E8-27287. Rail Transportation Security

AGENCY:

Transportation Security Administration, DHS.

ACTION:

Final rule.

SUMMARY:

The Transportation Security Administration (TSA) issues this final rule to enhance the security of our Nation's rail transportation system. This rule establishes security requirements for freight railroad carriers; intercity, commuter, and short-haul passenger train service providers; rail transit systems; and rail operations at certain, fixed-site facilities that ship or receive specified hazardous materials by rail. This rule codifies the scope of TSA's existing inspection program and requires regulated parties to allow TSA and Department of Homeland Security (DHS) officials to enter, inspect, and test property, facilities, conveyances, and records relevant to rail security. This rule also requires that regulated parties designate rail security coordinators and report significant security concerns.

This rule further requires that freight rail carriers and certain facilities handling specified hazardous materials be able to report location and shipping information to TSA upon request and implement chain of custody requirements to ensure a positive and secure exchange of specified hazardous materials. TSA also clarifies and amends the sensitive security information (SSI) protections to cover certain information associated with rail transportation.

DATES:

This final rule is effective December 26, 2008.

FOR FURTHER INFORMATION CONTACT:

For questions related to freight rail security: Scott Gorton, Transportation Sector Network Management, Freight Rail Security, TSA-28, Transportation Security Administration, 601 South 12th Street, Arlington, VA 22202-4220; telephone [phone]; facsimile [phone]; e-mail [e-mail].

For questions related to passenger rail security: Morvarid Zolghadr, Mass Transit and Passenger Rail Security, TSA-28, Transportation Security Administration, 601 South 12th Street, Arlington, VA 22202-4220; telephone [phone]; e-mail [e-mail].

For legal questions: David H. Kasminoff, Office of Chief Counsel, TSA-2, Transportation Security Administration, 601 South 12th Street, Arlington, VA 22202-4220; telephone [phone]; facsimile [phone]; e-mail [e-mail].

For questions related to SSI: Andrew E. Colsky, Office of the Special Counselor, SSI Office, TSA-31, Transportation Security Administration, 601 South 12th Street, Arlington, VA 22202-4220; telephone [phone]; facsimile [phone]; e-mail [e-mail].

SUPPLEMENTARY INFORMATION:

Availability of Rulemaking Document

You can get an electronic copy of this rulemaking document by—

(1) Searching the Department of Transportation's electronic Docket Management System (DMS) Web page at http://dms.dot.gov/​search;​;

(2) Visiting the Department of Transportation's Docket Operations facility located at 1200 New Jersey Avenue, SE., West Building, Ground Floor, Room W12-140, Washington, DC 20590. The facility is open from 9 a.m. to 5 p.m., Monday through Friday, excluding legal holidays. The Docket Operations telephone number is [phone];

(3) Accessing the Government Printing Office's Web page at http://www.gpoaccess.gov/​fr/​index.html;​; or

(4) Visiting TSA's Security Regulations Web page at http://www.tsa.gov and accessing the link for “Research Center” at the top of the page.

In addition, copies are available by writing or calling one of the individuals in the FOR FURTHER INFORMATION CONTACT section. When making such a request, please identify the docket number of this rulemaking.

Small Entity Inquiries

The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 1996 requires TSA to comply with small entity requests for information and advice about compliance with statutes and regulations within TSA's jurisdiction. Any small entity that has a question regarding this document may contact one of the persons listed in the FOR FURTHER INFORMATION CONTACT section. Persons can obtain further information regarding SBREFA on the Small Business Administration's (SBA) Web page at http://www.sba.gov/​advo/​laws/​law_​lib.html.

Abbreviations and Terms Used in This Document

AAR—Association of American Railroads

AEI—Automatic Equipment Identification

ASLRRA—American Short Line & Regional Railroad Association

Amtrak—National Railroad Passenger Corporation

CFATS—Chemical Facility Anti-Terrorism Standards

CVI—Chemical-terrorism Vulnerability Information

DOD—Department of Defense

DOE—Department of Energy

DOT—Department of Transportation

EPA—Environmental Protection Agency

FIPS201—Federal Information Processing Standards Publication 201

FRA—Federal Railroad Administration

FRFA—Final Regulatory Flexibility Analysis

FSO—Facility Security Officer

FTA—Federal Transit Administration

FTE—Full Time Equivalent

GPS—Global Positioning System

HMR—Hazardous Materials Regulations

HSPD—Homeland Security Presidential Directive

HTUA—High Threat Urban Area

IED—Improvised Explosive Device

MOU—Memorandum of Understanding

MTSA—Maritime Transportation Security Act

NAICS—North American Industry Classification System

NRC—Nuclear Regulatory Commission

OA—State Safety Oversight Agency

PCII—Protected Critical Infrastructure Information

PHMSA—Pipeline and Hazardous Materials Safety Administration

PIH—Poisonous by Inhalation or Poison Inhalation Hazard (materials) (PIH is another term for TIH)

RSC—Rail Security Coordinator

SBA—Small Business Administration

SD—Security Directive

SGI—Safeguards Information Program

SSI—Sensitive Security Information

STB—Surface Transportation Board

TIH—Toxic Inhalation Hazard (TIH is another term for PIH)

Outline of Final Rule Preamble

I. Background and Summary of the Final Rule

A. Summary of the Rule

B. Purpose of the Rule

C. Changes From the NPRM

II. Overlap Between TSA's Rule and Other DHS Regulations

III. Rail Security-Sensitive Materials

IV. Public Comments on the NPRM and TSA Responses on Regulatory Provisions

A. Summary

B. Specification of Hazardous Materials

C. Rail Security Coordinators

D. Inspection Authority

E. Reporting Significant Security Concerns

F. Sensitive Security Information

G. Chain of Custody and Control

H. Location and Shipping Information for Certain Rail Cars

I. Whistleblower Protection for Employees

J. Preemption

K. Comments on the Regulatory Impact Assessment

L. Comments Beyond the Scope of the Rulemaking

V. Rulemaking Analyses and Notices

A. Executive Order 12866 Assessment (Regulatory Planning and Review)

B. Regulatory Flexibility Act Assessment

C. Paperwork Reduction Act

D. International Trade Impact Assessment

E. Unfunded Mandates Reform Act Analyses

F. Executive Order 13132 (Federalism)

G. Environmental Analysis

H. Energy Impact Analysis

I. Background and Summary of This Final Rule

A. Summary of This Rule

TSA's final rule applies several general requirements to all freight and passenger railroad carriers, certain facilities that ship or receive specified hazardous materials by rail, and rail transit systems:

• Rail Security Coordinator. Covered entities must designate a rail security coordinator (RSC) and at least one alternate RSC to be available to TSA on a 24-hour, seven days per week basis to serve as the primary contact for receipt of intelligence information and other security-related activities.
• Reporting. Covered entities must immediately report incidents, potential threats, and significant security concerns to TSA.
• TSA Inspection. Covered entities must allow TSA inspectors, and DHS officials working with TSA, to enter and conduct inspections, copy records, perform tests, and conduct other activities necessary to carry out TSA's statutory responsibilities.
• Sensitive Security Information (SSI). This rule clarifies and extends the protection afforded to SSI in rail transportation and further identifies covered persons to include railroad carriers; certain facilities that ship or receive specified hazardous materials by rail; transit systems; and State, local, and tribal employees, contractors, and grantees.

The rule also applies additional requirements to freight railroad carriers and certain facilities that ship or receive specified hazardous materials by rail:

• Location and Shipping Information. Covered entities must provide to TSA, upon request, the location and shipping information of rail cars within their physical custody or control that contain a specified category and quantity of hazardous material. Class I freight railroad carriers must provide the information to TSA no later than five minutes (for one car) or 30 minutes (for two or more cars) after receiving the request. Other railroad operators and rail hazardous materials shipper and receiver facilities must provide the information for one or more cars within 30 minutes after receiving the request.
• Chain of Custody and Control. Covered entities must provide for a secure chain of custody and control of rail cars containing a specified quantity and type of hazardous material.

As TSA specified in its Notice of Proposed Rulemaking (NPRM) for this rulemaking (see 71 FR 76852, December 21, 2006), chain of custody and location requirements apply to specified quantities of three categories of hazardous materials based on the Department of Transportation's (DOT's) Hazardous Materials Regulations (HMR) (49 CFR parts 171-180):

(1) A rail car containing more than 2,268 kg (5,000 lbs) of a Division 1.1, 1.2, or 1.3 (explosive) material, as defined in 49 CFR 173.50;

(2) A tank car containing a material poisonous by inhalation (PIH) as defined in 49 CFR 171.8, including anhydrous ammonia, Division 2.3 gases poisonous by inhalation as set forth in 49 CFR 173.115(c), and Division 6.1 liquids meeting the defining criteria in 49 CFR 173.132(a)(1)(iii) and assigned to hazard zone A or hazard zone B in accordance with 49 CFR 173.133(a), excluding residue quantities of these materials; and

(3) A rail car containing a highway route-controlled quantity of a Class 7 (radioactive) material, as defined in 49 CFR 173.403.

Appendix B to part 1580 of Title 49 of the Code of Federal Regulations, reproduced as Table 1 below, presents a brief summary of the security measures required for the different categories of rail transportation entities that this final rule governs.

Table 1—TSA Rail Security Final Rule Summary

Security measure and rule section	Freight railroad carriers NOT transporting specified hazardous materials	Freight railroad carriers transporting specified hazardous materials (§ 1580.100(b))	Rail operations at certain facilities that ship (i.e., offer, prepare, or load for transportation) hazardous materials	Rail operations at certain facilities that receive or unload hazardous materials within an HTUA	Passenger railroad carriers and rail transit systems	Certain other rail operations (private, business/office, circus, tourist, historic, excursion)
Allow TSA to inspect (§ 1580.5)	X	X	X	X	X	X
Appoint rail security coordinator (§ 1580.101 freight; § 1580.201 passenger)	X	X	X	X	X	(1)
Report significant security concerns (§ 1580.105 freight; § 1580.203 passenger)	X	X	X	X	X	X
Provide location and shipping information for rail cars containing specified hazardous materials if requested (§ 1580.103)		X	X	X
Chain of custody and control requirements for transport of specified hazardous materials that are or may be in an HTUA (§ 1580.107)		X	X	X
1 Only if notified in writing that a security threat exists.

B. Purpose of the Rule

In developing this rule, TSA identified and addressed threats to rail transportation. With respect to passenger rail, TSA recognizes that passenger railroad carriers, commuter operations, and subway systems are high consequence targets in terms of potential loss of life and economic disruption. They carry large numbers of people in a confined environment, offer the opportunity for specific populations to be targeted at particular destinations, and often have stations located below or adjacent to high profile government buildings, major office complexes, and iconic structures. Terrorist bombings since 1995 highlight the need for improved government access to, and monitoring of, transportation of passengers by rail. Terrorists have attacked the Tokyo subway system (1995); areas in and around the Moscow subway system (2000, 2001, and 2004); Madrid commuter trains (2004); the London Underground system (2005); and the train system in Mumbai (formerly known as Bombay), India (2006).

TSA is also considering the threats that face freight rail transportation. Due to the open infrastructure of the rail transportation system, freight trains can be particularly vulnerable to attack. Currently, rail carriers and shippers lack positive chain of custody and control procedures for rail cars as they move through the transportation system (e.g., as entities load the rail cars at originating facilities, as carriers transport the cars over the tracks, and as entities unload the cars at receiving facilities). This can present a significant vulnerability. Whenever entities stop rail cars in transit and interchange them without appropriate security measures, it creates security vulnerabilities. Freight trains transporting hazardous materials are of even more concern, because an attack on those trains (e.g., through the placement of improvised explosive devices (IEDs) ^[1] or other forms of sabotage) could result in the release of hazardous materials.

TSA's NPRM proposed a number of measures to improve the security of freight rail and passenger rail, including rail transit. It also proposed security requirements for shippers and receivers of certain hazardous materials. This final rule adopts most of the provisions of the NPRM. TSA presented its rationale for each element of the NPRM in Section III of the preamble to the NPRM. 71 FR at 76861-76866. TSA describes the differences between the NPRM and this final rule in Section I.C of this preamble. TSA presents a summary of the public comments and responses in Section V of this preamble.

TSA's final rule adopts a risk-based approach by focusing on shipments of certain hazardous materials and establishing chain of custody and control procedures and other measures for rail cars that pose the greatest security vulnerabilities. While an IED attached to any rail car (such as a car transporting coal or household appliances) would obviously cause major damage to that car and its contents upon detonation, the more likely scenario is that terrorists would target a rail car containing highly toxic, explosive, or radioactive hazardous materials, which would cause the greatest loss of life and property and damage to the national economy.

To determine which hazardous materials to identify in the proposed regulation, TSA considered the hazardous materials for which security plans are required as specified in 49 CFR Part 172, Subpart I. (These requirements were included in a final rule adopted by the Pipeline and Hazardous Materials Safety Administration (PHMSA) under Docket Number HM-232.^[2] ) From the list of materials in 49 CFR 172.800(b), TSA identified three categories ^[3] of hazardous materials that pose the greatest transportation security risk—materials that are poisonous by inhalation (PIH),^[4] explosive, and radioactive. In the NPRM, TSA proposed to apply specific requirements to certain carriers and facilities that handle these materials. This final rule focuses on the same materials.

Each of these three categories of hazardous materials presents serious security risks. The release of PIH materials in a densely populated urban area would have catastrophic consequences. Such a release would endanger significant numbers of people. The consequences of an accidental PIH release in a rural area were seen in the January 6, 2005 rail accident in Graniteville, South Carolina. A Norfolk Southern Railway Company (NS) freight train carrying chlorine was improperly diverted from the main track onto a rail spur. The train struck a standing train on the rail spur, derailing three locomotives and sixteen rail cars and rupturing a single tank car carrying chlorine. Even in this sparsely populated area, the collision resulted in fatal injuries to eight residents and one railroad employee, injuries to 630 people, and the evacuation of 5,400 local residents. The property damage, including damages to the rolling stock and track, exceeded $6.9 million. While the accident was not the result of a terrorist attack, it nonetheless illustrates the danger of transporting PIH materials and the damage that can result from a release.

Although the number of rail shipments carrying explosives and radioactive materials is relatively low, a release of these materials could cause serious and devastating harm. If terrorists detonated certain explosives ^[5] at critical points in the transportation cycle, they could cause significant loss of life and damage to infrastructure, and harm the national economy through the accompanying disruption to commerce. Likewise, if terrorists perpetrated an attack against a rail car transporting certain radioactive materials,^[6] they could endanger a significant number of people as well as disrupt the supply chain as a result of contamination.

This final rule addresses the above-identified threats to rail transportation in several ways. This rule codifies the authority for TSA inspections, requires the designation of a rail security coordinator (RSC), and requires the reporting of significant security concerns by most entities to which the rule is applicable. These requirements will improve TSA's ability to inspect rail operations and communicate with railroads and rail facilities. Through these mechanisms, TSA and DHS will obtain better information and monitoring capabilities concerning potential transportation security incidents involving rail transportation and travel. Also, this final rule's requirements related to hazardous materials, such as additional monitoring and protection of certain rail cars and increased availability of location and shipping information for certain rail cars, will decrease the vulnerabilities of these hazardous materials shipments to attack.

