GAO Reports – Week of 1-6-24 – Cost of Positive Train Control

This week the Government Accountability Office published a report on “GAO Reports – Week of 1-6-24 – Cost of Positive Train Control”. This report was required by §22409 of the Infrastructure Investment and Jobs Act (PL 117-58, 135 STAT. 740). In collecting information for this report from the commuter railroads, GAO found that most did not accurately breakout the operations and maintenance (O&M) costs for the positive train control systems that they are required to operate.

When Congress mandated PTC systems for all passenger railroads in 2008, everyone knew that it would be a costly system to implement. What Congress was looking for in this report, now that all passenger railroads have PTC systems in place, is what it was going to cost to maintain and run these systems. Unfortunately, it appears that the railroads have had little interest in tracking those costs.

What is missing, however, is what costs the freight railroads are having to keep up their PTC systems on lines transited by the most dangerous chemicals. This was not included in this report for the simple reason that Congress did not ask for it.

GAO Reports – Week of 11-26-22 – Cybersecurity

This week the Government Accountability Office published one report on cybersecurity; “Critical Infrastructure: Actions Needed to Better Secure Internet-Connected Devices”. The report focuses on critical infrastructure oversight of IoT and OT cybersecurity at three federal agencies: DOE, HHS and TSA. The report includes nine recommendations, mainly dealing with specifically including IoT and OT technology in cyber risk assessments and including cybersecurity metrics in the respective sector specific plans.

Highlight Page .pdf - https://www.gao.gov/assets/gao-23-105327-highlights.pdf

Commentary

It is interesting that GAO overlooked the longest running federal security program that includes oversight of critical infrastructure cybersecurity; the Chemical Facility Anti-Terrorism Standards (CFATS) program. Many of the recommendations could be applied to that program as well.

GAO Reports – Cybersecurity Oversight Week of 11-12-22

This week the Government Accountability Office (GAO) published two reports on agency oversight of private sector cybersecurity. The reports covered DOD oversight of contractor cybersecurity and DOI’s s Bureau of Safety and Environmental Enforcement (BSEE) oversight of offshore oil facility cybersecurity. The two reports are 

DOD Cybersecurity: Enhanced Attention Needed to Ensure Cyber Incidents Are Appropriately Reported and Shared

Full Report .pdf

Highlights .pdf

Offshore Oil and Gas: Strategy Urgently Needed to Address Cybersecurity Risks to Infrastructure

Full Report .pdf

Highlights .pdf

GAO Reports – Response to Catastrophic Cyber Attack

This week the Government Accounting Office published a report looking at potential responses to address the financial fallout from a catastrophic cyberattack on critical infrastructure. It concludes that there are some major shortcomings in current insurance programs. It recommends that DHS and the Treasury Department take a concerted look at the situation and come up with potential program suggestions.

Specifically, the report notes (pg 1):

“Cyber insurance and the Terrorism Risk Insurance Program (TRIP)—the government backstop for losses from terrorism—are both limited in their ability to cover potentially catastrophic losses from systemic cyberattacks. Cyber insurance can offset costs from some of the most common cyber risks, such as data breaches and ransomware. However, private insurers have been taking steps to limit their potential losses from systemic cyber events. For example, insurers are excluding coverage for losses from cyber warfare and infrastructure outages. TRIP covers losses from cyberattacks if they are considered terrorism, among other requirements. However, cyberattacks may not meet the program’s criteria to be certified as terrorism, even if they resulted in catastrophic loss.”

GAO Reports – Counter Drone Technology

This week the Government Accountability Office published a report on “Counter Drone Technologies”. This is a very broad, non-technical look at the potential risks to critical infrastructure posed by unmanned aircraft and the potential technologies that could be used to counteract those risks. There is no real discussion about the legal implications of counter-drone technologies.