PTC NPRM Comments

The end of the comment period for the Federal Railroad Administration’s Positive Train Control (PTC) NPRM came last week. As I noted in a blog last month this is a very complex rule and only limited parts of it directly affect the chemical security community. In my review of the comments I will only look at those parts of the comments that will affect our community. Comments were received from 15 organizations and the FRA posted a transcript of a public meeting held on August 13th. Comments were received from: Utah Transit Authority Labor Union Invensys Rail Group CSX Transportation National Railroad Passenger Corp BNSF Railway Company American Assoc of Highway and Transportation Officials Northern Indiana Commuter Transportation District GE Transportation NJ Transit HCRQ, Inc The Chlorine Institute Southern California Regional Rail Authority New York State Metropolitan Transportation Authority Association of American Railroads A number of the commentors related their concern that the 30-day comment period, particularly at this time of the year, was too short to allow for an adequate analysis of the rule. The following organizations requested an extension of that time:

CSX Utah Transit Authority

Notes from Public Meeting The ARA noted that the determination of what routes should be covered by the PTC rules should be based on the effective date noted in the statute, 12-31-15. They noted that the Congress realized that there would be significant changes in PIH routings based on the recently implement re-routing rule and that re-routing would not even have begun until after 2010. CSX noted that the recent PIH chain of custody regulations would also affect PIH routings after the 2008 deadline in the NPRM. They suggest using a 2009 routing history for initial planning with a yearly revision based on current routing changes. BNSF notes that 30% of the PIH shipment destinations that delivered to in 2008 have yet to receive PIH shipments in 2009. There followed an extensive discussion (pgs 51 – 68) about how the re-routing rule and the PTC rule would affect each other. The ARA objects to the NPRM’s exempting the Class 2 and 3 railroads from having to have PTC equipped locomotives operating on PTC equipped Class 1 tracks. BNSF believes that concentrating PIH shipments on a smaller number of PTC covered routes would increase the safety of those shipments. Union Pacific notes that they have a number of routes with only a few PIH shipments, typically anhydrous ammonia destined for agricultural co-ops, that it would like to equip with PTC only after all higher priority lines were so equipped. BNSF would like to see a minimum value for the amount of PIH shipments that would trigger the PTC requirement for a freight rail line. The Chlorine Institute Comments The CI would ultimately like to see PTC on all freight railroads. The CI is concerned that using the 2008 freight history for determining which routes will receive PTC systems might serve to limit future routes that railroads will accept PIH shipments across. New York State Metropolitan Transportation Authority Comments The NYSMTA objects to allowing Class 2 and Class 3 railroad from operating non-PTC equipped trains on PTC-required systems. Association of American Railroads Comments AAR provides more detailed comments on their opposition to using 2008 traffic data for determining which routes carry PIH and on which they are thus required to implement PTC. AAR proposes exempting PIH rail cars that have been ‘vacuum pumped’ from being considered as PIH railcars for purposes of PTC routing. AAR objects to the use of a single PIH shipment as a requirement for PTC installation. AAR objects to allowing Class 2 and Class 3 railroads from operating non-PTC equipped trains on PTC-required systems. AAR OMB Appeal The AAR took the unusual step of filing an appeal with the Office of Management and Budget (OMB) in regards to two provisions of this NPRM. The provision covered that will be of interest to the chemical security community is the previously identified issue of the 2008 traffic data being used to determine which routes must be equipped with PTC systems. The appeal is being made using the justification that the FRA is exceeding the mandate of the Rail Safety Improvement Act of 2008 (RSIA) (PL 110-432) which is the authorizing legislation for this rule. The OMB conducts final reviews of all regulations to ensure that they meet the requirements of their legislative mandates and take all other Federal laws and regulations into account. As part of that review the OMB is expected to review public comments submitted during the rule making process to ensure that the rule making agency has adequately addressed those comments. In that respect, AAR is just asking OMB to do its job. Practically speaking though, this formal letter to the OMB is raising the stakes on this portion of the NPRM. This will certainly result in a slowing of the OMB review process, reducing the time between the publication of the final rule and legislatively required implementation date. My Comments on Comments With the extent of the complexity of the PTC issue it would seem to be surprising that the PIH issues consumed so much of the discussion time at the public meeting. When one looks at how much the PIH routing issue will impact the cost of implementing PTC it becomes less surprising especially considering that it was the railroad representatives that were engaged with FRA personnel in that discussion. What was missing from the discussion was representation of the two Federal agencies with PIH routing rules, PHMSA and TSA. The PHMSA rule on PIH routing and the TSA rule on PIH security in transit will both have some interaction with the PTC regulation. The FRA acknowledges that there is the potential for the cost of PTC implementation affecting routing decisions under the PHMSA rule. The railroads maintain that it is the rerouting decisions they make based on the PHMSA and TSA rules will affect which lines will be required to have PTC installation. This certainly requires more inter-agency dialogue. I did not see any discussion of the security aspects of this rule. It would have been nice to see some members of the process control community adding their two-cents worth to the discussion. PTC is certainly a control system writ large. It will require wireless communication between system components and specifically requires the active interaction between control systems of different companies. The fact that these systems are being designed to protect the shipment of PIH chemicals makes them a potential terrorist target. Thus, security is very important. One last interesting comment from the Public Hearing, there will be one additional venue for public comment on the PTC rule before it becomes a final rule. The PTC Working Group of the Railroad Safety Advisory Committee will meet on August 31st thru September 2nd. The meetings will only consider issues raised in filed public comments, but according to the FRA Hearing Officer, late comments filed on this docket will be considered.