TSA has legal authority to impose these requirements. Under the Aviation and Transportation Security Act (ATSA) ^[7] and delegated authority from the Secretary of Homeland Security, TSA has broad responsibility and authority for “security in all modes of transportation * * * including security responsibilities * * * over modes of transportation that are exercised by the Department of Transportation.” ^[8] TSA has authorities in addition to those transferred from DOT.^[9] TSA is empowered to develop policies, strategies, plans, and regulations for dealing with threats to all modes of transportation. As part of its security mission, TSA is responsible for assessing intelligence and other information to identify individuals who pose a threat to transportation security and to coordinate countermeasures with other Federal agencies to address such threats.^[10] TSA enforces security-related regulations and requirements,^[11] ensures the adequacy of security measures for the transportation of cargo,^[12] oversees the implementation and ensures the adequacy of security measures at transportation facilities,^[13] and carries out other appropriate duties relating to transportation security.^[14] TSA has broad regulatory authority to achieve ATSA's objectives, and may issue, rescind, and revise such regulations as are necessary to carry out TSA functions.^[15] TSA is also charged with serving as the primary liaison for transportation security to the intelligence and law enforcement communities.^[16]

TSA's authority with respect to transportation security is comprehensive and supported with specific powers related to the development and enforcement of regulations, security directives (SDs), security plans, and other requirements. Accordingly, under this authority, TSA may assess a security risk for any mode of transportation, develop security measures for dealing with that risk, and enforce compliance with those measures.

The Federal hazardous materials transportation law (Federal hazmat law, 49 U.S.C. 5101 et seq.), authorizes the Secretary of DOT to “prescribe regulations for the safe transportation, including security, of hazardous material in intrastate, interstate, and foreign commerce.” The Secretary of DOT has delegated this authority to PHMSA. Under the mandate in § 5103(b), PHMSA promulgated the HMR (49 CFR parts 171-180), which govern safety aspects, including security, of the transportation of hazardous material the Secretary of DOT considers appropriate. In accordance with its security authority, in March 2003, PHMSA adopted new transportation security requirements for offerors and transporters of certain classes and quantities of hazardous materials and new security training requirements for hazardous materials employees. The security regulations require offerors and carriers to develop and implement security plans and to train their employees to recognize and respond to possible security threats.

On August 9, 2006, DOT/PHMSA and DHS/TSA signed an annex to the September 28, 2004, “Memorandum of Understanding Between the Department of Homeland Security and the Department of Transportation on Roles and Responsibilities” (DHS-DOT MOU).^[17] The purpose of the annex is to delineate clear lines of authority and responsibility, promote communication and efficiency, and avoid duplication of effort through cooperation and collaboration in the area of hazardous materials transportation security based on existing legal authorities and core competencies. The annex acknowledges that DHS has lead authority and primary responsibility for security activities in all modes of transportation and notes that TSA is the lead Federal entity for transportation security.

Similarly, on September 28, 2006, DOT's Federal Railroad Administration (FRA) and TSA signed an annex to the DHS-DOT MOU to address each agency's roles and responsibilities for rail transportation security. The FRA-TSA annex recognizes that TSA is the lead Federal entity for transportation security in general and rail security in particular. Concerning safety, the FRA-TSA annex recognizes that FRA has authority over every area of railroad safety (including security) and that FRA enforces PHMSA's HMR. The FRA-TSA annex includes procedures for coordinating: (1) Planning, inspection, training, and enforcement activities; (2) criticality and vulnerability assessments and security reviews; (3) communication with affected stakeholders; and (4) the use of personnel and resources. Copies of the two annexes are available for review in the public docket for this rulemaking. Consistent with the principles outlined in the PHMSA-TSA and FRA-TSA annexes, PHMSA and FRA collaborated with TSA to develop this final rule.

On April 16, 2008, PHMSA published an interim final rule in the Federal Register to revise the current requirements in the HMR applicable to the safe and secure transportation of hazardous materials transported in commerce by rail. 73 FR 20752. Specifically, PHMSA adopted the following:

• Rail carriers transporting certain explosives, PIH material, and radioactive materials must compile information and data on the commodities transported, including the transportation routes over which they transport these commodities.
• Rail carriers transporting the specified hazardous materials must use the data they compile on commodities they transport to analyze the safety and security risks for the transportation routes used and all practicable alternative routes to the one used. Rail carriers must utilize these analyses to make transportation decisions that result in the transportation of these materials over the safest and most secure commercially practicable routes posing the least overall safety and security risks.
• Rail carriers must specifically address the security risks associated with shipments delayed in transit or temporarily stored in transit as part of their security plans.
• Rail carriers transporting covered hazardous materials must notify consignees if there is a significant unplanned delay affecting the delivery of the hazardous material.
• Rail carriers must work with shippers and consignees to minimize the time a rail car containing one of the specified hazardous materials is placed on track awaiting pick-up or delivery or transfer from one carrier to another.
• Rail carriers must conduct visual security inspections at ground level of rail cars containing hazardous materials to inspect for signs of tampering or the introduction of an IED.

C. Changes From the NPRM

This section summarizes the regulatory text changes that TSA has made to the NPRM in this final rule. In addition to the summary contained in this section, in many cases TSA has provided a more extensive discussion of the change, and the reason for the change, in the response to comments below. See Section IV “Public Comments on the NPRM and TSA Responses on Regulatory Provisions.” Finally, to the extent TSA has made technical corrections or corrected typographical errors, we do not specifically discuss them.

1. Sensitive Security Information

TSA has revised paragraph (b)(15) of 49 CFR 1520.5 to add rail to the categories of research and development information related to transportation security activities that is protected as SSI. TSA has revised paragraph (b) of 49 CFR 1520.11 to add State, local, and tribal government employees, contractors, and grantees to the list of persons with a potential need to know SSI. TSA made this change to be consistent with DHS policy on information sharing and allow States, localities and tribal governments, and their contractors and grantees, to have access to SSI if the information is needed for the performance of official duties, such as the prevention or mitigation of security incidents, contracts, or grants.

2. Rail Security-Sensitive Materials

This final rule defines the term “rail security-sensitive materials” to mean one or more of the categories and quantities of the materials set forth in the new § 1580.100(b), the transportation of which requires the operators to carry out the security measures in this rule. TSA has introduced this term to comply with §§ 1501(13) and 1551 of the “Implementing the Recommendations of the 9/11 Commission Act of 2007” (9/11 Commission Act).^[18] Section 1501(13) defines “security-sensitive material” to mean a material or group of materials, in a particular quantity and form that the Secretary of Homeland Security, in consultation with the Secretary of Transportation, determines through rulemaking with opportunity for public comment, poses a significant risk to national security while being transported in commerce. Section 1551 directs the Secretary of Transportation, in consultation with the Secretary of Homeland Security, to publish a final rule based on the PHMSA NPRM published on December 21, 2006.^[19] That section directs the Secretary of Transportation to ensure that the PHMSA final rule requires railroad carriers of “security-sensitive materials” to “select the safest and most secure route to be used in transporting” those materials and to select such route based on the railroad carrier's analysis of the safety and security risks on primary and alternate transportation routes over which the carrier has authority to operate.

Through this Rail Transportation Security rulemaking, TSA has provided the public with an opportunity to comment on its identification of security-sensitive materials in the rail sector. See Section III of this preamble. TSA has added the term “rail security-sensitive material” to 49 CFR 1580.3 to denote that the Secretary of Homeland Security has determined that the categories and quantities of hazardous materials set forth in 49 CFR 1580.100(b) pose a significant risk to national security while being transported in commerce by rail due to the potential use of one or more of these materials in an act of terrorism. TSA has therefore concluded that these categories and quantities of hazardous materials constitute “security-sensitive material” for purposes of triggering the railroad routing requirements in § 1551 of the 9/11 Commission Act.

3. Inspection Authority

In response to commenters who expressed concerns about verifying the identity and credentials of TSA inspectors, TSA has added a new paragraph (d) to 49 CFR 1580.5. It provides that TSA inspectors, and DHS officials working with TSA, will present their credentials for examination, at the request of the entity being inspected, with the understanding that the credentials may not be reproduced. Any regulated party wishing to authenticate the identity of an individual purporting to represent TSA may contact the Freedom Center at 703-563-3240 or 1-877-456-8722.^[20]

4. Reporting Significant Security Concerns

In the NPRM, TSA stated that reports of potential threats and significant security concerns to DHS would be required “in a manner prescribed by TSA.” See 49 CFR 1580.105(b) and 1580.203(b). In this final rule, TSA has revised paragraph (b) of each section to indicate that the regulated parties must make the required reports by telephoning the Freedom Center at 703-563-3240 or 1-877-456-8722.

5. Chain of Custody and Control Requirements

Some commenters asked TSA to explain the concept of “attending a rail car” in the context of complying with the requirement in paragraphs (c) and (d) of 49 CFR 1580.107 “to ensure that the rail car is not left unattended at any time during the physical transfer of custody.” One commenter asked if “maintain[ing] positive control of the rail car” for purposes of 49 CFR 1580.107(f)(1) was merely synonymous with a prohibition against unattended pick up and delivery. In response, TSA has added a new paragraph (k) to 49 CFR 1580.107 to explain the terms “attended” and “maintains positive control.” As used in § 1580.107, a rail car is “attended” if an employee or authorized representative of the freight railroad carrier: (1) Is physically located on site in reasonable proximity to the rail car; (2) is capable of promptly responding to unauthorized access or activity at or near the rail car, including immediately contacting law enforcement or other authorities, and (3) immediately responds to any unauthorized access or activity at or near the rail car either personally or by contacting law enforcement or other authorities. Electronic monitoring is permitted so long as the responsible party is located on site and can accomplish an equivalent level of surveillance, response, and notification. Attending a rail car is a component part of maintaining positive control. As used in § 1580.107, when the rail hazardous materials receiver and freight railroad carrier communicate and cooperate with each other to ensure the security of the rail car during the physical transfer of custody, they are “maintaining positive control” of the car.

TSA has also included an explanation in paragraph (k) of the term “document the transfer.” As used in § 1580.107, a transfer of physical custody of a rail car is properly documented, either in writing or electronically, when the documentation contains, at a minimum: (1) The car's initial (also known as the reporting mark) and number; (2) the names or employee numbers of the individuals who attended the transfer; (3) the location where the transfer took place; and (4) the date and time the transfer was completed.

6. Location and Shipping Information for Certain Rail Cars

In the NPRM, TSA proposed a one-hour timeframe for freight railroad carriers, rail hazardous materials shippers, and rail hazardous materials receivers to report the location and shipping information to TSA or other DHS officials for a specified rail car(s). However, in recognition of the fact that such information is critical to addressing specific security threats or incidents, TSA sought comment on the feasibility of a shorter timeframe, such as five minutes or thirty minutes. Based upon comments received and TSA's understanding of the technological capabilities of the regulated parties, we have changed the reporting timeframe in 49 CFR 1580.103 by revising paragraph (d) and adding a new paragraph (e). Paragraph (d) requires all Class I freight railroad carriers subject to § 1580.103 to provide location and shipping information to TSA within five minutes if the request concerns only one car and within thirty minutes if the request concerns two or more rail cars. Paragraph (e) requires all other entities subject to § 1580.103 to provide the information to TSA within thirty minutes, regardless of how many rail cars the request concerns. TSA has also added a new paragraph (h) to § 1580.103 to indicate that TSA has adopted the same definition of “Class I carrier” as used by the Surface Transportation Board (STB). See 49 CFR part 1201, General Instructions 1-1.

The NPRM would have required each regulated party to develop procedures for determining location and shipping information, if requested by TSA, for covered rail cars under their physical custody and control, but the NPRM did not propose to require the regulated party to provide TSA with a contact telephone number to use when requesting this information. TSA has added a new paragraph (g) to § 1580.103, requiring each regulated party to provide TSA with a telephone number that is monitored by a live person on a 24-hours a day, seven days a week basis. This will assure a prompt response on those occasions when TSA needs information.

7. Harmonization of Federal Regulation of Nuclear Facilities

TSA recognizes that its statutory authorities and obligations may extend to facilities involved in the production and utilization of nuclear materials or weapons already subject to safety, security, and inspection requirements imposed by the Nuclear Regulatory Commission (NRC) and the Department of Energy (DOE). To ensure that regulated entities are not subject to duplicative or conflicting regulatory or inspection requirements, TSA has included section 1580.111 of the regulations, which states that TSA will coordinate activities under this subpart with the NRC and DOE with respect to regulation of rail hazardous materials shippers and receivers that are also licensed or regulated by the NRC or DOE under the Atomic Energy Act of 1954, as amended, to maintain consistency with the requirements imposed by the NRC and DOE. TSA will enter into appropriate agency-to-agency agreements with the NRC and DOE to carry out section 1580.111.

II. Overlap Between TSA's Rule and Other DHS Regulations

This Rail Transportation Security final rule affects entities that also may be subject to the requirements of other DHS rules—e.g., the DHS Chemical Facility Anti-Terrorism Standards (CFATS) regulation ^[21] and the Coast Guard's Maritime Transportation Security Act (MTSA) ^[22] regulations. This section describes the interrelationships of this rule with the CFATS and MTSA regulations.

Pursuant to § 550 of the Department of Homeland Security Appropriations Act of 2007 (2007 DHS Appropriations Act) (Pub. L. 109-295), which provides DHS with the authority to regulate the security of certain high-risk chemical facilities in the United States, DHS issued an interim final rule on Chemical Facility Anti-Terrorism Standards. See 72 FR 17688 (April 9, 2007). The CFATS rule establishes risk-based performance standards for the security of our Nation's high-risk chemical facilities. It requires facilities that possess specified chemicals at or above specified amounts to provide information to DHS. From this information, DHS will initially determine which facilities are high-risk and preliminarily place high-risk chemical facilities ^[23] in risk-based tiers. Such facilities must then prepare Security Vulnerability Assessments, which identify facility security vulnerabilities, and develop and implement Site Security Plans, which include measures that satisfy the DHS-identified risk-based performance standards. The CFATS rule contains associated provisions addressing inspections and audits, recordkeeping, and protection of information that constitutes Chemical-terrorism Vulnerability Information (CVI).

In the CFATS interim final rule (IFR), DHS recognized that with respect to chemical security, certain aspects of § 550 and TSA's authorities are concurrent and overlapping. In the preamble to the CFATS IFR, DHS stated that it does not presently plan to screen railroad facilities for inclusion in the § 550 program (although DHS reserves the right to reevaluate their possible coverage at a future date). See 72 FR 17698-17699. Nevertheless, it is possible that some chemical facilities will be subject to both CFATS and this TSA final rule. Specifically, it is possible that some facilities, which are rail hazardous materials shippers or receivers as defined in this final rule, may be subject to the CFATS screening requirements and may become covered facilities (i.e., high-risk facilities) under the CFATS rule. In such situations, the facilities will have to comply with the requirements of both regulatory programs (including requirements to provide information under both programs). TSA and DHS, however, will work closely together to ensure that the efforts directed at these facilities are coordinated and consistent.

MTSA requires the Secretary of Homeland Security to issue regulations to strengthen the security of American ports and waterways and the ships that use them. This authority, in addition to other grants of authority, serves as the basis for a comprehensive maritime security regime. Under these authorities, the Coast Guard issued regulations to ensure the security of vessels, facilities, and other elements of the maritime transportation system. Part 105 of Title 33 of the Code of Federal Regulations imposed requirements on a range of maritime facilities, including hazardous material and petroleum facilities and those fleeting facilities that receive barges carrying, in bulk, cargoes regulated by Subchapters D and O of Chapter I, Title 46, Code of Federal Regulations or Certain Dangerous Cargoes.

Pursuant to these maritime security regulations, the Coast Guard requires these facilities to perform security assessments and then, based on these assessments, develop security plans, and implement security measures and procedures in order to reduce the risk of, and to mitigate the results of, any security incident that threatens the facility, its personnel, the public, the environment, and the economy.

