Assessing the Risk to Rail and Transit Systems

On the morning of March 11, 2004, when bombs exploded in the

Madrid train station, the security of Americas rail and mass transit

systems became of greater concern than the day before. In July 2005,

Americans were reminded of the vulnerabilities of transit systems when bombs

exploded in the London Underground. However, rail and transit security has

not become a national priority. Following the 9/11 attacks on theWorldTrade

Center and Pentagonand the 9/11 Commissions recommendation of increased

attention to the risksdiscussion has been considerable concerning the

vulnerability of the nations rail and transit systems, but little has been done to

improve the situation.

The Madrid and London bombings reminded Americans of the dangers,

and the perception of heightened risk did force the U.S.Department of Homeland

Security (DHS) and other federal agencies, as well as rail companies and

transit authorities, to invest more in system security.However, investments have

been small, and rail and transit security clearly is not a priority.The Bush administration

has asked for only $37 million for railroad and transit security for

FY09, compared with $6 billion for aviation security.The issue was raised by

Senator Barack Obama in his presidential campaign (www.barackobama.com),

and presumably he will address this vulnerability as president.The issue is not

likely to be addressed soon, however.The questions that have to be answered

now are (1) how high the risk is and (2) how it can be reduced to an acceptable

level.Need for Better Risk Management

Officials at all levels have recognized the need for better

risk management to set policy priorities and guide resource

allocations.The working group that developed The

Principles of Emergency Management in 2007 listedrisk-driven

as one of the eight core principles in the profession

and practice of emergency management.That principle

reflects the concern among many professional emergency

managers that homeland security priorities and federal

funding too often do not address real,measurable risks in

their communities.The U.S. Government Accountability

Office (GAO), too,has expressed concern that homeland

security programs lack effective risk management approaches.

An expert panel convened by GAO determined

that poor risk communication,politics, and alack of strategic

thinking inhibit the use of risk management.

Terrorism presents some challenge in terms of the measurement

of risk.Risk assessment techniques usually focus

on the frequency or probability of undesirable events

and their likely severity.When there is a history of events,

the frequency and intensity of future disasters can be extrapolated.

For example, volcanic eruptions tend to follow

cycles,with major events from a few decades to tens

of thousands of years apart.The eruptions are largely effusive

(characterized by lava flows) or explosive (characterized

by explosions of ash, rock, and gas and by pyroclastic flows).

Scientists can estimate how frequently a volcano will erupt

and the likelihood that the eruption will be of one type

or the other.Some new predictive models estimate the time

and severity of eruptions, and warnings have provided time

to evacuate threatened populations.

Terrorist events,while cyclic, are less amenable to estimation.

However, terrorist organizations tend to have

limited repertoires and resources, and predicting their future

behavior on the basis of the past is reasonable.Targets

and weaponry for particular terrorists organizations

tend to vary little. Of course, a volcano can behave differently

than in the past, and terrorists can certainly learn

new tricks.Although basing estimations of future behavior

on past behavior is reasonable in the absence of contrary

indicators, there is a danger of missing clues to new behaviors

or even, in the case of volcanoes, longer cycles characterized

by different behaviors. Fortunately, terrorist

groups tend not to last as long as volcanoes.Assessing the Threat

How should the threat of terrorism be assessed?Terrorist

violence has beenbackground noisefor half a century

or more, and the demarcation line for modern terrorism

is the conflicts followingWorldWar II.As illustrated

inTable 1, hundreds of attacks have occurred each year.For the United States, attacks on diplomatic facilities

and personnel are relatively common,but few people have

been killed.As shown inTable 2, twenty-five Americans

were killed in the attack on the USS Cole in 1996, twenty-

three in the Khobar barracks bombing in 2000, and

twelve in the bombings of the Kenyan andTanzanian embassies

in 1998and those were large numbers compared

with other years. (The State Department stopped publishing

its annual reviews of international terrorism in 2003.)

Almost three thousand Americans and non-Americans

died in theWorldTrade Center and Pentagon attacks.

