlined in the  framework– Identify, Protect, and Respond. For example, the BASE asks  agencies if they ensure training reinforces cybersecurity roles and  responsibilities, which corresponds to the awareness and training  category of the NIST Protect function. However, the remaining two  functions—Detect and Recover—are not represented in the BASE.  According to the framework, when considered together, these functions  provide a high-level, strategic view of the life cycle of an organization’s  management of cybersecurity risk.

TSA officials stated that they regularly review the BASE and noted that  the questions are intended to reflect both industry key practices and  agency policy; however, they also stated that the agency has not updated  the BASE cybersecurity questions since NIST released its Cybersecurity  Framework in 2014. In January 2020, officials responsible for the BASE  acknowledged that the cybersecurity questions should be updated to  reflect the framework. TSA officials also noted that they would want to  align changes to the BASE cybersecurity questions with any new  guidance or direction provided by the newly established Surface  Transportation Security Advisory Committee. As of January 2020, the  Committee is in its initial start-up phase, and has not yet provided any  reports or recommendations or published a timeline or project plan.  Further, because the framework functions organize basic cybersecurity  activities at their highest level, incorporating elements of all five functions  into the BASE template should not require additional guidance from the  Committee.

The 2015 TSA Transportation Systems Sector-Specific Plan states that  encouraging the adoption of the NIST Cybersecurity Framework across  all transportation modes supports the plan’s goal to manage the security  risks to the physical, human, and cyber elements of critical transportation  infrastructure. The plan also states that encouraging the adoption of the  framework contributes to several of the NIPP’s calls to action related to  sharing actionable and relevant information. TSA considers the  framework a best practice document.

By updating the BASE cybersecurity questions to align more closely with  the core functions in the NIST Cybersecurity Framework, TSA could  better assist passenger rail and other operators in identifying current key  practices and improving their cybersecurity posture. As a result, transit  operators would be more aware of cybersecurity vulnerabilities and better  prepared to reduce the impact from a cybersecurity incident. In addition,  this would create a more consistent cybersecurity approach from TSA,  since the agency promotes the framework through other mechanisms,  such as the series of cybersecurity workshops, as noted above.

Recent physical and cyberattacks in U.S. cities and Europe demonstrate  the evolving nature of the threats to passenger rail and highlight the  importance of working with both domestic stakeholders and foreign rail  security partners. As such, TSA actively engages with domestic  passenger rail stakeholders, but could do more to engage with foreign  stakeholders. TSARs stationed abroad are well positioned to further  leverage bilateral relationships with foreign passenger rail stakeholders,  and several TSARs have taken initiative to do so. However, TSA provides  only limited guidance to TSARs on surface transportation engagement.  Without specific guidance, there is no assurance that TSARs will engage  in these exchanges with modes outside of aviation. TSA’s new Regional  Operational Implementation Plans provide an opportunity to more clearly  incorporate targeted guidance to encourage TSAR outreach and  information sharing in specific areas. Additionally, such guidance will  provide TSA with greater assurance that TSARs are engaging with  foreign stakeholders in a consistent manner.

TSA uses various mechanisms to share security standards and key  practice information with rail stakeholders, including through BASE  assessments. The cybersecurity questions in the BASE template,  however, do not fully reflect two of the five core areas identified in the  NIST Cybersecurity Framework. By updating the BASE cybersecurity  questions to align more closely with current key practices such as the  framework, TSA could better assist passenger rail and other operators in  improving their cybersecurity posture. As a result, transit operators would  be more aware of cybersecurity vulnerabilities and better prepared to  reduce the impact from a cybersecurity incident.

We are making two recommendations to TSA.

The TSA Administrator should ensure that the TSAR Regional  Operational Implementation Plans include guidance on how TSARs are to  engage with foreign surface transportation stakeholders, including  passenger rail stakeholders. (Recommendation 1)

The TSA Administrator should update the BASE cybersecurity template to  ensure it reflects cybersecurity key practices, including the Detect and  Recover functions outlined in the NIST Cybersecurity Framework.  (Recommendation 2)

We provided a draft of this report to DHS for review and comment. DHS  provided written comments, which are reprinted in appendix II, and also  provided technical comments, which we incorporated as appropriate.

DHS concurred with both recommendations and described actions TSA  plans to take to address them. Specifically, to address recommendation  1, TSA plans to draft an Operational Implementation Plan, which will  provide guidance to TSARs for engaging with foreign surface  transportation stakeholders, including in passenger rail security.  According to TSA, this plan will also serve as the outline for the  development of Regional Operational Implementation Plans, which will  help align resources worldwide. To address recommendation 2, TSA  plans to update the BASE Cybersecurity Security Action Item section to  ensure it reflects the NIST Cybersecurity Framework Detect and Recover  functions. These actions, if fully implemented by TSA, should address the  intent of both recommendations.

We are sending copies of this report to the appropriate congressional  committees and the acting Secretary of Homeland Security. In addition,  the report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact Triana McNeil at (202) 512-8777 or McNeilT@gao.gov. Contact  points for our Office of Congressional Relations and Public Affairs may be  found on the last page of this report. GAO staff who made key  contributors to this report are listed in appendix III.

Appendix I: Physical Security and Cybersecurity Key Practices Cited by Domestic and Foreign Stakeholders

We asked domestic and foreign passenger rail agencies and foreign  passenger rail stakeholders we interviewed to identify some security  related key practices or lessons learned that they employ, including, but  not limited to, intermodal stations and cybersecurity. Table 5 below  provides examples of common security practices both domestic and  foreign officials identified; table 6 shows several additional key practices  foreign rail stakeholders cited. These tables are not intended to be a  comprehensive list, but provide examples of key security practices utilized  by selected domestic and foreign rail agencies.

Figure 4 below shows an example of a Project Servator poster displayed  during an exercise at St. Pancras International Station in London. As  noted in table 6 above, foreign passenger rail stakeholders cited Project  Servator as a key rail security practice.

Appendix II: Comments from the U.S. Department of Homeland Security

Appendix III: GAO Contact and Staff Acknowledgments

In additional to the contact named above, Christopher Ferencik (Assistant  Director), Sarah Turpin (Analyst in Charge), Chuck Bausell, Benjamin  Crossley, Suzanne Kaasa, Tracey King, Ronald La Due Lake, William  Reed, and Adam Vogt made key contributions to this report.

Recent attacks in the U.S. and Europe highlight the importance of strengthening and securing rail systems around the world.

Among other things, we looked at how the U.S. Transportation Security Administration works with U.S. and foreign transit and security officials and others to identify and share security standards and practices.

TSA may not be fully aware of key rail security practices abroad that can keep passengers safe. TSA could also engage more consistently with foreign surface transportation stakeholders.

We made 2 recommendations, including that TSA provide better guidance for those who serve as its primary overseas representatives.