A few commenters requested that TSA not apply certain provisions of this final rule to facilities that comply with 33 CFR part 105 of the MTSA regulations. Specifically, commenters requested that TSA exempt these facilities from the Rail Transportation Security rule's requirements for appointing RSCs, for reporting of significant security concerns, and for chain of custody and controls. TSA addresses those specific comments in Section V of this preamble. Generally, however, TSA has decided not to exempt MTSA-regulated facilities from these requirements.

Regulating rail security at maritime facilities is a complex issue, and TSA recognizes that certain aspects of the Coast Guard's maritime security regulations and TSA's authorities are concurrent and overlapping. In some respects, compliance with the Coast Guard regulations and with these regulations can be achieved through the same operational practices. For example, the Facility Security Officer (FSO) can serve as the RSC. Also, the rail secure area required by this rule can be the same area as the restricted area designated in the facility security assessment required by 33 CFR 105.305, so long as the regulated party employs physical security measures to ensure that no unauthorized person gains access to the area. However, to the extent that the two sets of requirements are different to account for mode-specific differences in the security issues being addressed by the Coast Guard and TSA, the facility would have to satisfy both sets of regulatory requirements. TSA and the Coast Guard will work closely together to make sure that the requirements of the two programs are complementary, not inconsistent, with each other.

III. Rail Security-Sensitive Material

As discussed in section I.C.3 of this preamble, § 1501(13) of the 9/11 Commission Act defines the term “security-sensitive material” to mean “a material, or a group or class of material, in a particular amount and form that the Secretary [of Homeland Security], in consultation with the Secretary of Transportation, determines, through a rulemaking with the opportunity for public comment, poses a significant risk to national security while being transported in commerce due to the potential use of the material in an act of terrorism.” In making such a determination, the Secretary of Homeland Security is directed to consider at least the following: (1) Class 7 radioactive materials; (2) Division 1.1, 1.2, and 1.3 explosives; (3) materials poisonous or toxic by inhalation, including Division 2.3 gases and Division 6.1 materials; and (4) a select agent or toxin regulated by the Centers for Disease Control and Prevention (CDC) under 42 CFR part 73.

As discussed in section IV.B of this preamble, DHS and DOT assessed the security vulnerabilities associated with the transportation of different types and classes of hazardous materials before proposing to apply enhanced security requirements for the categories and quantities of explosive, PIH, and radioactive materials specified in proposed § 1580.100(b). TSA sought comment on whether to apply the requirements in this final rule to fewer or additional hazardous materials or to extend the requirements to include tank cars containing residue. TSA also sought comment on whether there are other hazardous materials that could cause significant loss of life, transportation system disruption, or economic disruption and whether TSA should apply the requirements in this final rule to those other materials.

TSA did not propose to include select agents or toxins regulated by the CDC under 42 CFR part 73, because railroads transport few, if any, shipments of these types of materials. Generally, shipments of infectious substances, including select agents and toxins, must be transported quickly from point of origin to destination to prevent degradation of samples that can occur over time and to ensure swift diagnosis and treatment of infectious diseases. For these reasons, highway (for short distances) and air (for longer distances) are the preferred modes of transportation for these materials.

TSA provided notice and invited public comment in the NPRM on the list of materials that the Secretary of Homeland Security is required to consider under § 1501(13) of the 9/11 Commission Act when defining “security-sensitive material.” The hazardous materials set forth in § 1580.100(b) of this final rule constitute the Secretary of Homeland Security's list of “security-sensitive materials” for purposes of rail transportation. See § 1551 of the 9/11 Commission Act. Accordingly, the Secretary of Homeland Security, in consultation with the Secretary of Transportation, has satisfied the requirements of § 1551 with respect to the rail mode of transportation and has determined that “rail security-sensitive materials” are: (1) More than 2,268 kg (5,000 lbs) in a single carload of a Division 1.1, 1.2, or 1.3 explosive; (2) a tank car containing a material poisonous by inhalation, as defined in 49 CFR 171.8, including anhydrous ammonia but excluding residue quantities of these materials; and (3) a highway route-controlled quantity of a Class 7 (radioactive) material, as defined in 49 CFR 173.403.

The list of “rail security-sensitive materials” represents the materials that TSA has determined are appropriate at this time for purposes of this final rule and the PHMSA interim final rule. DHS, in consultation with DOT, will continue to evaluate the transportation security risks posed by all types of hazardous materials and may regulate the transportation by rail of other materials at a later time. TSA notes that although PHMSA must require railroad carriers transporting the categories and quantities of materials identified on the DHS list of “rail security-sensitive materials” to comply with the routing requirements in the PHMSA interim final rule, DOT is not precluded by § 1551 of the 9/11 Commission Act from regulating the railroad routing of additional materials or quantities of materials, such as rail cars transporting residue amounts of hazardous materials.

IV. Public Comments on the NPRM and TSA Responses on Regulatory Provisions

A. Summary

To gain additional commenter input on the proposed rail security requirements, TSA held a public meeting on February 2, 2007 in Arlington, Virginia. Sixty-one persons attended the meeting. The oral presentations given by stakeholders mirrored their written comments. Transcripts from the public meeting are available for review in the public docket for this rulemaking. The public comment period for the NPRM closed on February 20, 2007. TSA received approximately 73 public comments on the NPRM. Comments were submitted by trade associations, individual companies, labor unions, States and localities, and private individuals.

Below is a summary of the public comments and TSA's responses, organized as follows: Section A describes the overall organization of this section of the preamble, and Section B includes comments and responses related to the specification of hazardous materials. Sections C, D, and E include comments and responses on issues that apply to passenger rail (including rail transit), freight rail, and hazardous materials facilities that ship or receive materials by rail. These issues relate to the appointment of an RSC, TSA's inspection authority, and the requirement to report suspicious incidents or activities. Section F includes comments and responses on SSI issues. Sections G and H include comments and responses on issues that relate to freight railroad carriers and hazardous materials facilities that ship or receive materials by rail. Section I includes comments and responses on whistleblower protection. Section J includes comments and responses on preemption. Section K includes comments and responses on the regulatory impact assessment. Section L concerns comments that are beyond the scope of this rulemaking.

B. Specification of Hazardous Materials

As explained in the NPRM, TSA, PHMSA, and FRA have assessed the security vulnerabilities associated with the transportation of different types and classes of hazardous materials. TSA applied enhanced security requirements for certain categories and quantities of hazardous materials (i.e., as specified in proposed § 1580.100(b)) based upon specific railroad transportation scenarios depicting how individuals could deliberately use hazardous materials to cause significant casualties and property damage. 71 FR at 76861. The materials specified in the NPRM present a significant rail transportation security risk and an attractive target for terrorists because of the potential for these materials to be used as weapons of mass effect. The proposed rule excluded tank cars containing only residue quantities of the hazardous material, because TSA concluded that, from a security perspective, the consequences of the release of a residue quantity of a PIH material would be significantly less than the consequences involving a loaded tank car. 71 FR at 76861. TSA sought comment on whether to apply the requirements in the final rule to fewer or additional hazardous materials or to extend the requirements to include tank cars containing residue quantities. TSA also sought comment on whether there are other hazardous materials that could cause significant loss of life, transportation system disruption, or economic disruption and whether TSA should apply the requirements in the final rule to those other materials.

Comments: An association commented that this final rule should not apply to Division 1.3 explosives, which consist of materials such as fireworks, smokeless powder, and rocket motors. The commenter noted that while TSA characterizes Division 1.3 explosives as commodities presenting “a fire hazard and either a minor blast hazard or a minor projection hazard or both, but not a mass explosion hazard” (71 FR at 76861), many commodities present a fire hazard that are not included in the commodities identified by TSA as warranting special security protection.

TSA Response: TSA is retaining Division 1.3 explosives in § 1580.100(b) of the final rule, because these explosive materials in the quantities covered in this rule present a significant security risk in transportation. Although a Division 1.3 explosive presents a minor blast and/or projection hazard, this material is extremely flammable and could be used as a weapon of mass effect. If compromised in transit by detonation or as a secondary explosion to an IED, Division 1.3 explosives could result in substantial damage to people, public and private property, and rail infrastructure.

Comments: A labor union recommended that TSA reduce the 5,000 pound applicability trigger for explosives in § 1580.100(b) to 100 pounds.

TSA Response: TSA has not adopted this recommendation. A low threshold quantity of 100 pounds of explosives, even if compromised or detonated in transit, is unlikely to have the potential to turn the rail shipment into a weapon of mass effect.

Comments: Several commenters expressed some concern that the TSA and PHMSA rail security NPRMs are not consistent in terms of their application to shipments of PIH materials. The PHMSA NPRM applies to bulk quantities of PIH materials. A “bulk quantity” as used in the HMR means a quantity that exceeds 450 L (119 gallons) for liquids, a net mass greater than 400 kg (882 pounds) for solids, or a water capacity greater than 454 kg (1,000 pounds) as a receptacle for gas. See 49 CFR 171.8. Thus, the provisions of the PHMSA NPRM would apply to PIH shipments transported in tank cars, including residue amounts exceeding 119 gallons, and portable tanks and other bulk containers. In contrast, the TSA NPRM would apply to tank cars containing PIH materials but exclude residues. Commenters suggested that the two rules should be applied consistently. They recommended that both final rules adopt the TSA tank-car threshold and exclude residue shipments, because they represent a low security threat.

TSA Response: We believe that there are important distinctions between the quantities of concern from a security perspective and the quantities of concern from a safety perspective. These distinctions account for the differences between the two rules. The amount of residue remaining in a tank car varies, but in most instances, tank car residues will total approximately 1-2 percent of the original amount of material in the tank, or 1,800-3,600 pounds. There are legitimate safety concerns relating to residue quantities even though the target attractiveness from a security standpoint is diminished. PHMSA explains those safety concerns in its rule. With respect to security, the potential consequences of the release of a residue quantity of al PIH material would be significantly less than the consequences of an incident involving a loaded tank car. Therefore, in this final rule, TSA is requiring enhanced security measures for the classes and quantities of PIH materials as proposed in the NPRM (i.e., not tank cars containing residual PIH materials). TSA has determined that residue quantities of PIH materials in bulk packaging shipments do not carry sufficient amounts of security-sensitive materials to warrant the enhanced security measures required by this rulemaking.

Comments: Some commenters were confused as to whether TSA intended anhydrous ammonia to be included as a PIH material for which enhanced security measures are required.

TSA Response: The answer is yes. To ensure that this confusion does not persist, we are specifically adding anhydrous ammonia as an example in § 1580.100(b) of a material covered by the security requirements in this final rule. Commenters are correct that, under the HMR, anhydrous ammonia is classed as a Division 2.2 compressed gas for domestic transportation. However, anhydrous ammonia meets the definition of a material that is poisonous by inhalation under 49 CFR 171.8 of the HMR. That definition includes any material identified as an inhalation hazard by a special provision in column 7 of the 49 CFR 172.10 Hazardous Materials Table. The entry for anhydrous ammonia in the Hazardous Materials Table includes Special Provision 13, which requires the words “Inhalation Hazard” to be entered on shipping papers and marked on packages.

Comments: Some commenters believed that the hazardous materials listed in 49 CFR 1580.100(b) should include other flammable gases and liquids, since those materials could be weaponized, as well as include other materials that could cause serious damage if released into rivers and lakes. One commenter recommended that TSA extend the applicability of this final rule to cover commodities that convert to poisonous gases when they come into contact with water, fire, or acids; this commenter referenced a train derailment that occurred near Superior, Wisconsin on June 30, 1992 in which 73 persons were injured when the contents of one rail car reacted with water and formed a vast vapor cloud.

TSA Response: While TSA agrees that other types of hazardous materials pose certain security risks in rail transportation, the risks are not as great as those posed by the explosive, radioactive, and PIH materials specified in this final rule, and at this time we are not persuaded that they warrant the additional precautions required by this final rule. TSA, in consultation with PHMSA and FRA, will continue to evaluate the rail transportation security risks posed by all types of hazardous materials and the effectiveness of existing Federal regulations in addressing those risks and will consider specific requirements as necessary.

Comments: One commenter requested that TSA revise the applicability language in 49 CFR 1580.100(b)(3) by replacing the threshold limit of “a highway route-controlled quantity of a Class 7 (radioactive) material” with the NRC's published list of Import and Export Threshold Limits for Category 1 and 2 Radioactive Materials. See Appendix P to 20 CFR part 110.

TSA Response: TSA has retained the threshold limits for radioactive materials as proposed in the NPRM. From a security perspective, it appears that the consequences from a release of a radioactive material subject to the lower threshold limits set forth by the NRC would be significantly less than the consequences of an incident using a highway route-controlled quantity of a Class 7 radioactive material.

C. Rail Security Coordinators

Section 1580.101 of the NPRM proposed that freight railroad carriers, rail hazardous materials shippers, and rail hazardous materials receivers within a High Threat Urban Area (HTUA) appoint an RSC, designated at the corporate level, to serve as the primary contact for intelligence information and security-related activities and communications with TSA, and coordinate security practices and procedures with law enforcement and emergency response agencies. Section 1580.201 of the NPRM proposed that passenger railroad carriers and rail transit systems appoint RSCs who would perform the same functions. TSA received numerous comments on the RSC provisions of the NPRM. TSA summarizes those comments and its responses below.

1. The RSC Role Must Be Performed by a Designated Individual

Comments: Several commenters, representing railroad carriers and explosives manufacturers, remarked that many companies already have emergency response and communications systems in place, with some of them following PHMSA's emergency response information requirements.^[24] Some of these commenters urged TSA to allow the use of an emergency contact center number or a 24-hour corporate security number, instead of appointing an RSC.^[25] The commenters stressed that an emergency call center could connect the TSA caller to the appropriate security or response personnel as needed. Further, other commenters thought that having TSA maintain telephone lists of specific individuals named as RSCs does not appear to add value to the regulation.

TSA Response: TSA believes that there is great security value in requiring the appointment of RSCs and in requiring regulated entities to provide contact information for these individuals. The RSC or alternate must serve as the security liaison between the regulated party and TSA. The RSC or alternate provides a primary single point of contact at the corporate level for receiving communications and inquiries from TSA concerning threat information or security procedures and coordinating responses with appropriate law enforcement and emergency response agencies. If TSA needs to convey extremely time-sensitive security information to a regulated party, particularly in situations requiring frequent information updates, it is important for the sake of continuity that TSA be able to interact with a specific individual. The RSC must be in a position to understand security problems, raise issues with corporate leadership, and recognize when emergency response action is appropriate.

TSA has decided not to allow the use of emergency call centers or 24-hour generic contact numbers to substitute for the requirement to designate named individuals to serve as RSCs and alternate RSCs. However, using call centers, in conjunction with appointed RSCs, may be an appropriate way to satisfy the requirements of 49 CFR 1580.101(e)(2) and 1580.201(e)(2). To meet these requirements, the call center or emergency hotline would need to be staffed 24-hours a day, 7 days a week, and must be able to immediately locate and communicate with the RSC.

2. Scope of Section 1580.101

Comments: Several commenters suggested that certain operations do not need RSCs or that individuals performing similar functions for other purposes, such as individuals responsible for security under DHS's CFATS rule, should be able to serve as RSCs.

Some commenters argued that proposed § 1580.101 should not apply to marine terminals because those facilities are regulated under the Coast Guard security requirements. They believed that TSA should exclude “on-dock” rail facilities from the requirement.

Several trade associations stated that § 1580.101 should not apply to a rail hazardous material shipper or receiver that only ships or receives the specified hazardous materials on an occasional basis. One of these commenters noted that many of its members are relatively small operations that may ship or receive tank cars of anhydrous ammonia only once or twice a year. Another association recommended exempting entities that ship or receive less than three rail cars per month.