Many more have died in the conflicts inAfghanistan and

Iraq,most killed byAfghan and Iraqi insurgents rather than

international terrorists.The point is, except for 2001, the

number of American deaths from international terrorist

attacks has been relatively low compared with other risks,

particularly, for example, the annual deaths of thirty thousand

on the highways and thirty-six thousand from the

flu.This is not to say that terrorism is not a serious problem,

but, in the context of other threats to life, it has notbeen as deadly.The question also remains whether the

thousands of deaths in 2001 were the beginning of a trend

or simply an extraordinary but short series of events.

U.S. counterterrorism policy has been criticized for

being based on worst-case scenarios rather than on past

or even the most likely events. For example, the concern

about bioterrorist attacks has been great and investments

in programs to address them have increased, but the most

likely terrorist incidents are bombings. In fact,homemade

bombs are generally the terroristsweapons of choice.

Part of the problem is trying to assess risk on the basis

of the identification of vulnerabilities. Just because a facility

or community is vulnerable because it lacks sufficient

security to deter or deflect a terrorist attack does not mean

that terrorists would choose it as a target.Terrorists frequently

do choose so-calledsoft targetsbecause they have

a greater likelihood of success at minimal cost, but other

factors affect target choice, such as symbolic value, location,

and their own organizational resources and expertise.

All potential targets are not equal, and all terrorist organizations

are influenced by their own dynamics.Not all

terrorists hope to kill large numbers of people.

Transportation systems have frequently been the targets

of terrorists.A study of attacks on land transportation

systems, including rail, between July 1997 and December

2000, listed attacks and attempted attacks in

forty-eight different countries. Although the attacks on

U.S. railroads and transit systems have been relatively few,terrorists are likely to find such systems attractive targets

or at least targets of opportunity.The threat is real, but is

it significant in the United States? Can terrorists attack

an American transportation hub like they did in Madrid

or a transit system as they did in London? In May 2002,

warnings were issued concerning a possible attack upon

U.S. subway and rail systems, and in October 2002,warnings

were issued again by the FBI about possible attacks

on passenger trains. No attacks have yet occurred.

Since the 9/11 attacks, warnings have also been issued

about attacks on buses, bridges, tunnels, and other

parts of our transportation infrastructure.Although some

rail companies and transit systems stepped up their security

precautions following the warnings, the financial and technical

resources to support comprehensive security efforts

have been lacking, and the result has been piecemeal protection

or no additional protection at all.The federal government

focus has been on prevention rather than on reducing

the potential losses of life and property from such

attacks.

Because of the focus on prevention (securing facilities

to protect against attacks rather than preparation for

reducing the impact upon lives and property), passengers

have not been prepared to deal with attacks.Officials evidently

fear that suggesting measures to deal with attacks

will cause panic or simply scare off potential passengers.

However, the victims of the 1995 sarin gas attack in the

Tokyo subway system, for example, showed remarkable

calm even when the risk became obvious.

Security Problems

Rail and transit systems are indefensible.Although some

parts of rail and transit systems can be secured, the systems

are and will remain vulnerable to terrorist attack.There

are a number of reasons for that vulnerability.First, stations

and other facilities have to be open to passengers, shippers,

and others seeing passengers off or conducting business.

Second, long sections of track are extremely difficult to defend

without posting armed guards every few hundred yards

and creating sizable secure buffer zones to keep unauthorized

personnel away.Crowded urban areas simply do

not provide space for that kind of security.Third, access

to facilities and track by large numbers of workers also poses

a threat because it affords opportunities for terrorists and

criminals either to infiltrate the workforce or to disguise

themselves as workers to enter secure areas.Public Access

Access is a touchy issue in public facilities in general

and in rail and mass transit facilities in particular.According

to GAO,U.S. transit systems logged over nine billion

passenger trips in 2000 and employed approximately

350,000 workers.The sheer numbers of passengers and

workers having access to the systems complicates surveillance

and confounds security. Systems heavily depend

on ridership, with fares generating 36 percent of operating

revenue. Security is largely an operating expense, and

federal law prevents large urban transit systems from using

federal dollars for operating expenses.The transit systems

have largely been left to their own devices to fund

security efforts.