PTC NPRM and Cyber Security

Since Positive Train Control is, at its most basic, a cyber control system, it is heartening to see that FRA is actively addressing security measures in this NPRM. While this does not have any direct affect on the chemical security community, I do believe that a brief look at how FRA treats the control system security issue provides a good look at methodologies that could be appropriate for chemical process control systems.

Design Criteria 

In the discussion of §236.1003 FRA explains that security must be considered as one of the design parameters of the system. They note that security “is an important element in the design and development of PTC systems and covers issues such as developing measures to prevent hackers from gaining access to software and to preclude sudden system shutdown, mechanisms to provide message integrity, and means to authenticate the communicating parties” (74 FR 35984).

These should also be part of the design criteria for any industrial control system, but they particularly important for critical control systems at high-risk chemical facilities. Later in the same discussion the FRA notes that another design element, integrated security, “recognizes that optimum protection comes from three mutually supporting elements: physical security measures, operational procedures, and procedural security measures”. Physical security includes measures that “prevent or deter attackers from accessing a facility, resource, or information stored on physical media and guidance on how to design structures to resist various hostile acts” (74 FR 75985).

Finally, since PTC systems are based upon communications between operational units and fixed activities, communications security measures need to be an integral part of system design parameters. In this context communications security measures include systems designed to “deny unauthorized persons information derived from telecommunications and ensure the authenticity of such telecommunications”.

Cryptography Requirements 

One of the key communications security measures that the PTC NPRM is considering requiring where communications confidentiality is required is the use cryptography to both prevent message interception and spoofing as well as provide for communication authentication. It is interesting to note that FRA recognizes that there are no reasonably unbreakable cryptographic techniques. They note that “modern cryptographic practice has discarded the notion of perfect secrecy as a requirement for encryption, and instead focuses on computational security. Under this definition, the computational requirements of breaking an encrypted text must be infeasible for an attacker” (74 FR 35999).

All cryptographic systems use some sort of ‘key’ to share the encryption-decryption procedures between the sender and receiver of the encrypted message. Management of those keys “includes ordering, generating, distributing, storing, loading, escrowing, archiving, auditing, and destroying the different types of material”. Appropriate attention must be paid to each step of this process to protect the keys from inappropriate disclosure.

The NPRM also takes a pragmatic approach to the physical security requirements of the cryptographic equipment. Instead of requiring a ‘tamper-proof’ standard for the physical protection of equipment, the FRA is recommending that the equipment be made ‘tamper-resistant’ and ‘tamper-evident’. To provide an additional level of security, they will require that the equipment be installed in a readily visible location so that the physical evidence of tampering would reasonably be expected to be detected in normal operations of the equipment.

As with most of the requirements found in this NPRM, FRA does not specify the specific cryptographic techniques or equipment that must be used. What it does require is that the railroad must specify the techniques to be used in their PTC Development Plan (PTCDP). While most high-risk chemical facilities do not typically consider communications security in their cyber security plan, any facility that allows off-site communications with their control systems does need to consider protecting that communication with cryptographic techniques. Those communications would not be limited to off-site human access to those systems, but could include system-to-system communications with enterprise information systems.

All-in-all this is an interesting discussion of cyber security measures. It is not comprehensive, but it does provide a perspective that has been missing from many discussions of control systems security. It would certainly be interesting to see what comments cyber security professionals provide in the public discussion of this NPRM.