Two trade associations objected to requiring occasional rail hazardous materials shippers or receivers to have an RSC available 24-hours a day, 7 days a week, 365 days a year, even if the facility has no rail cars in its custody or in transit. Similarly, several commenters argued that TSA should not require the RSC to be available 24-hours a day, 7 days a week for short line railroads that only operate 40 hours per week or for railroads that do not transport hazardous materials.

TSA Response: TSA requires a point of contact for all carriers, regardless of whether they transport hazardous materials, because security concerns may arise that are unrelated to hazardous materials. TSA must be able to communicate as soon as possible with the RSC for all affected freight railroad carriers and rail hazardous materials facilities if TSA needs to convey extremely time-sensitive threat information or security procedures or seek information relating to threats or potential threats.

TSA has also carefully considered the comments concerning freight railroad carriers who rarely transport, and shippers and receivers who rarely ship or receive, rail cars containing the categories and quantities of hazardous materials covered by part 1580. However, TSA has decided not to exempt these entities from the RSC requirements. With respect to infrequent shipments of hazardous materials, the consequences can be significant even if a railroad carrier only transports a single carload or a rail hazardous materials facility only ships or receives a single carload. The January 6, 2005 rail accident in Graniteville, South Carolina resulted in the puncture of a single tank car of chlorine, but the consequences of that accident were substantial.

In the case of rail hazardous materials facilities that are also subject to the maritime security regime required by MTSA, the individual who serves as the FSO may also fulfill the duties of the RSC, provided that the person understands the responsibilities of an RSC as provided in 49 CFR 1580.101. See 33 CFR parts 101-106. However, compliance with MTSA does not itself satisfy the TSA requirement

3. Scope of Section 1580.201

Comments: Some commenters representing passenger railroads suggested that proposed § 1580.201 should not apply to tourist, scenic, historic, and excursion railroad operations. One commenter recommended that TSA exempt the systems unless they operate in an HTUA, while another commenter believed that the requirements would pose an undue burden.

TSA Response: TSA is promulgating the final RSC requirement as proposed. TSA only requires a tourist, scenic, historic, or excursion passenger rail operation, whether on or off the general railroad system of transportation, to designate and use an RSC if TSA informs it in writing that it must do so because of a general or specific threat concerning that operation. An exemption is not appropriate because many tourist, scenic, historic, and excursion operations, though not necessarily operating in areas of high risk, do carry large numbers of people and may become potential terrorist targets.

If the need arises, TSA will inform the carrier of the need for an RSC. In determining whether one or more of these passenger railroad carriers must designate and use an RSC, TSA will consider all available information, including location, populations served, and any intelligence, law enforcement, and reported suspicious activity.

4. Responsibilities of the RSC

Comments: A few commenters asked whether a corporate RSC could serve multiple regulated facilities or operations and whether the individual serving as the RSC may perform other functions. One State agency commenter recommended that the primary and alternate RSCs appointed by passenger railroad operators or mass transit operators should be identified within the existing State Safety Oversight Agency (OA), formed under 49 CFR part 659.

TSA Response: A single RSC or alternate may have responsibility for multiple covered rail facilities that are owned and operated by one corporation, provided that the individual has the information necessary to perform the RSC's duties.

This final rule allows different people to be on call at different times throughout the day, provided that at least one RSC or alternate is available to TSA on a 24-hour, 7 days a week basis. This final rule allows a passenger rail operator to select a qualified individual who also performs job duties for the OA to serve as the RSC.

5. Rail Security Coordinators Identified Previously

Comments: One mass transit agency asked whether a list of security coordinators previously sent to TSA to comply with the rail SDs would satisfy § 1580.201's requirement to appoint an RSC.^[26]

TSA Response: Yes, passenger railroad carriers and rail transit systems that have already provided the required information on their primary and alternate RSCs to TSA have complied with the requirements of § 1580.201. They do not have to take further action unless any of the contact information changes. However, all covered parties, including those passenger railroad carriers and rail transit systems that have already provided the required information, must report all changes to the names, titles, telephone numbers, and e-mail addresses of the RSCs and alternate RSCs to TSA within seven calendar days.

6. Rail Security Coordinator Coordination With State and Local Governments

Comments: Several commenters representing State and local agencies stated that contact information for RSCs should be made available to local governments where hazardous material rail cars may be staged. Another commenter requested that TSA make RSC information available to local emergency planning committees and/or the sheriff's department at all locations where the railroad maintains a switching yard where rail cars containing hazardous materials subject to this final rule may be staged for more than four hours.

TSA Response: When it is necessary and appropriate, TSA will make RSC information available to State and local government agencies for official business purposes, including emergency responders.

7. Rail Security Coordinator Training

In the NPRM, TSA noted that the RSC proposal was crafted as a performance standard, and TSA anticipated that each of the regulated parties would provide its RSC with the information necessary to perform his or her job duties. 71 FR at 76863. However, TSA sought comment on whether to add a training requirement for RSCs in the final rule or via another rulemaking, and requested information on potential training methods.

Comments: TSA received comments both supporting and opposing the inclusion of training standards. Commenters supporting training requirements recommended TSA include standards that were consistent with those that the Coast Guard requires for FSOs under 33 CFR 105.205. Other commenters believed training programs were necessary to ensure a common knowledge base across the industry. For example, The Tri-State Oversight Committee for Maryland, Virginia, and the District of Columbia encouraged TSA to create a national level training program for RSCs and suggested that TSA establish a single training academy where RSCs could network and share best practices, similar to the Federal Transit Administration's (FTA's) workshops for State Safety Oversight personnel. Other commenters stated that training was unnecessary, because railroad personnel already perform similar functions and have been trained to perform them.

TSA Response: TSA has determined not to provide RSC training at this time or to provide specific training standards. To comply with the RSC requirement, the regulated party must ensure that individuals performing RSC duties are available to TSA on a 24-hours a day basis, capable of serving as the primary point of contact with TSA on security matters, and able to coordinate security practices and procedures with appropriate law enforcement and emergency response agencies. To meet the performance standard established for RSCs, TSA expects entities subject to this requirement to provide any necessary training, which may be specific to each entity.

D. Inspection Authority

TSA received numerous comments on many aspects of the inspection provisions of the NPRM. TSA considered all the comments and has decided to make only one minor change to the inspection provisions. Specifically, TSA has added a new paragraph (d) to 49 CFR 1580.5 to state that upon request, TSA inspectors and DHS officials working with TSA will present their credentials for examination, but with the proviso that the credentials may not be photocopied or otherwise reproduced (so as to mitigate the possibility that an inspector's credentials will be duplicated for fraudulent purposes). TSA added this paragraph in response to commenter requests for an authentication process to verify the identity of an individual purporting to represent TSA.

1. Unannounced Inspections

Comments: Section 1580.5(c) of the NPRM codified TSA's authority to “enter, without advance notice * * * any area or within any conveyance * * * in order to inspect or test compliance, or perform other such duties as TSA may direct.” Many commenters objected to this provision, raising the following comments and concerns:

• Unannounced inspections will disrupt ongoing business activities.
• TSA should pre-arrange inspections when practical.
• Employees of railroads and facilities who find TSA inspectors on their premises might view them as a threat and respond by calling law enforcement or security guards.
• The presence of TSA inspectors on rail lines and in operating facilities would be dangerous to TSA employees, rail system or facility employees, and customers. Inspectors should be escorted, qualified, and/or trained to ensure safety. Some commenters recommended specific types of safety training.
• Railroad operators and facility owner/operators may incur liability if TSA inspectors or others are injured.
• TSA inspectors should be required to obtain facility identification media and/or TSA should provide a mechanism through which they can verify the identity of TSA inspectors.
• The rule language is inconsistent with Security Directive RAILPAX-04-01.
• TSA should limit the scope of potential unannounced visits to hazardous materials shipper, railroad carrier, and hazardous materials receiver locations where rail cars containing PIH, explosive, and radioactive materials. are handled

TSA Response:

a. Need to Conduct Unannounced Inspections

TSA has retained the language that it used in the NPRM with respect to conducting inspections within any area or conveyance of a regulated party without providing advance notice. TSA anticipates that in most cases it will notify railroad carriers, rail transit systems, and rail hazardous materials facilities of scheduled inspections. This notice gives the parties to be inspected the opportunity to gather evidence of compliance and to arrange to have the appropriate personnel available to assist TSA. However, inspections related to a particular incident, and inspections that are made without notice, are necessary. Some inspections can only be effective if they are unannounced, so as to determine whether the regulated party is in compliance when it is unaware that TSA may be inspecting. TSA must have the flexibility to respond to information, operations, and specific circumstances whenever they exist or develop. TSA must be able to assess the security of covered parties during all times of the day or night and under all operational situations. Consequently, TSA may have to conduct inspections in the evenings, at night, on weekends, or on holidays. Security concerns are different at different times of the day and on different days of the week, and terrorists may seek to take advantage of vulnerabilities whenever they occur. TSA must be able to assess potential threats and an entity's security measures at any time.

The nature of any given TSA inspection will depend on the specific circumstances surrounding a particular railroad carrier, rail transit system, or rail hazardous materials shipper or receiver's operations at a given point in time and will be considered in conjunction with available threat information. While TSA may choose to notify regulated entities, local emergency responders, or other agencies on a case-by-case basis, TSA is not including a mandatory requirement to notify the regulated party.

We note, too, that many of the locations that TSA may inspect do not have access controls, such as fences or gates. Indeed, in some locations, the general public has easy access to the property. Unannounced TSA inspections of these areas will not require access to controlled areas. Further, TSA's inspection may test the regulated party's ability to detect and respond to the presence of unauthorized individuals.

b. Contacts with Law Enforcement Officials

In response to the commenters who believe that unannounced TSA inspections would create new safety and security risks for TSA inspectors and to other individuals on rail property, TSA recognizes that the presence of a seemingly unauthorized individual on the property of a railroad carrier, rail transit system, or rail hazardous materials facility may result in law enforcement officials being contacted. In the case of announced or planned inspections, TSA has trained its inspectors to identify themselves when they reach the facility to be inspected in order to avoid unnecessary notification of local law enforcement officials. In the case of unannounced inspections where the inspector has not notified any representative of the inspected facility, TSA has trained its inspectors to provide identification upon demand to a representative of the facility.

c. Danger

In response to commenter concerns about their liability in connection with TSA personnel who may be injured on rail property while performing unannounced inspections, we note that we have trained our inspectors on specific safety and security protocols to follow while inspecting the equipment and facilities of a regulated party. In the event that a TSA inspector is either injured or alleged to have caused an injury while on a regulated party's property, we will address the situation in accordance with applicable laws and regulations. By way of example, as a general rule, a TSA employee who sustains injuries while performing official duties is compensated by the Federal Employees Compensation Act (FECA), 5 U.S.C. 8101-8193.^[27] Persons who believe they have a tort claim against the United States may pursue their rights under the Federal Torts Claim Act (FTCA).^[28] See 26 U.S.C. 2671-2680.

d. Relationship to Inspection Authority Pursuant to Security Directives

The American Public Transportation Association (APTA) commented that conducting unannounced inspections is inconsistent with the requirement in SD RAILPAX-04-01 that TSA coordinate inspections with the rail property's designated security coordinator. In response, TSA acknowledges that it is expanding the requirements in the rail SDs. In most cases, TSA inspectors will notify the rail property in advance to schedule an inspection and, to the extent practicable, work in close partnership during the visit with the RSC designated under § 1580.201 or other appropriate official(s) designated by the railroad carrier or rail transit system. However, TSA must be able to make unannounced inspections to check for compliance. To the extent there is ambiguity as to whether TSA inspections, evaluations, and tests to ensure compliance with the rail SDs can only be performed if they are announced and coordinated in advance with the regulated party, TSA notes that the inspection authority set forth in 49 CFR 1580.5 supersedes the provisions in TSA's rail SDs that compliance visits will be coordinated with the Security Coordinator.

e. Training of TSA Inspectors

TSA appreciates that inspectors must be properly trained to avoid danger to themselves, to workers on the inspected property, to travelers, and to the inspected property. TSA intends to use only properly trained personnel to conduct inspections. TSA puts its inspectors through a rigorous training program, incorporating classroom and field training, so that inspectors are knowledgeable on all aspects related to this regulatory program as well as on safety issues. TSA inspectors receive training on specific safety procedures to use while inspecting the equipment and facilities of freight and passenger railroad carriers, transit system owners and operators, and rail hazardous materials facilities, including the Transportation Safety Institute's Transportation of Hazardous Materials course covering 49 CFR parts 100-185. Many of TSA's inspectors have backgrounds in law enforcement and physical security and are subject matter experts in the field of railroad transportation, including the transportation of hazardous materials. In addition, all DHS officials conducting inspections with TSA will receive training, including training on applicable FRA requirements and the safety procedures to follow while aboard a conveyance or inside a terminal or facility. If a rail hazardous materials facility requests that an inspector receive facility-specific safety briefings or training, TSA will work with the facility to accommodate those requests, provided that the timing is acceptable and that additional safety training is reasonable given the nature of the expected inspection.

2. Use of Identification Media and Verification of Identity of TSA Inspectors

Comments: Section 1580.5(c) provides that TSA is authorized to “enter, without advance notice * * * any area or within any conveyance without access media or identification media * * * in order to inspect or test compliance, or perform other such duties as TSA may direct.” Many commenters expressed concerns and comments about verifying the identity and credentials of inspectors. For example, APTA expressed the view that allowing TSA personnel to conduct inspections without identification media issued by the rail property would create unnecessary delays and disruption until their identities can be properly verified. APTA recommended that TSA inspectors use local identification media in addition to their TSA credentials to reduce the possibility that an individual posing as a TSA inspector could gain access to a property and compromise security.

Several commenters asked TSA to include a clearly stated authentication process, including a 24/7 telephone number, in the text of this final rule. Other commenters recommended that TSA officials be required to present government credentials and other identification (including photo identification) before being allowed on site, be badged at the facility to be inspected, or be escorted by a company representative.

One commenter stated that TSA inspections at NRC-licensed facilities without presentation of access or identification media issued or approved by the NRC licensees would place the licensees in direct violation of NRC regulations and security orders concerning access authorization.

TSA Response: TSA inspectors will carry Federal government credentials identifying themselves as having official authority to inspect. In addition, any railroad carrier, rail transit system, or rail hazardous materials facility wishing to authenticate the identity of an individual purporting to represent TSA may contact the Freedom Center at 703-563-3240 or 1-877-456-8722. In addition, TSA has provided some additional regulatory text on the issue of inspector credentials. Upon the request of an entity being inspected by TSA (and, as applicable, DHS officials working with TSA) the TSA or DHS official will present their credentials for examination, provided that the credentials may not be photocopied or otherwise reproduced. See 49 CFR 1580.5(d).

TSA notes that Homeland Security Presidential Directive 12 (HSPD-12) requires Federal agencies to improve secure identification processes for Federal employees and contractors.^[29] The U.S. Department of Commerce has published guidance on the standards and methods by which Agencies could reach compliance with HSPD-12.^[30]

As the capability becomes available and implementation of HSPD-12 continues, all Federal employees will have Federally-issued HSPD-12 compliant cards. TSA will establish procedures for regulated parties that elect to electronically validate Federal officials' credentials using FIPS 201 real-time credential authentication capability. In compliance with § 1512 of the 9/11 Commission Act, TSA is developing requirements for security programs in the rail sector. As TSA develops these requirements, TSA will consider procedures and protocols pertaining to verification of Federal HSPD-12 cards.

TSA has decided that it will not require an official of the inspected entity to accompany a TSA inspector during inspections. Although, in many cases, such an escort may very well be helpful, in other cases, it may hinder an inspection's timing or scope. TSA's inspectors often will request an escort, but they must be able to perform unescorted inspections at times to check compliance. With the exception of NRC-licensed facilities (as discussed below), TSA also is not requiring that inspectors receive identification media from the facility to be inspected. These media will not be necessary once the inspectors show their TSA or DHS credentials.