Limiting public access is also problematic because of

the impact that delays can have on ridership.Local commuters,

in particular, choose to use mass transit because

of cost and convenience. Delays caused by mechanical

problems, accidents, and security can tip the balance for

those choosing between mass transit and private automobiles.

Delays of as little as a few minutes can influence

that choice, but likely have less impact when commutes

are longer, so commuter rail systems will be less affected

than subway and light rail.Nonetheless, the financial condition

ofAmtrak is such that small decreases in ridership

can have a significant effect.

Increased security at airports has certainly slowed passenger

access and, in some cases, delayed flights or

caused passengers to miss their flights.Long security lines

inAtlantas Hartsfield-Jackson InternationalAirport one

Monday morning inMay 2004 caused approximately four

hundred passengers to miss their flights, and the U.S.Transportation

SecurityAdministration (TSA) was encouraged

to increase the numbers of screeners at major airports despite

the limits on manpower mandated by the act. Similar

problems at other airports have encouraged TSA to

move screeners from less busy airports to twenty-five focus

airports, selected on the basis of size and proximity

to special events and major tourist attractions.

There is also some question whether travelers are

choosing to drive rather than to fly when distances are

relatively short.A six-hour drive may be faster than flying

when travel to the airport, baggage checks, security

processing,waiting at the gate, and the actual flight time

are factored in. Recent analyses of air travel since 9/11

indicate a major decline that might be attributed to the

security measures put in place, rather than fear of a terrorist

attack.

Screening Passengers

An experimental program to screen passengers was

set up at a commuter rail station inMaryland and has since

been used at large airports. Passengers walk through a

puffer machine that checks for traces of explosives in

the air around them.Baggage is also being screened.The

technology is in use around military installations and power

plants, as well as some government buildings and the

Statue of Liberty.Biometric scans, preferred customer or

passenger lists, and other means of speeding up the security

screening process or excluding some passengers from the

process altogether are also being implemented.

Security of Tracks and Rights of Way

Security of tracks and rights of way is also a serious

problem.Rail systems and urban mass transit systems typically

cross jurisdictional boundaries, creating coordination

problems for security efforts,fiscal issues regarding the cost

of security, and capacity issues relative to the resources and

capabilities of communities and agencies.Securing rail and

roadbeds,bridges, and tunnels would be a monumental task.

In the months following the 9/11 attacks, some transit systems

employed trackwalkers to examine rails and roadbeds.

That was done inAtlanta during the 1996 Olympics and

it is still done by some transit systems.Monitoring devices

to detect biological and chemical agents and radiological

materials have also been deployed in the systems considered

at greatest risk of attack.

Limiting worker access is a feasible task, but difficult

at best.A credentialing program for transportation workers

has been a priority for the Bush administration.

Before Madrid and London

Before the bombings, very little was done to secure

Americas rail lines and transit systems. Little federal investment

was made in security for facilities or routes.Legislation

that would have provided funding and encouraged

greater security was not passed. The focus of

federal attention was on aircraft and airport security.Some

efforts have been underway to identify best practices in

rail and transit security, conduct vulnerability assessments,

and create an identification system for rail employees,but,

without funding specifically for security,most systems still

lack the resources to achieve a reasonable level of protection

for lives and property.

Homeland Security Presidential Directive No. 7

(HSPD-7) provides the policy underpinning for the protection

of the nations critical infrastructure, including theprotection of rail and transit systems.HSPD-7 states that

all vulnerabilities cannot be addressed or reduced and that

security programs must both reduce the likelihood of attacks

and their impact.The National Strategy for the Physical

Protection of Critical Infrastructures and Key Assets fleshes

out that policy.

The major problem has been how to engage private

firms in protecting the critical infrastructure, including rail

and transit systems, for which they have principal responsibility.

Investments in security are costly, and firms

are understandably reticent to spend scarce funds on uncertain

needs.For government agencies, the expenditures

often provide dual use in the sense that the capabilities

developed can be used to address more-probable risks, like

natural and technological hazards. Notwithstanding the

advantage of improving basic capacities to deal with hazards

and disasters, governments, like businesses, have little

cash to invest in security, and federal dollars are seen

as the key to reducing the risk posed by terrorists.

