Rail Transportation Security – Reporting Security Concerns

This is another in a series of blogs that will look at the requirements of the recently released final rule on Rail Transportation Security. While the main focus of this regulation is directed at railroads, there are significant provisions (49 CFR part 1580, Subpart B) that will apply to a wide variety of chemical facilities that use railroad to ship or receive ‘specified quantities and types of hazardous materials’. This blog deals the provisions requiring covered chemical facilities to report significant security concerns to TSA. Earlier blogs in this series were: Rail Transportation Security – RSC Requirement The new rail transportation security rule {49 CFR § 1580.105(b)} requires that covered facilities (hazmat shippers and hazmat receivers in UHTA shipping/receiving PIH chemicals by rail) “must immediately report potential threats and significant security concerns to DHS by telephoning the Freedom Center at 703-563-3240 or 1-877-456-8722”. Potential Threats or Significant Security Concerns Section 1580.105(c) provides an extensive list (nine separate entries) of activities or incidents that need to be reported to the Freedom Center. Some items on the list are easy to understand, like ‘bomb threats’. Others are rather vague, like “Suspicious activity occurring onboard a train or inside the facility of a freight railroad carrier, rail hazardous materials shipper, or rail hazardous materials receiver that results in a disruption of operations.” TSA acknowledges that the wording of many of the listed activities is vague. On page 66 of the preamble to the rule TSA explains that:

“These requirements will provide information to the appropriate authorities, allowing their timely intervention to an attack or its preparation. Detecting activities that may compromise transportation security entails piecing together seemingly unrelated incidents or observations and conducting analysis in context with information from other sources. However, as the threat environment is dynamic and indicators of incident planning and preparation can change, TSA cannot provide a threshold for reportable events or a specific definition.”

This is a problem common to all intelligence analysis operations. Trying to define in advance what information will be important in identifying an opponent’s intentions is nearly impossible. The trick is to acquire as much information as is possible and then let the analysts sort it out. Inevitably this means that much of the information captured will have no use in the analysis because it will not pertain to the actual opponent, but it is always better to have too much information than not enough. Reporting Format In the Army we trained every soldier to use the acronym SALUTE to remember to report the Size, Activity, Location, Unit, Time, and Equipment observed every time that they reported enemy activity. TSA has not yet gotten that sophisticated, in Section 1580.105(d) they provide a list of eight different items that they want included in their reports. As you would expect in a rail security rule, most of the information that TSA is interested in seeing in the report is details about the railroad involvement in the incident. They want to know the carrier name, the rail line/siding, the rail car identification. TSA also wants to know the name of the facility and the point of contact for the incident, to include a telephone number or email where the POC can be reached for the inevitable questions. Finally TSA wants as many details as possible about the incident. Covered facilities should consider making up a blank reporting template. It should include the two Freedom Center phone numbers (703-563-3240 or 1-877-456-8722) and blanks for each of the information requirements listed in §1580.105(d). This would make it easier to organize information in a coherent manner. It would also help to prompt the reporter to take a second look at the incident to gather as much detail as possible before making the phone call. Finally, it would serve as a written record of the information provided to the Freedom Center. Immediately Report Incidents Immediately is one of those tricky terms that everyone thinks they understand. From the discussion provided in the preamble to the final rule, it is clear that reviewers of the NPRM thought that it could mean anything from before calling the police to call within 12 hours. TSA refused to set a specific time standard, but did indicate that a call to 911 would probably take precedence, but not much else. Here is the way it was described in the preamble to the final rule (page 61):

“TSA recognizes that, in some cases, notifying the local first responders to address a threat or consequences in the immediate aftermath of an incident takes precedence over notifying TSA because of the need to protect lives or property. In these cases, regulated entities should notify TSA simultaneously or as soon as possible after notifying 911 or other first responders.”

TSA maintains that promptly receiving these reports is an integral factor in meeting its legal responsibility to assess and coordinate government response to threats against transportation. The preamble notes (page 61) that prompt “notification enables TSA to help coordinate the Federal response, including actions to be taken at the State and local levels, and provides TSA with the situational awareness needed to make the appropriate assessments on the National and local levels.”