In the case of inspections conducted at NRC-licensed facilities, TSA inspectors who have not been granted unescorted access to the facility in accordance with NRC regulations will perform their unannounced inspections while escorted by an NRC or licensee employee who has been granted unescorted access. NRC inspectors inspecting for compliance with NRC requirements will notify TSA about any rail security concerns. As noted earlier, TSA intends that the specifics of these arrangements be outlined in an agreement between TSA and the NRC.

3. Warrantless Inspections

a. Legal Authority To Conduct Warrantless Inspections

Comments: One commenter questioned the legal grounds for the seizure of copies of documents without a warrant.

TSA Response: TSA is mandated by ATSA to develop policies, strategies, and plans for dealing with threats to all modes of transportation,^[31] including rail, and has authority to conduct inspections to ensure compliance with those policies and plans.^[32] The inspection authority provision in § 1580.5 of this final rule requires that freight and passenger railroad carriers, rail transit systems, and rail hazardous materials facilities allow TSA officials and DHS officials working with TSA to enter and be present within any area or within any conveyance to conduct inspections, tests, or to perform such other duties at any time or place to carry out TSA's statutory duties.

These inspections may be conducted without a warrant. By publication of this final regulation, owners and operators of rail operations and hazardous materials facilities are on notice as to the statutory and regulatory authority for the inspections. The regulation also identifies that TSA and other authorized DHS officials are the persons authorized to conduct the inspections. In addition, TSA has explained that the inspections may occur at any time, but will occur in a reasonable manner. Finally, the regulation identifies the locations subject to inspection and delineates the scope of the inspection, in that the inspection will encompass the property, facilities, equipment, operations, conveyances, and records that are necessary to carry out TSA's security-related responsibilities.

The entities covered by this final rule are part of a closely regulated industry due to existing oversight and the heightened government interests in regulating these businesses. Most rail carriers and facilities identified in the regulation are already subject to regulation from other Federal entities such as DOT and EPA. There is also no doubt that TSA has a substantial interest in regulating the railroad carriers, rail transit systems, and rail hazardous materials facilities covered by this final rule. The preamble to the NPRM set forth several examples of the devastating consequences of an attack on rail transportation and clearly explained TSA's interest in regulating rail transportation to protect persons and property. 71 FR at 76854. The NPRM also described what measures must be taken by rail interests to detect and deter these threats.

The warrantless administrative inspections contemplated by the rule are also necessary to further the regulatory scheme. TSA's rail inspection program is directed at a mobile industry that transports persons and potentially dangerous materials, and if inspection is to be effective and serve as a credible deterrent, unannounced inspections are essential.

b. Criminal Evidence Found During an Inspection

Comments: A State DOT stated that TSA may not use its regulatory oversight powers as a means to gather and seize criminal evidence against a rail carrier without a search warrant. The commenter said while there are allowable exceptions to warrant searches (such as the exigent circumstances surrounding the hot pursuit of a criminal suspect), none of those circumstances would typically exist during an oversight inspection.

TSA Response: TSA is aware of the legal requirements for conducting a criminal investigation, including requirements for obtaining a search warrant in certain circumstances. Transportation Security Inspectors (Surface) are not criminal investigators, and they will be trained accordingly. As appropriate, the inspectors will refer matters to the appropriate law enforcement authorities.

4. Enforcement Guidance for Inspectors

Comments: One chemical manufacturer stated that TSA must ensure the fairness of guidance documents that TSA may issue to inspectors, that TSA must issue any guidance in accordance with Executive Order (E.O.) 13422, amending E.O. 12866, which addresses Regulatory Planning and Review and the Office of Management & Budget's (OMB's) Bulletin for Agency Good Guidance Practices, and that TSA should give the regulated community the opportunity to submit comments regarding any draft guidance.

TSA Response: TSA will evaluate any guidance materials issued to our inspectors to determine the appropriate procedure for issuing them.

5. Review Process for Enforcement Decisions

Comments: National Railroad Passenger Corporation (Amtrak) asked if there would be a review process if the rail carrier does not agree with the decision of the rail inspector.

TSA Response: If any covered party disagrees with a rail inspector's decision with respect to compliance or possible corrective action, the party may request that the decision be reviewed at a higher level at TSA. The regulated entity may request that the issue be resolved by TSA management. Management will raise unresolved issues to TSA's Office of Chief Counsel and senior management for final resolution.

6. Use of Third-Party Contractors for Inspections

Comments: One commenter raised a number of questions about the use of contractors or officials of other agencies to conduct inspections under this rule.

TSA Response: TSA does not intend to employ contractors to carry out TSA's inspection responsibilities. DHS officials may inspect rail operations and rail hazardous materials facilities in coordination with TSA.^[33]

7. Other Comments on TSA Inspection Authority

Comments: A passenger railroad operator asked if TSA would provide any guidelines to rail inspectors regarding their actions while on a conveyance. For example, the commenter asked if the inspectors would occupy revenue seats of rail cars and transit vehicles and if they would be able to use their credentials to travel to and from their residence or place of work.

TSA Response: As stated above in the discussion of inspector training, TSA intends to use only properly trained personnel to conduct inspections. TSA inspectors will display credentials upon request and occupy revenue seats on passenger railroad cars and rail transit system conveyances only while performing official duties. If a TSA inspector is commuting to or from his or her residence or place of work, he or she will pay the same full fare as a member of the traveling public. Also, an on-duty TSA inspector may travel as a paying passenger when conducting unannounced inspections to evaluate the regulated party's security measures.

Comments: Proposed 49 CFR 1580.5(b)(7) states that TSA's inspection authority includes the right to “carry out such other duties, and exercise such other powers, relating to transportation security as the Assistant Secretary of Homeland Security for the TSA considers appropriate, to the extent authorized by law.” One chemical manufacturer commented that this proposed language is vague and undefined, and subjects the regulated community to unknown inspection criteria.

TSA Response: TSA has retained the language that it used in the NPRM. TSA has the primary Federal role in enhancing security for all modes of transportation. Under ATSA, TSA's authority with respect to transportation security is comprehensive and supported with specific powers related to the development and enforcement of security-related regulations, SDs, security plans, and other requirements, including ensuring the adequacy of security measures for the transportation of cargo ^[34] and overseeing the implementation of and ensuring the adequacy of security measures at transportation facilities.^[35] In addition to its other responsibilities under ATSA, TSA is charged with carrying out other appropriate duties relating to transportation security.^[36] The regulatory language in 49 CFR 1580.5(b)(7) notifies the regulated community of TSA's broad statutory authority to inspect and codifies the scope of TSA's existing inspection program as it relates to rail security.

As explained in the NPRM, TSA is authorized to conduct general security assessments in addition to inspecting for compliance with specific regulations. TSA has specific powers to assess threats to transportation security; monitor the state of awareness and readiness throughout the rail sector; determine the adequacy of an owner or operator's transportation-related security measures; and identify security gaps.

Comments: Two associations expressed concern that the proposed rule extends beyond just the rail operations and shipping and receiving areas of a regulated facility and, therefore, exceeds TSA's authority. These commenters requested that TSA revise the inspection provision in the rule to limit its scope to those operations directly related to or impacting a facility's rail operations.

TSA Response: TSA's authority to inspect under this rule does not extend to areas of the facility that are unrelated to transportation security, which may include (for example) areas dedicated exclusively to manufacturing or engineering. However, TSA notes that its inspection authority is broad. TSA has the discretion to inspect those areas of a rail hazardous materials shipper or receiver facility that are related to the security of the transportation system, such as the rail secure area and control rooms or offices where security activities are initiated or monitored. Under the authority of ATSA, TSA is directed to ensure the adequacy of security measures for the transportation of cargo,^[37] which includes ensuring the adequacy of security measures at the transportation-related areas of rail hazardous materials shipper and receiver facilities. The rail cars offered, prepared, loaded, received, or unloaded from or at these facilities may travel anywhere in the general railroad system of transportation, including in and near high population areas, critical infrastructure, and other vital areas. Sometimes loaded rail cars will remain for some time at the shipper's facility awaiting pickup from the freight railroad carrier. Whether being loaded at facilities or awaiting pickup at facilities, these rail cars could endanger surrounding areas. Accordingly, TSA's broad authority under ATSA includes authority to inspect those areas of the facilities used for transportation security activities.

E. Reporting Significant Security Concerns

1. General Comments

a. Value of Proposed Requirement To Report Significant Security Concerns

TSA received a number of comments supporting the proposed requirement to report significant security concerns. Two chemical companies and a major trade association supported the reporting of significant security concerns to TSA as proposed in § 1580.105. Other commenters expressed concerns about the requirements.

Comments: The Chairman and four members of the U.S. House Committee on Homeland Security expressed the view that the proposed reporting requirements would not improve rail security. They commented that the reporting requirements would not make the industry proactive in deterring terrorists and that, instead of collecting data for study after incidents have occurred, TSA should provide the industry with mandatory, standardized security practices and mandated training programs.

TSA Response: TSA believes that the requirements to report significant security concerns have great value in the overall approach to enhancing rail security. That approach includes other mandatory requirements, such as the chain of custody measures, location and shipping information, and the designation of RSCs, that will enhance security. TSA agrees with the House Committee members that it is important to focus on deterring activities that might compromise transportation security. TSA believes that reports of significant security concerns from rail transit operations, freight and passenger railroad carriers, and rail hazardous materials shippers and receivers enhance security, because they help TSA to evaluate if there are geographic or other patterns to the activities that are reported. If so, TSA may be able to interrupt similar events at other locations. In addition, TSA can determine if it should intensify inspections that focus on particular areas or activities.

b. Scope of the Reporting Requirements

Comments: The National Industrial Transportation League questioned the extent to which the reporting requirements would apply to a rail hazardous material shipper or receiver with a very large facility. The League asked if TSA intends to require a regulated entity to report any of the enumerated incidents anywhere in its facility, even if the incident has no relationship to or impact on the facility's rail operations.

TSA Response: TSA does not expect shipping or receiving facilities in an HTUA to report incidents that bear no relationship to areas of the facility that are related to the designated rail secure area, rail shipments, or receipt of the hazardous materials covered by this regulation. However, TSA expects that facility owners will report suspicious incidents outside the scope of this rule to other Federal, State, or local authorities, as appropriate or required by those other authorities.

2. Time and Method of Reporting

a. When must reports be made?

Comments: TSA received many comments about the proposed requirement to report significant security concerns “immediately,” particularly in the context of 911 notifications. Commenters asked TSA to define “immediately.” Several commenters requested that TSA clarify that the new reporting requirement does not take precedence over “first calls” to local authorities (that is, 911) for events requiring police, fire, or emergency medical support. A chemical company said that, for practical purposes, “immediate” notification of TSA would follow notification of local first responders via 911. A trade association said that the rule should emphasize that local authorities are to be notified simultaneously because local authorities near the plant site are in the best position to act quickly to mitigate and reduce the consequences of a real threat.

Similarly, one transit authority said that the requirement for “immediate” reporting would burden the RSC and other supervisory security personnel during the resolution of incidents. At such a crucial time, the RSC and other security personnel should focus on safe and secure resolution of the incident. A transit authority suggested that TSA change the reporting timeframe from “immediately” to monthly or bi-weekly reporting.

Two State DOTs said that the proposed rule fails to establish a timeframe for reporting potential threats and significant security concerns or specifically identify the role of the State oversight agency in the reporting process.

Several commenters offered suggested definitions of the term “immediately.” A trade association requested that TSA allow enough time to determine whether a notification is warranted. The association pointed out that the current DOT/PHMSA regulation (49 CFR 171.15) defines immediate notice to mean as soon as practical, but no later than 12 hours, and suggested that TSA incorporate similar language into the final rule. Another trade association noted that PHMSA's incident reporting requirements use the phrase “at the earliest practicable moment” to describe “immediate” and recommended that TSA use the same terminology. See 49 CFR 171.15 (which requires notice “as soon as practical but no later than 12 hours after the occurrence of [the] incident.”).

TSA Response: TSA plays a crucial role in coordinating the Federal response to threats to transportation security. The immediate reporting of a potential threat, a security incident, or a significant security concern is integral to TSA's ability to carry out this function successfully. Prompt notification enables TSA to help coordinate the Federal response, including actions to be taken at the State and local levels, and provides TSA with the situational awareness needed to make the appropriate assessments on the National and local levels.

TSA recognizes that, in some cases, notifying the local first responders to address a threat or consequences in the immediate aftermath of an incident takes precedence over notifying TSA because of the need to protect lives or property. In these cases, regulated entities should notify TSA simultaneously or as soon as possible after notifying 911 or other first responders.

TSA decided not to provide a definition of “immediately” in this final rule. TSA considered the DOT/PHMSA definition but decided that allowing up to twelve hours to report an incident may not allow sufficient time for TSA or other agencies to take necessary action to address a security concern. As noted above, TSA recognizes that, in some cases, reporting to TSA may take place after the reporting entity alerts law enforcement and first responders to ensure public safety and mitigate damage to property.

b. Content and Method of Reporting

Comments: Many commenters asked questions with respect to what information they should include in the reports and how and to whom they should report the information. A technology vendor said that its “off-the-shelf” product could be configured with sensors to detect and report tampering with rail cars and assist in reporting significant safety concerns.

TSA Response: With respect to content, the reports should inc lude all the information required in § 1580.105(d) and § 1580.203(d). Passenger railroad carriers and rail transit systems should refer to § 1580.203, and freight railroad carriers and facilities that ship or receive hazardous materials covered by the rule should refer to § 1580.105. With respect to the method of identifying the information to report, the rule does not require the use of specific products or methodologies. To help identify significant security concerns in a manner that meets this rule's performance standards, the covered entities may elect to use any variety of technological products.

3. Coordination With Other Reporting Requirements

Comments: TSA received numerous comments about the interrelationship between the reporting requirements of this rule and the reporting that occurs in response to other regulatory programs or other procedures. Commenters urged TSA to increase coordination and eliminate unnecessary duplication. For example, one trade association said that certain facilities are currently reporting significant security concerns to the FBI, local authorities, and the Coast Guard. The association said that TSA should use these existing reports to gather information rather than to create an additional reporting requirement. The association suggested that if TSA maintains this reporting requirement in the final rule, it should only apply to the certain hazardous materials determined to pose a higher security risk (such as PIH, explosives, and radioactive materials).

Several commenters wrote about the relationship between the proposed reporting requirement and FTA's reporting requirement in 49 CFR 659.33, asking TSA to clarify the role of State oversight agencies in the reporting process. Some State DOTs said that the proposed reporting would partially duplicate the reporting requirements of the State oversight program, which would force rail systems to develop multiple sets of procedures and processes.

Commenters suggested the following options for coordinating or merging the proposed reporting requirement with similar existing requirements:

• Create a centralized or “one stop” reporting process for stakeholders.
• Avoid any “excessive” duplication between the safety oversight and rail security programs.
• Minimize redundant reporting and ensure there is coordination of FRA, NTSB, and TSA reporting requirements.
• Make the proposed reporting requirement parallel to the existing requirements (or vice versa).
• Allow the reporting to other jurisdictional law enforcement agencies to meet the requirement of reporting to TSA.
• Allow reporting to the State oversight agency to fulfill TSA's requirement.
• Make the proposed reporting requirement more consistent with posting to the public transportation portion of the Homeland Security Information Network (HSIN).
• Modify the reporting requirements for the National Transit Database to support TSA's needs.
• Require that covered entities send reports to the National Response Center as the primary and sole reporting center for the purposes of this section and develop a mechanism for TSA to receive reports of significant security concerns from the National Response Center.
• Include language in the final rule to help regulated entities prioritize all of the notifications that they are required to make.

