Railroad Control System Security

There is an interesting article on the BostonReview.net site about control system security in US railroads. Unfortunately, the author (Bryce Emley) was not able to document a lot of the suspected control system attacks described in the article. This was not because of any lack of research on his part, but probably has more to do with the same sort of reluctance to discuss cyber incidents that we see throughout industry.

Cybersecurity Rules Non-existent

The article includes a rather lengthy discussion about the positive train control (PTC) technology that is still being implemented by the railroad industry. Now I did do a blog post on the security rules in the NPRM for the PTC rule back in 2009 and it is interesting to see how much our ideas about control system security have changed since that time.

As I described in 2009 the current PTC security rules (49 CFR 236.1033) are actually communications security rules and have nothing to do with the cybersecurity other than how secure encryption will be used to communicate between devices.

For other railroad safety systems (and older systems still in place until fully replaced by PTC by 2021) the closest you get to cybersecurity rules can be found in §236 Subpart H; Standards for Processor-Based Signal and Train Control Systems. But the scoping statement for that subpart never mentions security, just safety. The closest you get is found in §236.901:

“This subpart prescribes minimum, performance-based safety standards for safety critical products, including requirements to ensure that the development, installation, implementation, inspection, testing, operation, maintenance, repair, and modification of those products will achieve and maintain [emphasis added] an acceptable level of safety.”

What is Missing

What should have been included (to be fair, no one was really talking about this type stuff for control systems back in 2009, or year 1BS – Before Stuxnet) in the original PTC rulemaking? First, since the railroad industry was being tasked to design, essentially from scratch, a new industrial control system network, this would have been an ideal time to require that secure design tools and processes would be used in developing and manufacturing all components that would be included in PTC installations.

Next the railroads should have been required to develop and maintain network diagrams for all fixed components of their PTC systems and a similar network diagram for each mobile platform traversing those systems. Those diagrams would have to include all devices connected to the systems and all communications modes available to connect with each of those devices.

The rules should have also included requirements for railroads to conduct intrusion detection monitoring of those networks. Because public safety (both passenger and right-of-way neighbors) is involved there should have been requirements to establish internal reporting and incident response plans with requirements for reporting certain types of breaches to the TSA.

Finally, there should have been provisions made for reporting and coordinating component vulnerability disclosure and mitigation. Those provisions should have included specific DMCA exemptions for security researchers looking at PTC components or systems.

Conflicting Responsibilities

Sharp eyed readers will note that I listed TSA as the breach reporting agency. This is because TSA has been given responsibility for surface transportation security, not because they have expertise in cybersecurity matters. They do have a security incident reporting infrastructure in place, but they would probably have to pull in experts from ICS-CERT and/or the FRA for analysis and mitigation measures.

The FRA certainly has a certain amount of internal expertise on matters dealing with PTC systems. I am almost certain, however, that they have little or no cybersecurity expertise as it pertains to those systems. To be fair, nor does anyone else. The closest thing to having an agency with that sort of expertise is the ICS-CERT. A large measure of their control system security expertise would be directly translatable and the probable system specific blank spots would not be difficult to overcome; certainly more so for ICS-CERT than either FRA or TSA.

And there is yet a fourth agency that has a horse in this race, the Federal Communications Commission. Since the PTC systems use broadcast communications both between fixed components and mobile units and intra-fixed network communications over long distances. In fact, the FCC’s permitting process was responsible for some of the delays that the railroads experienced in setting up their PTC systems.

What Needs to Be Done

At this point adding any new PTC regulations for cybersecurity is going to be difficult. No agency has specific authority to issue such regulations and after recently extending the PTC implementation deadline, Congress is unlikely to provide specific regulatory authority. Unless, of course, we have a railroad hacking event of sufficient magnitude that the public and political outcry forces Congress to over-react.

It is probably too late at this point to include secure design requirements in any cybersecurity legislation. New equipment and system modifications could be addressed at this point, but most of the system design and much of the hardware acquisition has already taken place, so the secure design benefits would be somewhat lessened.

All of the other security measures discussed above, however, could be added onto the PTC systems already in place. They would go a long way to preventing the sorts of problems we have seen to date with security reporting. They would also provide for early detection of hacking attempts that could certainly prevent both intended and unintended railroad accidents resulting from such hacking attempts. That early detection and accident prevention fits well into the whole concept of positive train control.

S 301 Introduce – PTC Revisions

Back on February 8th, Sen. Hutchison (R, TX) introduced S 301, a bill that would make “technical and minor modifications to the positive train control requirements under chapter 201”. This bill, with its ‘minor modifications’ could have serious implications for the profitability of railroads and routing decisions Class 1 railroad make for toxic inhalation hazard chemicals.

Background

I looked at the TIH-PTC issue in a blog posting almost two years ago for the NPRM for the PTC rule. One of the key components of the PTC rule is that Class I railroads need to install this expensive safety equipment on lines with significant TIH shipping traffic. There has been some concern expressed that TIH routings would be changed to reduce the number of track miles that would have to be equipped with PTC equipment, routing changes that would disregard other safety and security considerations.

