Managing Risk on the Rails

It seems that there has been a lot of press lately about rail security. Adding to the pile, the GAO recently released a review of DHS' work so far on the rail sector. It was an update of GAO's September 2005 report on the same subject.

Typical for a GAO report, there's some good news, there's some bad news. The salient point, which is hammered home again and again, is that DHS and the Transportation Security Administration (TSA) need to complete their risk assessment of the rail sector. TSA has worked on a lot of interventions, such as their new proposed rules for the passenger and freight sectors. But without finishing the risk assessment and developing a comprehensive strategy based on risk, who's to say if the rail sector will be as secure as it can be?

Here are a few highlights from the GAO report:

In our September 2005 report on passenger rail security, we recommended, among other things, that TSA establish a plan with timelines for completing its methodology for conducting risk assessments and develop security standards that reflect industry best practices and can be measured and enforced. These actions should help ensure that the federal government has the information it needs to prioritize passenger rail assets based on risk, and evaluate, select, and implement measures to help the passenger rail operators protect their systems against terrorism. … However, as of February 2007, DHS has not provided a formal response indicating if or how it has implemented these recommendations.

In fact, the National Infrastructure Protection Plan (NIPP), released in 2006, specifically requires agencies to develop priorities based on risk assessments:

In fulfilling its responsibilities under the NIPP, TSA must conduct and facilitate risk assessments in order to identify, prioritize, and coordinate the protection of critical transportation systems infrastructure, as well as develop risk based priorities for the transportation sector.

To be fair, TSA has been working on it:

DHS has made progress in assessing the risks facing the U.S. passenger rail system, but has not issued a plan based on those risk assessments for securing the entire transportation sector and supporting plans for each mode of transportation, including passenger rail.

As of February 2007, the [DHS] Office for Grants and Training (OGT) had completed or planned to conduct risk assessments of most passenger rail operators.

But the key is to have a comprehensive, strategic approach to intervention that's based on risk-management. Until you have the whole picture of risk, your interventions (though they may have individual tactical effectiveness) will not form an integrated system and will not reach their optimal level of effectiveness. For example:

In May 2004, TSA issued security directives to the passenger rail industry to establish standard security measures for all passenger rail operators, including Amtrak. However, as we previously reported, it was unclear how TSA developed the requirements in the directives, how TSA planned to monitor and ensure compliance, how rail operators were to implement the measures, and which entities were responsible for their implementation.

The GAO concludes:

Since our September 2005 report, DHS components have taken steps to assess the risks to the passenger rail system, such as working with rail operators to update prior risk assessments and facilitating rail operator security self assessments. According to TSA, the agency plans to use these assessment results to set priorities for securing rail assets deemed most at risk, such as underground and underwater rail infrastructure and high density passenger rail stations. A comprehensive assessment of the risks facing the transportation sector and each mode, including passenger rail, will be a key component of the TSSP and supporting plans for each mode of transportation. Until TSA issues these plans, however, the agency lacks a clearly communicated strategy with goals and objectives for securing the overall transportation sector and each mode of transportation, including passenger rail.