TSA Response: TSA needs information immediately on potential threats, suspicious activities, and security incidents for the purposes of comprehensive intelligence analysis, threat assessment, and allocation of security resources. Covered entities must report security concerns to the Freedom Center. The Freedom Center maintains communications networks with other Federal operations centers, such as DOT's Crisis Management Center, to convey reported security concerns to interested entities throughout the Federal government.

The reports submitted to State oversight agencies under 49 CFR 659.33 will not satisfy the requirements of this rule. Reports to the oversight agencies meet a more general need for situational awareness, particularly pertaining to safety conditions. The required reporting under this final rule and the reporting under 49 CFR 659.33 do not overlap extensively. Where they do overlap, TSA would expect that passenger railroad carriers and rail transit systems would follow procedures for reporting to TSA as well as to the State agencies.

TSA recognizes that entities regulated by both the Coast Guard and TSA may be required to report the same security concern to the National Response Center and the Freedom Center. However, in this final rule, TSA is requiring reporting to the Freedom Center for all rail-related security issues to facilitate the continued development of a centralized surface transportation security operations center and the development of rail specific intelligence. Moreover, obtaining reports indirectly from the National Response Center, the States, or other third parties might delay a needed response or may not contain adequate information for TSA's purposes.

4. Reportable Events

Comments: Many commenters said that TSA's definition of reportable events is too broad and should be more narrowly focused. Several comments from transit authorities said that the proposed reporting requirements would impose a substantial burden on transit systems and even on TSA itself and that the scope of the requirement should be narrowed. They also asserted that the proposed requirements would result in an overload of information that would divert attention from truly significant threats and dilute the effectiveness of the reporting system. Other commenters asked for a more specific description of “suspicious” activities or a list of examples that would, or would not, be considered “suspicious.” A commenter identified “youth vandalism” as an incident that should not be reportable.

Several commenters offered specific suggestions for which activities or incidents should be considered reportable. Some commenters suggested that the requirement focus on activities that pose a security threat to rail cars carrying covered hazardous materials or the materials covered by this regulation.

An industry association noted that the events that must be reported to DOT are very specific (such as a person being killed or requiring hospitalization) and suggested that TSA's reportable events be more specific and similar to DOT's. One commenter suggested that TSA only require reporting of certain specific crimes. Another commenter made specific suggestions regarding the categories of events that should be reported to TSA.

TSA Response: TSA is aware that the proposed reporting requirements are broad and, in some respects—such as the requirement to report “suspicious” activities—are not as specific as the regulated community would like. However, TSA has not changed the reporting requirements in this final rule for the reasons described below.

The reporting requirements are intended to mitigate the risk to rail transportation systems. These requirements will provide information to the appropriate authorities, allowing their timely intervention to an attack or its preparation. Detecting activities that may compromise transportation security entails piecing together seemingly unrelated incidents or observations and conducting analysis in context with information from other sources. However, as the threat environment is dynamic and indicators of incident planning and preparation can change, TSA cannot provide a threshold for reportable events or a specific definition.

TSA has decided not to accept commenters' suggestions to limit the scope of the reporting requirement. Limiting the scope to the DOT reporting requirements, which are intended to identify safety concerns, would reduce the data that TSA could use for trend analysis to anticipate and prevent an attack. Limiting incident reporting to only PIH materials, explosives in Classes 1.1, 1.2, and 1.3, or highway route-controlled quantities of radioactive materials would also limit TSA's domain awareness.

Comments: A State DOT expressed the concern that transit agencies may respond to the proposed requirement by understating or omitting the annual crime statistics they provide to the State DOT to avoid the proposed reporting requirement. Two State DOTs asked what would happen to a rail transit agency that failed to notice or report a potential threat.

TSA Response: TSA does not believe that transit agencies or others within the scope of TSA's reporting requirements would fail to report crimes in order to avoid the reporting requirements of this final rule. If a covered entity failed to report a potential threat in accordance with this rule, TSA would consider taking enforcement action. TSA would exercise enforcement discretion and would consider factors such as the type of threat and its significance, the procedures the covered party had in place to identify and report such threats, and other factors as appropriate.

5. Training

Comments: Several commenters requested that TSA develop training programs to assist employees in recognizing events that could raise security concerns and should be reported. One State DOT commented that, for the reporting system to work successfully there needs to be a comprehensive and ongoing training program for employees of passenger railroad carriers and rail transit systems. The agency requested that TSA provide a rail-specific training package for reporting potential threats and significant rail security concerns. Similarly, a labor union asserted that front-line workers will be in the best position to identify many of the potential threats or significant security concerns listed in the proposed rule. The union said that reporting will simply not be as robust or as complete as envisioned by TSA without mandatory security training for rail employees.

A chemical company noted that the proposed rule makes several references to IEDs. The company said that if these devices are a realistic threat to U.S. facilities, then the regulated community could benefit from specialized training, provided by TSA or other government agencies, on recognizing IEDs.

Some commenters requested that TSA provide training to RSCs on what constitutes a reportable event for purposes of reporting significant security concerns.

TSA Response: TSA recognizes that well-trained employees will enhance security. In the passenger rail/rail transit context, TSA has undertaken an effort to elevate the level of training generally, bring greater consistency, and assist transit agencies in arranging and implementing training programs by developing and disseminating a voluntary Mass Transit Security Training Program; this training program is available on TSA's Web site.^[38] The program identifies specific types of training at basic and follow-on levels for particular categories of transit employees. Basic categories for front-line employees include security awareness, behavior recognition, and immediate emergency response. The training program presents the information in a readily understandable matrix, and provides effective guidance to passenger rail and transit agency officials on how to build and implement training programs for employees working in their systems. The Transit Security Grant Program, administered by DHS and TSA to advance security enhancement efforts in passenger rail and mass transit systems, affords the agencies the option of this pre-packaged training program with grant funding. Agencies taking advantage of this program have their grant applications expedited for review and approval. This initiative aims to expand significantly the volume and quality of training for passenger rail and mass transit employees. Information on this initiative is available on TSA's Web site.^[39]

At this time, the rule does not mandate specific training for the reporting of significant security concerns. It specifies the type of incidents that covered entities must report. TSA will work with covered parties to comply with this final rule. In addition, TSA notes that current DOT regulations will aid in providing an adequate basis to identify suspicious incidents. Current DOT regulations require employers to provide security awareness training for most hazardous materials employees. See 49 CFR 172.704. The security awareness training must provide employees with an awareness of security risks associated with hazardous materials transportation and methods to enhance transportation security. This training must also include a component on how to recognize and respond to possible security threats. TSA recognizes that not all reporting will be accomplished by hazardous materials employees, however, TSA also recognizes that almost all employers provide their operational employees with some security awareness training. This training will enhance the quality of the information that covered entities report to TSA and will improve reporting levels. Additionally, TSA is developing a CD that will instruct workers on the appearance of an IED and how to locate an IED on a rail car. The CD will also include a training module on security awareness. TSA will provide the CD to covered parties prior to the effective date of this final rule via a mass mailing and will also post a request form on TSA's Web site.

We note that some commenters made reference to TSA providing training for RSCs. This final rule (49 CFR 1580.105 and 1580.203) does not assign the reporting task to the RSC, and TSA does not expect all reports of significant security concerns to come from the RSC. Reports may be made by individuals who are not employed at the corporate level of the regulated party.

6. Sharing of Information Received

Comments: A commenter asked whether TSA intends to share incident and trend analysis with anyone. Several governmental authorities requested that TSA transmit reports of significant security concerns to states and localities, including first responders, in a timely manner.

TSA Response: TSA may share reports of security concerns with Federal, State, or local law enforcement or other officials, for further analysis or for action consistent with those agencies' authorities.

7. Other Comments on Reporting Significant Security Concerns

Comments: One commenter asked how TSA will respond to and investigate reportable events.

TSA Response: If a determination is made that a reported event warrants a response or further investigation, TSA will work with the RSC, the local Transportation Security Inspectors (Surface), and other Federal, State, and local authorities, if warranted, to take appropriate action.

Comment: A commenter asked whether the information reported would receive SSI protection.

TSA Response: Under 49 CFR 1520.5(b)(7) (threat information), reports of significant security concerns would be considered SSI once TSA receives them.

F. Sensitive Security Information

1. Extent of Protection of Information as SSI

Comments: Several commenters suggested that the final rule should extend SSI protection to information that covered entities must submit to TSA under this rule, including location and shipping information for certain rail cars submitted in accordance with § 1580.103 and reports of significant security concerns submitted in accordance with § 1580.105 or § 1580.203.

TSA Response: The location and shipping information, which carriers are required to maintain and submit, would not be considered SSI. However, once DHS or DOT receives the location and shipping information from the railroad carrier and includes it as part of a broader analysis of the location of rail cars subject to the location reporting requirement, the compilation, not the raw data, will constitute SSI under revised § 1520.5(b)(12). Such compilations require greater protection than the information maintained by the railroad carrier for its business purposes, because the release of a compilation of location and shipping information to the public would increase the risk that the compiled information could be used to identify vulnerabilities or to plan an attack on critical rail assets. In the NPRM, TSA proposed to revise § 1520.5(b)(12), relating to information concerning infrastructure assets, to include rail transportation systems. TSA has included this provision in the final rule. Consistent with the provision, TSA considers lists of critical infrastructure assets prepared by DHS or DOT, including lists of rail cars containing covered materials, to be SSI.

With respect to reports of significant security concerns submitted under § 1580.105 or § 1580.203, such reports would constitute SSI under existing § 1520.5(b)(7) (threat information) once the Federal government receives them.

2. Access to Sensitive Security Information for State Oversight Agency or Designated Local or Tribal Officials

Comments: Many commenters expressed concern with the proposed amendment to 49 CFR part 1520 to protect information related to rail transit systems and to require rail transit systems to restrict the distribution, disclosure, and availability of SSI. Some said that the proposed rule needs to ensure that State oversight agencies responsible for establishing standards for rail safety and security programs for a State's rail fixed-guideway systems under 49 CFR part 659 will have access to SSI. Some were concerned about limitations on the availability of information, because they felt that State and local law enforcement and emergency response personnel need SSI for emergency planning. One commenter requested that TSA specify the rights of State and local governments to access SSI.

TSA Response: TSA agrees that State, local, and tribal governments, including State oversight agencies, should have access to SSI generated under this regulation for which they have a need to know. SSI may not be publicly disclosed pursuant to any State, local, or tribal law. This is consistent with DHS policy and will allow States, localities, and tribal employees, contractors, and grantees to have access to SSI if the information is needed for the performance of official duties on behalf of or in defense of the interests of Federal, State, local, or tribal government, or for performance of the contract or grant. Accordingly, TSA is adding State, local, and tribal agencies, which would include State oversight agencies, to the list of persons with a “need to know” under § 1520.11. This amendment does not authorize a State, local, or tribal agency to access SSI as a general matter. The agency must have a “need to know” specific pieces of SSI. SSI may not be publicly disclosed pursuant to any State, local, or tribal law.

3. Security Clearance

Comments: One commenter noted that most program administrators at the State oversight agencies do not have official “security clearance” authorizations and may therefore not have access to information needed to carry out security-related responsibilities.

TSA Response: TSA has revised § 1520.11 to allow access to SSI by State oversight agency employees with a need to know without requiring them to have security clearances. Under the SSI regulation, the Federal government does not ordinarily clear covered persons for receipt of classified national security information in order to receive access to SSI. TSA notes that security clearances would be required for access to information that is classified pursuant to Executive Order (E.O.) 13292 of March 25, 2003 (68 FR 15315. March 28, 2003); however, SSI does not fall within the scope of the E.O.

4. Inspection Information

Comments: One commenter requested that TSA protect information gathered by TSA inspectors as SSI.

TSA Response: This final rule will protect pertinent inspection-related security information as SSI under § 1520.5(b)(6), as amended by this rulemaking.

5. Simplified Marking

Comments: Another commenter suggested that TSA simplify the SSI marking requirements, so that documents need not be marked on every page.

TSA Response: This issue is beyond the scope of the Rail Transportation Security NPRM. TSA will consider revising the marking requirements of the SSI regulation in a future rulemaking.

6. Broadening the Scope of Sensitive Security Information

Comments: Many commenters supported the provisions protecting the disclosure of SSI in rail transportation. Others opposed expanding the scope of SSI, concerned that use of an SSI designation could withhold too much information from the public. They expressed concern that the proposed rule contained no restrictions on who may declare information SSI, or what information may be included in reports automatically accepted as SSI, and that there were no time limits on how long information protected as SSI remains SSI. These commenters believed that TSA should amend the SSI regulation to make it clear that records relating to the general safety of the rail and transit networks, as well as the terminals and other facilities, and records of their maintenance are not SSI. Other commenters suggested that TSA balance any need to protect route information against the need to disclose to States, cities, counties, Congress, and the public general information about the quantities and types of materials that are being shipped through an area. Other commenters urged that the definition of SSI be as narrow as possible.

TSA Response: TSA is fully committed to disclosing information to the public where appropriate unless such disclosure is prohibited from disclosure under law or would compromise transportation security. TSA does not intend to protect information as SSI that would not be detrimental to transportation security if publicly disclosed. SSI should not be released to individuals who do not have a need to know. Records relating to the general safety of railroad and transit systems, as well as related yards, terminals and other facilities, and records of their maintenance, are not SSI unless they overlap with or are inextricably commingled with security information that falls within the specific categories of SSI information in the SSI regulation. This consists of information that terrorists or others could use to the detriment of transportation or national security. Section 1520.15(b) allows for the public release of all information that is not SSI within records that contain both SSI and non-SSI information.

The SSI regulation defines what is considered SSI and imposes certain SSI handling requirements on a “covered person” with a need to know; only “covered persons” must mark information as SSI under the regulation.

7. Protection of SSI in Civil Litigation

Comments: Several commenters suggested that the SSI provisions should include the protections afforded CVI under DHS's CFATS rule, in light of recent Congressional requirements on the disclosure or sharing of SSI in civil litigation and the protection for SSI that is over three years old.

TSA Response: Last year, DHS issued the CFATS interim final rule on chemical facility security. Pursuant to its statutory mandate, the CFATS rule includes provisions for protecting CVI. Most rail SSI would not also qualify as CVI. Without statutory direction to do so, TSA is not authorized to expand the SSI regulation to include the protections afforded CVI.

The commenter is correct that Congress recently enacted legislation regarding SSI in civil litigation, but the new statute is narrow in scope. Section 525(d) of the 2007 DHS Appropriations Act grants civil litigants or their counsel who do not have a need to know under 49 CFR part 1520 access to specific SSI in Federal civil district court proceedings if certain requirements are met. This provision requires the controlled sharing in civil litigation in Federal district courts of relevant SSI for which a litigant demonstrates a substantial need after successful completion of a security threat assessment, and under a protective order entered by the court that protects the SSI from unauthorized or unnecessary disclosure and specifies the terms and conditions of access.

8. Coordination With Other Information Protection Programs

Comments: Several commenters were concerned that the recent DHS rule governing CVI means that regulated entities may soon manage three categories of protected homeland security information: SSI, Protected Critical Infrastructure Information (PCII) in 6 CFR part 29, and CVI in 6 CFR part 27. Each has unique elements and regulatory requirements. Commenters suggested that TSA consider adopting regulations that would harmonize and clarify information protection procedures for government and the private sector.