Congress dealt with this concern in their legislation mandating PTC installation by setting the route determinations as those that were in place in 2008. If TIH cars were shipped on rail lines then, those lines would have to have PTC installed. There were provisions requiring new TIH lines added to the PTC requirement, but no provisions were made for not including 2008 TIH lines that no longer had such shipments because of safety/security rerouting decisions ‘mandated’ (suggested would probably be a better term) by TSA.

When the PTC NPRM was published the rail industry objected to the 2008 cut-off, noting that they would be required to ‘waste’ money installing PTC on lines where it wasn’t really required. The FRA response in the final rule preamble was essentially that there hands had been tied by Congress; they were the ones that set the 2008 rule.

S 301 Provisions

Sen. Hutchison’s bill would address that issue by setting December 31st, 2015 as the date which would be used to determine which lines would have to be updated to PTC standards; this is the date by which the railroads would have to have their PTC systems installed. The amount of wording changed (this is only a two page bill – which may explain why it took the GPO so long to get it posted to their web site – minor sarcasm alert) may qualify as a minor change, but the cost and safety implications are anything but minor.

Practical Effects of this Bill

The railroads certainly have financial justification for not wanting to install any more of the PTC equipment than they have to. Congress agreed with this concern by limiting the application of PTC to the most potentially dangerous stretches of the Class I railroad lines. One of the key metrics used by Congress in establishing that potential danger was the presence of TIH shipments; Congress clearly decided that PTC was not cost effective enough to be placed on all rail lines. From the political point of view, given that earlier decision, this bill makes good sense.

From the point of view of safety and security we have to remember that most major rail lines historically run through major urban areas, particularly west of the Appalachians. The reason is that cities grew up around the railroads and the major rail yards. To go around these urban areas, then, requires traveling extra miles. The added cost for installing PTC systems on those added miles will be quite high. So railroads would prefer to PTC the shorter routes.

What this means is that the routes through cities become favored routes for shipping TIH chemicals. This is exactly the opposite of what many safety and security advocates have been fighting for. Keeping TIH rail cars out of major urban areas significantly reduces the risk of accident or terrorist attack.

If we had real security routing rules for TIH chemicals this bill would be of little consequence to safety or security. The security rules would dictate the TIH routing decisions and this bill would allow railroads to save money by not installing ‘wasted’ PTC equipment on lines without significant TIH shipments.

Unfortunately, the security rule is so weak as to be only a paper drill. It is not a serious impediment to any TIH routing the railroads would make for whatever reason. In that situation the effects of this bill will be to drive more TIH shipments over the shorter mileage routes through major urban areas.

PTC Final Rule Nears Release

The Positive Train Control (PTC) final rule was approved by the Office of Management and Budget (OMB), last week. This is one of the last administrative hurdles that a final rule has to clear before it is published in the Federal Register. The only thing left to do is to complete any corrections or updates required by OMB. The final rule will likely be published this month. While the PTC rule is not really a hazardous material regulation (HMR), it will certainly affect the rail shipments of poison inhalation hazard (PIH) chemicals. The pending regulations have already been used by the Union Pacific Railroad to justify drastically increased rates for shipping railcars of chlorine in a pending case before the Surface Transportation Board (STB). The requirement for railroads to install expensive automated train controls on lines over which significant amounts of PIH chemicals travel will certainly increase operating costs for those railroads. If the railroads are allowed to pass those costs directly to PIH shippers (certainly an economically justifiable move), this could result in a dramatic reduction in the amount of these chemicals shipped by rail over certain routes. Whether this will be the result of end users switching to newly cheaper alternative chemicals, or producers switching to newly cheaper alternative transportation remains to be seen.

Positive Train Control Systems

Earlier this week the Federal Railroad Administration (FRA) published a notice of proposed rule making implementing the Positive Train Control (PTC) Systems requirements set forth in the Railroad Safety Improvement Act (RSIA) of 2008 (Public Law 110–432). While this is a highly technical proposed regulation primarily affecting the railroad industry, it has the potential for directly affecting the shipment of TIH chemicals by rail and rail-rerouting plans. I’ll address these issues in a later blog. Comments may be submitted electronically at www.Regulations.gov (Docket No. FRA-2008-0132). Comments should be submitted by August 20th, 2009 though comments received after that may still be considered. Public Hearing The FRA also announced a public hearing concerning this NPRM. The hearing will be held in Washington, D.C. on August 13th. The meeting will last all day (9 a.m. to 6 p.m.). Written notification of intent to present oral testimony at the hearing should be faxed to the FRA Docket Clerk at (202) 493-6068 or sent by mail to:

FRA Docket Clerk Office of Chief Counsel Federal Railroad Administration 1200 New Jersey Ave. SE.,RCC-10, Stop 10 Washington, DC 20590

Notification should identify the party the person represents, the particular subject(s) the person plans to address, and the time requested. The notification should also provide the Docket Clerk with the participant's mailing address, other contact information and three copies of the oral statement to be presented.