After Madrid and London

Fortunately, since the bombings, Congress has been

quick to authorize funds to improve rail and transit system

security.The Public Transportation Terrorism PreventionAct

of 2004 authorized the spending of $3.5 billion

for capital improvements, $800 million for operational

improvements, $200 million for research next year, and

$700 million more in the following two years for operational

improvements. In spring 2004, legislation was introduced

in the U.S. House of Representatives to spend

$2.8 billion over three years to improve security forAmtrak,

subway systems,buses, ferries, and other forms of mass

transit.A similar bill was passed in the Senate Banking

Committee to authorize $4.3 billion for FY05.DHS was

to be responsible for identifying security priorities and for

awarding capital grants for communications equipment,

surveillance equipment,bomb detection technologies, and

alert/warning systems and operational grants for training,

drills, and public awareness programs.The Senate Commerce

Committee has passed a bill to spend $1.2 billion

over five years to improve security forAmtrak and freight

lines. The Banking Committee estimated that only

$0.0006 had been invested by the federal government to

provide security for each of the fourteen million passengers

that use public transportation annually, compared with

$9.16 per airline passenger.The $37 million budget request

for surface transportation security for FY09 is clearly

indicative of the low priority given railroad and transit

system security, despite the estimations of risk.

All-Hazards Approach

Rail and transit systems cannot be protected completely,

so the best approach is to prepare for the acts of

God and man.Accidents will happen, natural and technological

hazards will damage systems and harm people,

and terrorists may well attack.Traditional risk assessments

might help target funding, but a broader approach

would help spread resources among many potential terrorist

targets and ensure that other, more common risks

are also addressed, such as rail accidents and hazardous materials

spills.The need is to minimize the social and economic

impact of rail and transit disruption regardless of

the cause.

Dual-use capabilities, therefore, should be a priority.

Which disruptions are most likely is unimportant, and the

risks can be addressed very broadly. Jeremy Plant has suggested

a broad risk management approach that acknowledges

the impossibility of protecting whole systems

and, instead, focuses on mitigating the possible effects of

attacks, as well as accidents and other catastrophes.He recommends

focusing investments on vulnerabilities, likelihoods

or probabilities of attack, and the critical nature of

the asset.A broad all-hazards approach would similarly address

vulnerabilities and build capacities to respond to

emergencies of all sorts and to recover more quickly.

In terms of terrorism, risk increases before and during

special events that attract large numbers of people or media

attention in proportion to the number of symbolic targets

in the community (because transportation systems afford

access to terrorists as well as other passengers) and because

the systems themselves present dense targets (many people

in a small space). Still, train and subway stations are more

likely targets than individual trains or cars simply because

more people are in the facilities, the facilities are likely to

be centrally located,media access is greater, and terrorists

can more easily hide among the passengers and workers.

A prophylactic, or prevention, approach would seem

logical to reduce the likelihood of terrorist attacks, as well

as criminal acts, against stations and other facilities.

However, the potential for fires, gas explosions, and train

crashes, to mention only a few possibilities, also need to

be addressed. Such disasters may have consequences very

similar to those of a terrorist bombing, and the evacuation,

medical response, and fire service plans and other

preparations to respond to them can be adapted for ter-rorist attacks.The all-hazards approachthe underpinning

for the nations emergency management capability

can also be the foundation for terrorism response and recovery

capability.Certainly, integrating the two capabilities

results in economies of scale and programmatic efficiencies

in considering the risks of all kinds of rail and transit

disasters as part of a larger problem.

Conclusion

The rail and transit systems must ensure adequate security

to reduce the risk to life and property and ensure

that security measures do not adversely affect ridership

and operations. Investments of federal dollars, or at least

financial incentives, that encourage private investment in

security costs are critical.The risk of terrorist attack is still

uncertain. Domestic terrorists may become the major

threat to the nations rail and transit systems in the decades

ahead.A focus on Madrid-type bombings may miss the

mark when the threat changes, so a more general approach

will be more adaptable to future, as well as current, risks.