Similarly, the NRC has pointed out that some information that would be SSI under this rule would also fall within the scope of their Safeguards Information (SGI) program under § 147 of the Atomic Energy Act of 1954, as amended. SGI must be protected in accordance with the requirements in 10 CFR part 73.

TSA Response: The requirements of each of these information-management programs are specific to each respective program and relate to particular statutory and regulatory provisions. It is beyond the scope of this rulemaking and of TSA's authorities to amend the regulations governing Federal programs other than SSI or to make changes to the SSI regulation that exceed the scope of the Rail Transportation Security NPRM. With respect to information that is both SSI and CVI, PCII, or SGI, such information must be marked and protected in accordance with all applicable regulations. TSA will work closely with DHS and other government agencies to make sure that the requirements of the CVI, PCII, SGI, and SSI programs are complementary, not inconsistent, with each other.

9. Protection for Personal Information

Comments: One commenter recommended that TSA extend SSI protection to the personal information of rail transportation workers and employees of rail hazardous materials shippers and receivers, including RSCs appointed pursuant to this rule.

TSA Response: TSA will not normally share the personal information of RSCs provided to TSA under this rule with organizations external to DHS. However, if appropriate, TSA may share the information with other Federal, State, local, or tribal government agencies, including DOT, in accordance with applicable requirements, such as the Privacy Act and the Freedom of Information Act. To the extent that TSA shares the information with non-Federal entities, such as State, local, or tribal agencies, TSA expects that information will be safeguarded in accordance with procedures designed to protect such information. Accordingly, TSA has decided that it is not necessary to expand the protections afforded to personal information by further amending the SSI regulation at this time. TSA notes that lists of individuals with unescorted access to rail secure areas, if maintained, will be considered SSI under § 1520.5(b)(11)(i)(A). This final rule adopts the proposed amendment of that provision to include lists of individuals with unescorted access to rail secure areas.

10. Expansion of Sensitive Security Information to Other Modes of Transportation Besides Rail

Comments: One commenter believed that the paragraphs in § 1520.5(b) should include motor carriers, motor carrier freight terminals, and motor carrier infrastructure assets.

TSA Response: The changes to the SSI regulation in this final rule are focused on rail transportation rather than on other modes of transportation. Any changes concerning other modes of transportation would be outside the scope of this rulemaking. In the future, TSA may consider changes in the SSI regulation relating to motor carriers.

G. Chain of Custody and Control

1. Applicability

Comments: A municipality supported the chain of custody provision and recommended that TSA extend it to the carriage of all hazardous materials. Another commenter suggested that the rule is vague and does not address certain kinds of terrorist attacks (such as placing an explosive device under rail tracks or under elevated rail in a major city) and does not mandate any protective distances.

TSA Response: TSA is not expanding the proposed list of hazardous materials to which the requirements of part 1580 apply. While we recognize that all substances defined by DOT as “hazardous materials” are “capable of posing an unreasonable risk to health, safety, and property when transported in commerce” (see 49 CFR 171.8), not all hazardous materials are subject to the same potential for terrorists to exploit them to cause significant loss of life, transportation system disruption, or economic disruption. At this time, TSA has decided not to expand the list of materials to which this rule applies.

Comments: A commenter asked why TSA did not propose to apply the chain of custody requirements to transfers occurring between train crews employed by the same carrier.

TSA Response: TSA applied a risk-based approach in crafting the requirements of this final rule, and the greatest risk to rail cars today is when they are standing still unattended in an HTUA or prior to entering an HTUA. While TSA acknowledges that there is a security vulnerability any time a railroad carrier leaves rail cars (and sometimes entire trains) unattended, cars and trains are much more frequently left unattended when awaiting interchange to another carrier or at the point of initial shipment and delivery. TSA may consider applying the chain of custody requirements to intra-carrier transfers in a later rulemaking.

Comments: Two commenters opposed the exclusion of facilities owned or operated by the Federal government from the definitions for receivers and shippers, due to possible dangers of explosives and nuclear materials.

TSA Response: Although facilities owned or operated by the Federal government, such as any facility owned or operated by the Department of Defense (DOD) or the Department of Energy, are not subject to the requirements of this final rule, these facilities are the responsibility of other Federal agencies. In general, a Federal agency that ships or receives the materials described in § 1580.100 would be a secure facility operating under policies or regulations that provide a level of security comparable to the requirements of this final rule. For example, DOD shipments of explosives are frequently contracted as “rail surveillance” shipments, meaning that railroad police or their agents attend, inspect, and monitor these shipments while they are in transportation. Similarly, Federal agents track and monitor shipments of high-level nuclear materials while in transportation.

Comments: If operations of two or more companies are co-located, would only companies that ship designated materials be subject to § 1580.107?

TSA Response: If a company is co-located at the same facility as shippers or receivers covered by the chain of custody requirements but does not engage in the transportation by rail of the materials described in § 1580.100, that company does not have to comply with the chain of custody and control procedures in § 1580.107.

2. Attendance Requirement

Comments: Several commenters raised questions about compliance with the attendance requirement. Some commenters asked for clarification on the number of rail cars that one individual can attend. One commenter asked if a representative of the first railroad carrier must fully observe the transfer of physical custody of the rail car before turning it over to the second carrier, or if unmanned secure enclosures may be used.

TSA Response: Although the preamble to the NPRM stated that “not left unattended” meant that the employee or authorized representative must have “an unobstructed view of the rail car prior to the delivering carrier leaving the interchange point” (71 FR at 76873), TSA has reconsidered this interpretation. For purposes of paragraphs (c) and (d) of 49 CFR 1580.107, the requirement “to ensure that the rail car is not left unattended at any time during the physical transfer of custody” means that the regulated party has an employee or authorized representative physically located on site, in reasonable proximity to the rail car, who can reasonably detect unauthorized access or unlawful activity near the rail car and is capable of promptly responding to such unauthorized access or unlawful activity (such as by immediately contacting law enforcement or other authorities to investigate), and immediately responds to unauthorized access or activity at or near the rail car either personally or by contacting law enforcement or other authorities. See 49 CFR 1580.107(k)(1).

In the case of rail cars that have been decoupled from locomotive power and are therefore not in a train, reasonable proximity is best understood to mean that an employee or designee of the responsible party has either the rail car or the area surrounding the rail car, including paths of access to the rail car, within his or her field of vision. For rail cars that are in a train, the concept of reasonable proximity means that the train crewmembers are located on or near the train; although the train crewmembers may be located at the front of the train and physically unable to visually observe every rail car, the security risk is mitigated by the fact that the train is subject to unpredictable movement at any time. Determining what is a reasonable proximity is not calculated by measuring a precise distance or designating a particular location, but rather by achieving a reasonable expectation that any unlawful interference with the rail car will be promptly detected. As long as the individual performing the monitoring, whether on the ground or located in an on-site control room watching via a surveillance system, can satisfy this performance standard, there is no limit on the number of cars that he or she can attend. Accordingly, TSA does not expect the first railroad carrier to assign someone to literally observe each car 100 percent of the time during the physical transfer of custody.

TSA also does not want an employee or authorized representative of the regulated party to place his or her safety or life in jeopardy. TSA recognizes that a reasonable response to unauthorized access or unlawful activity may be to immediately contact law enforcement rather than approach an individual directly.

Comments: A municipality commented that TSA should provide clarification on whether rail switching yards must be converted into secure areas. As an example, it referenced a yard where trains are broken up into cars or blocks of cars and built into new trains.

TSA Response: Although the commenter uses the words “secure areas” in the context of asking whether rail yards fall under the “secure location” requirement in the definition of “rail secure area,” the commenter's question appears to concern the carrier to carrier transfer requirements in 49 CFR 1580.107(c) and (d).^[40] Under 49 CFR 1580.107, TSA requires attendance of the rail car during carrier to carrier physical transfers of custody. The attendance requirement only applies in a rail switching yard when one carrier interchanges a covered rail car with another carrier in such a yard. TSA anticipates this happening most often when cars enter and leave the yard, not while they are within the yard being switched. Movements within a yard (including many classification yards) that are transfers solely between the same railroad carrier are not covered by 49 CFR 1580.107.

Comments: An association representing short line and regional railroads commented that TSA should provide clarification on when the transfer is complete under the chain of custody and control requirements and recommended that TSA consider the transfer complete once the rail car is uncoupled from the delivering railroad carrier.

TSA Response: TSA agrees that the transfer is complete when the car is uncoupled from the train, and all documentation requirements are met either in writing or electronically.

Comments: Some commenters suggested that TSA amend paragraph (f)(1) of 49 CFR 1580.107 to prohibit unattended pick up and delivery rather than using the term “positive control.”

TSA Response: The language in this final rule remains unchanged from the NPRM. However, TSA has added a new paragraph (k)(2) to 49 CFR 1580.107 to explain the term “maintains positive control.”

By requiring that either the rail hazardous materials receiver in an HTUA or railroad carrier “maintains positive control” of the rail car during the physical transfer of custody of the rail car, TSA intends that the receiver communicate with the railroad carrier and work in close cooperation to ensure the security of the rail car during the transfer process. Since “attending the car” is only one component of the overall process of “controlling the car” during the transfer, the regulatory text requires one or both parties to be responsible for positive control.

Comments: A railroad carrier commenter indicated that a rail car is attended if a train crewmember is present. Several rail labor unions urged TSA to specify that a railroad carrier may not assign a train crewmember for purposes of compliance with the attendance requirements because of the high risk of injury or death in the event of a terrorist incident. One commenter stressed that train conductors already have numerous safety and other responsibilities, and are not trained as security personnel. Another commenter noted that 49 CFR 1580.107 does not have a training requirement, and requested that TSA add a provision to specifically address the skill set and qualifications necessary for conducting inspections required under 49 CFR 1580.107(a)(1), (b), (c), and (d).

TSA Response: As noted in the NPRM (71 FR at 76873), TSA intends that railroad carriers have maximum flexibility in adopting and implementing procedures to meet the car attendance performance standard. Accordingly, a railroad carrier's option to use any category of individuals, including train crewmembers, to carry out the job function of attending rail cars remains unchanged from the proposed rule. In crafting its procedures, TSA expects a railroad carrier to consider personal safety and security issues and competing job responsibilities of the potential individuals who will serve as attendants, as well as compliance with all other applicable laws, regulations, and contracts.

TSA is not prescribing a specific training requirement for attendant functions in this final rule, nor is it establishing minimum qualification standards for the employees who must attend the rail cars. However, in order to comply, the railroad carrier must ensure that persons who carry out this rule know what they must do. TSA will soon issue a DVD training video to freight railroad carriers and rail hazardous materials facilities on identifying IEDs and signs of rail car tampering and on security awareness.

TSA is mindful of employee concerns about personal safety. We do not expect that railroad employees will necessarily confront suspicious persons directly. For instance, an employee may summon law enforcement personnel to confront a suspicious individual or respond to a report of a possible IED.

Comments: Some commenters were concerned that the chain of custody provisions would be burdensome on small hazardous materials shippers and receivers in high threat urban areas that did not operate 24 hours a day, 7 days a week. Consequently, these facilities might not have staff to comply with the chain of custody provisions of this final rule when a carrier arrived to transfer a rail car.

TSA Response: TSA recognizes that a rail hazardous materials receiver located in an HTUA that is not open for business 24-hours a day, seven days a week, may incur some additional cost to meet the requirements in this final rule. TSA has accounted for this cost in the Regulatory Impact Assessment (RIA). Some regulated parties may satisfy the attendance requirement by employing someone only as long as necessary to transfer the car from the delivering railroad carrier, to document the transfer of custody, and to ensure that it is moved into a rail secure area. Once the rail car is placed in a rail secure area at the receiving facility, the rail car no longer needs to be attended.

3. Electronic Monitoring of Rail Cars

Comments: One group of commenters asked how technology can be used to comply with 49 CFR 1580.107. Several comments supported the use of technology to satisfy the chain of custody and control requirements, noting that electronic devices may offer better security benefits through their enhanced methods to track and control products while in transit. A trade association representing chlor-alkali producers worldwide (as well as packagers, distributors, users, and suppliers) asked TSA to clarify that “positive control” can be achieved through electronic communication.

TSA Response: TSA supports the use of technology to the extent that covered entities can use it to achieve the security standards of 49 CFR 1580.107. TSA recognizes that as existing and future technologies become commercially available, they could provide equal, or possibly superior, monitoring capability of rail cars. As noted, the attendance standard is that of a regulated party's reasonable expectation that it has the ability to detect unlawful interference with the rail car and properly respond to a security situation. See 49 CFR 1580.107(k)(1). As part of “maintaining positive control” of the rail car, attendance must occur until the receiving party has accepted physical custody. In this final rule, covered entities may use visual monitoring technology to comply with the attendance and transfer of physical custody requirements, but only if the person attending the car(s) or train is physically present on-site at the facility where the attendance is required.^[41]

The technology selected may include, but is not limited to, intelligent video, passive intrusion detection, perimeter alarms, or advanced video surveillance systems.^[42] Whatever system or method is selected, the regulated party is responsible for ensuring that the process employed provides an operationally effective means to meet the regulatory requirement. Automatic Equipment Identification (AEI) readers cannot be used to meet the provisions of 49 CFR 1580.107, because they cannot be used to monitor or control access to a car.

4. Rail Hazardous Materials Receivers

Comments: Some commenters requested that TSA assist facilities in determining whether they are within an HTUA and therefore subject to certain chain of custody and control provisions.

TSA Response: Before the effective date of this final rule, TSA will provide on its website maps of each of the 46 HTUAs that TSA will use to inspect for compliance with the applicable sections of this regulation. It is important to note that TSA will provide these maps for general guidance purposes only. TSA encourages any regulated party with questions concerning the applicability of this final rule to its operations to contact TSA directly.

Comments: A trade association commented that TSA should grant an exception to the chain of custody and control provisions for receivers located in an HTUA that receive less than one tank car per month.

TSA Response: This final rule does not contain an automatic exemption from the chain of custody requirements for rail hazardous materials receivers located within an HTUA, regardless of whether they receive very few cars in a given timeframe. The security risk posed by receipt of shipments of Division 1.1, 1.2, and 1.3 explosives, non-residue quantities of PIH materials, and highway route controlled quantities of radioactive materials is significant even if a rail hazardous materials facility only receives a single carload each month. While it is true that the security risks for the rail transportation system as a whole increases as the total number of shipments increase, it is also true that there is a risk associated with each carload received. An exemption from 49 CFR 1580.107 for the specified hazardous materials in amounts below a given threshold is not warranted given the security risks posed by these materials. However, any receiver located in an HTUA may request an exemption ^[43] from some or all of the chain of custody requirements of this final rule if it believes, based upon the operational characteristics and geographical location of its facility, that the potential security risk of its facility is insufficient to warrant application of the chain of custody requirements in 49 CFR 1580.107.

Comments: One commenter asked TSA to clarify that receivers located outside an HTUA are not required to satisfy the chain of custody and control provisions, including attending the physical hand-off from a railroad carrier.

TSA Response: Rail hazardous materials receivers not located within an HTUA are not subject to any of the requirements in this final rule.

Comments: A municipality stated that it is opposed to allowing shippers to request an exemption under 49 CFR 1580.107(j) if they determine that a terrorist attack is unlikely at the area where they forward or receive hazardous materials. The commenter stated that such requests for exemption are likely to be based on cost considerations, and not necessarily on objective and knowing assessments that an area is less vulnerable to terrorist activity. In addition, once these locations become and remain unguarded, they are likely to attract persons who could take advantage of the fact that the area is unsecured.

TSA Response: In the case of shippers of the covered hazardous materials, TSA agrees with the commenter. As the first link in the supply chain, and the first opportunity for unlawful interference with a rail car, shippers are not allowed to request an exemption from this regulation. However, under 49 CFR 1580.107(j), a rail hazardous materials receiver located within an HTUA can receive an exemption from the chain of custody and control requirements if it shows TSA that the potential risk from its activities is insufficient to warrant compliance. TSA will only grant such an exemption if, after analyzing the factors relevant to the potential security risk, it concludes that doing so is in the public interest and consistent with transportation security. The factors include: (1) The quantities and types of all hazardous materials that the rail hazardous materials receiver typically receives or unloads; (2) the receiver's geographical location in relationship to populated areas, which includes both daytime office building populations and populations in residential neighborhoods; (3) the receiver facility's immediate proximity to sensitive populated areas, such as other businesses (including other hazardous materials facilities), residential homes and apartment buildings, elementary schools, and hospitals; (4) any information regarding threats to the facility; and (5) any other circumstances relevant to that receiver's activities that would demonstrate that these activities present a low security risk.

5. Document Requirement

Comments: Several commenters requested that TSA clarify whether electronic data interchange (EDI) may be used to satisfy the documentation requirements of this final rule. One trade association asked whether an AEI system with readers at agreed interchange points would satisfy the documentation requirements. An association representing Class I railroads requested clarification on whether notification on a “switch list” (date and time of delivery), which is then entered into the carrier's electronic database, meets the documentation requirement.^[44]

TSA Response: The requirement to document the transfer of custody ensures that all parties involved in the transfer know who is responsible at any given time; this allows TSA to verify that freight railroad carriers and rail hazardous materials facilities are not engaged in practices that leave certain hazardous materials rail cars unattended, and therefore vulnerable to someone attaching an IED or otherwise sabotaging the car. The documentation requirement also assists in locating rail cars, especially after delivery to the receiving facility in an HTUA. This final rule does not specify that a carrier or facility must use a particular document to meet this requirement, but does prescribe certain mandatory information that carriers and facilities must include. In this regard, TSA recognizes the unique operating practices and considerations of each regulated party, and anticipates that each party will meet the performance standard by adapting existing documents and/or technology. Regardless of which method the regulated party uses to comply, TSA requires that the documentation must contain information that uniquely identifies that the rail car was attended during the transfer of custody. This information must include the car's initial (reporting mark) and number, identifying data that allows TSA to determine who in fact attended the rail car (such as the names or uniquely identifying employee numbers of the train crewmembers or rail hazardous materials facility employees), location of the transfer (such as the milepost number, name of the rail yard, or siding designation), and the date and time when the transfer was completed. See new 49 CFR 1580.107(k)(3).

EDI and switch lists may be used to satisfy the requirement and serve as a technical representation of a business conversation between two regulated parties if they are adapted to sufficiently document the transfer of physical custody from one regulated party to the other and allow TSA to determine who participated in the transfer and when and where the transfer took place. TSA is retaining in the final rule the language from the proposed rule requiring that both participants in the transfer create documentation. Passive AEI readers do not meet the documentation requirements of this final rule because while the passage of a rail car past an AEI reader would establish the car's geographical location at the time of the reading, it would not generate the required documentation.

6. Other Issues Concerning Chain of Custody and Control

Comments: Several members of Congress questioned the effectiveness of the proposed rule given the fact that so few TSA inspectors are available.

TSA Response: TSA has deployed the 100 inspectors provided for by Congress in the Department of Homeland Security Appropriations Act for fiscal year 2005 (Pub. L. 108-90). Assigned to 19 field offices throughout the United States, the inspectors cover the key rail and mass transit facilities in their regions. The program has focused on nationwide outreach and liaison activities with the rail industry and initiatives aimed at enhancing security in rail and mass transit systems. Inspections for compliance with this regulation, such as the chain of custody and control provision targeting of high risk interchanges, will focus our inspection priorities. Other provisions in this final rule, such as the appointment of a RSC and the requirement to provide certain location and shipping information, may be primarily monitored by headquarters staff. TSA is confident that this rule will be effectively implemented.

Comments: One municipality believed that re-routing of hazardous materials was a better strategy.

TSA Response: TSA's NPRM did not address this issue. DOT/PHMSA has addressed routing issues in its rule. As noted earlier in this preamble, DOT/PHMSA published an interim final rule in the Federal Register on April 16, 2008. The PHMSA rule revises the current requirements in the HMR applicable to the safe and secure transportation of hazardous materials transported in commerce by rail. In pertinent part, PHMSA is requiring freight railroad carriers to compile annual data on certain shipments of explosive, toxic inhalation, and radioactive materials, use the data to analyze safety and security risks along rail transportation routes where those materials are transported, assess alternative routing options, and make routing decisions based on those assessments.

Comments: Two commenters recommended that TSA adopt the DOT definition of offeror instead of “shipper” and that all requirements placed on the shipper should be assigned to the “offeror.” ^[45]

One of the commenters stated that the definition in the proposed rule of “rail hazardous materials shipper” is more restrictive than the DOT definition of “person who offers” or “offeror” in 49 CFR 171.8. The commenter noted that the proposed rule appears to assume that all hazardous materials shipment origination activities occur at the physical facility where a covered hazardous material shipment originates, and indicated that this is not necessarily the case. The commenter recommended that TSA revise the proposed rule to distinguish between requirements applicable to the originating facility and requirements applicable to the person or organization performing the functions of “offeror,” as described in 49 CFR 171.8.

Another commenter stated that since rail hazardous materials shippers and receivers are fixed-site facilities, not persons, they cannot be tasked to perform “offeror” functions. The commenter also recommended that TSA adjust the definition of “receiver” to make it consistent with 49 CFR 171.8.

TSA Response: TSA is revising the definitions of “rail hazardous materials shipper” and “rail hazardous materials receiver” in 49 CFR 1580.3 to clarify that this rule applies to the operator of the fixed-site facility. TSA is retaining the term “rail hazardous materials shipper” to establish that responsibility for compliance with the requirements in parts 1520 and 1580 rests with the operator of the fixed-site facility that has a physical connection to the general railroad system of transportation and offers, prepares, or loads any of the covered hazardous materials for transportation by rail. Although the facility operator may elect to assign responsibility for performing pre-transportation functions to an agent or contractor, the facility operator remains responsible under the rule for compliance with all applicable provisions of this final rule. In the event of noncompliance, TSA may hold the shipper/facility's operator responsible for the violation and subject to enforcement action. Further, TSA notes that a fixed-site facility operator is a “person” for purposes of being able to ship/offer or receive hazardous materials covered by the rule. See 49 CFR 1580.3.

TSA is also retaining the term “rail hazardous materials receiver” in this final rule rather than using the DOT term “consignee.” ^[46] A fixed-site receiving facility is not merely a delivery location, but also the legal entity responsible for compliance with this final rule in its role as a receiver or unloader of the covered hazardous materials. While DOT regulations no longer apply after the delivering railroad carrier departs a rail hazardous materials receiver facility (see 49 CFR 171.1(c)(3) and 171.8), TSA's final rule extends beyond that time and covers the transportation-related areas of these facilities that receive or unload covered rail cars.

Comments: A chemical manufacturer observed that TSA's definition of “offeror” includes the words “Any person who * * * [t]enders or makes the hazardous material available * * *” (49 CFR 1580.3). That manufacturer noted that the term “tenders” has a precise legal meaning, often used in satisfaction of a debt or obligation. The commenter recommended that TSA revise the definition of “offeror” by replacing the word “tenders” with “provides.”

TSA Response: For the sake of consistency with DOT's HMR, TSA based its definition of “offers” or “offeror” (49 CFR 1580.3) on the DOT definition of “person who offers” or “offeror” (49 CFR 171.8). In pertinent part, DOT defines a “person who offers or offeror” as “any person who * * * [t]enders or makes the hazardous material available * * *” In the context of TSA's definition of “offers” or “offeror,” the legal meaning of “tenders” is clear.

Comments: A chemical manufacturer commented that TSA should align the applicability of its rail transportation security rule with DHS's CFATS regulation and clearly define jurisdictions and authority so that entities covered by both regulations have a clear understanding of their obligations under the law.

TSA Response: It is not practicable for TSA to align the applicability section of the two rulemakings. Section 1580.107 of the freight rail provisions of TSA's regulation focuses on the pickup, delivery, and interchange of rail cars containing certain hazardous materials, whereas DHS's CFATS rule establishes requirements for the security of entire high-risk chemical facilities. Given the disparity in focus and the differences in addressing risk between the transportation and chemical sectors, it is neither practicable nor necessary to completely align the applicability sections of the two rules. Due to the nature of the supply chain, there is some inherent overlap between transportation and chemical facilities. This is reflected in the TSA regulation. In order to secure the transportation system, in § 1580.107 we are regulating facilities that are connected to the general railroad system of transportation and ship, or receive in an HTUA, one or more of the specified categories and quantities of the hazardous materials listed in § 1580.100(b). However, we believe that the responsibilities of those facilities that are potentially subject, to some degree, to both this rule and to CFATS are sufficiently clear and that those responsibilities will not conflict with each other.^[47]

Comments: A commenter expressed concern that the attendance requirements of 49 CFR 1580.107 might lead to non-compliance with the hours of service laws,^[48] cause worker fatigue issues, and have an impact on transit times and delivery schedules.

TSA Response: TSA recognizes that the attendance requirement may require certain operational changes by the freight railroad carriers required “to ensure that the rail car is not left unattended during the physical transfer of custody.” This final rule allows freight railroad carriers the maximum degree of flexibility to adopt and implement procedures to meet the car attendance performance standard. In this regard, 49 CFR 1580.107 does not specify a maximum number of rail cars that a carrier employee or authorized representative may attend, nor does it require the attendant to be within a certain designated distance from the rail car. TSA expects the affected freight railroad carriers to adopt and carry out implementing procedures that meet the performance standard of this rule without compromising railroad safety or violating any other Federal requirements.

Comments: Several commenters asked whether the chain of custody provisions apply to imports and exports from Mexico and Canada.

TSA Response: The chain of custody requirements do not apply at any shipper facilities located outside the United States, but begin at the first carrier interchange point inside the United States that triggers the provisions of § 1580.107, and apply to all subsequent covered carrier interchanges. The requirements also apply to a rail hazardous materials receiver located in an HTUA, regardless of whether the rail car originated at a domestic or foreign location. Accordingly, for shipments originating in Canada or Mexico, there will be no evidence of a secure shipment from the initial rail hazardous materials shipper, and for shipments destined for Canada or Mexico, there is no requirement for a secure hand off to the receiver.

Comments: One commenter requested clarification of responsibilities where a passenger railroad has contractual agreements regarding the use of their respective rail tracks for the transportation of hazardous materials by private freight railroad carriers.

TSA Response: The requirements in § 1580.107 do not apply to passenger railroad carriers that lease or have contractual agreements regarding the use of their track by freight railroad carriers to haul hazardous materials. Only the railroad carrier transporting the covered hazardous materials, not the owner of the track, is covered by § 1580.107.

Comments: The Small Railroad Business Owners of America commented on the potential danger of grouping hazardous materials rail cars together in secure areas rather then leaving them individually on tracks in various rail yards. The commenter stated that the best solution is to employ security systems that are monitored, such as television cameras and employees who work in the area who are told to immediately report any unauthorized persons.

TSA Response: TSA recognizes that rail hazardous materials facilities may have to comply with 49 CFR 1580.107 by storing covered rail cars in close proximity to each other. However, this final rule does not outline any specific requirements for the storage of covered cars, other than that the cars must be kept in a rail secure area with physical security measures while awaiting pickup at a rail hazardous material shipper by a railroad carrier or awaiting unloading at a rail hazardous materials receiver in an HTUA. The rule also does not specify the size of the secure area; a facility may establish multiple secure areas. TSA believes that placing covered cars only in secure areas with physical security measures in place provides an added security benefit, since it is easier for the facility to monitor the cars in concentrated locations rather than stored individually on multiple tracks.

H. Location and Shipping Information for Certain Rail Cars

1. Applicability

Comments: An association suggested that TSA exempt Class III railroads from providing routing information for cars on other carriers' portions of a rail car trip (i.e., the time that the rail car spends in transportation being hauled by another railroad carrier). The commenter stated that the shipping documents that small railroad carriers receive from connecting carriers typically do not indicate the routing that the larger railroads will use. They asserted that, in practice, this information is available from Class I railroad carriers who have multiple routing options and will know which route other carriers will use to the final delivery destination point.

TSA Response: When TSA needs to know the location of a specific rail car, the agency may query a number of carriers about the routing and shipping information; however, TSA recognizes that the entity in possession of the rail car generally has the best available information. In the context of TSA requesting the information, since this final rule only requires railroad carriers to report information for cars under their physical custody and control, TSA will not ask a carrier to submit information that is beyond its range of knowledge and that would require it to make inquiries of other carriers. See 49 CFR 1580.103(b).

Concerning routing information, TSA understands the differing capabilities between Class I railroads and short line and regional railroads, and has taken this into consideration in this final rule by allowing freight railroads, other than Class I carriers, more time to provide the required information. See 49 CFR 1580.103(e). TSA understands that routes sometimes change and expects that all regulated parties will provide the best available current routing information. TSA anticipates that in cases of heightened threat or during a security incident, all regulated parties would go beyond the minimum regulatory requirements and provide TSA with as much information as possible, including available information on rail cars that a railroad carrier had on its system before transferring it to another carrier or to a rail hazardous materials receiver.

Comments: One association commented that the only location and shipping information that rail hazardous materials shippers and receivers should have to provide to TSA, when requested, is the fact that the facility is in possession of the car.

TSA Response: This final rule provides that all covered freight railroad carriers and rail hazardous materials facilities must develop procedures to determine the location and shipping information specified by 49 CFR 1580.103 for rail cars under their physical custody and control containing the specified hazardous materials. A rail hazardous materials facility meets the requirements of 49 CFR 1580.103 if it informs TSA that it currently has a specific car(s) in its possession, identifies which rail cars contain a specified hazardous material, and provides TSA with the name and address of the facility where the car(s) or train is located. TSA is aware that some rail shipper and receiver facilities are very large, but there may be times when it is imperative that DHS know an exact car location inside a facility. In these cases, DHS and TSA will work with the affected facility to locate the precise position of the car to ensure appropriate intervention.

Comments: One commenter recommended that TSA extend applicability of the car location and shipping information reporting requirement to covered entities handling all DOT-classified hazardous materials.

TSA Response: As discussed in Section V.G.1 of this preamble, TSA is not revising the list of hazardous materials to which the requirements of 49 CFR 1580.103 apply. While TSA acknowledges that all hazardous materials present certain security risks in transportation, we selected the explosive, PIH, and radioactive materials as an initial step, because of the significant risk posed by these materials. In the case of an emergency involving explosives, PIH, or radioactive materials, such as a specific threat against a particular train or a general threat involving the metropolitan area through which the train is operating, it may be critical for TSA to have location and shipping information rapidly to address threats to persons and property.

2. Timeframe for Reporting Information

Comments: Many commenters supported the requirement to provide location and shipping information to TSA upon request within one hour, as proposed in the NPRM. TSA also requested comment on whether TSA could and should shorten the response time to five minutes for providing information on a specific car and 30 minutes for providing information on more than one car under the regulated party's physical custody and control.

Several commenters opposed shortening the response time. These commenters varied in their reasons for opposing the change, including arguments that it would pose an unreasonable cost, was too difficult, or was impossible to implement with current technology. A few commenters supported the shortened five minute/30 minute reporting timeframe. One commenter suggested that commercial off-the-shelf technology existed that could meet TSA's proposed requirement. Two others suggested that the threat was severe enough that TSA must be able to obtain location and shipping information on cars carrying security-sensitive materials in the shortest possible timeframe, regardless of whether the private sector funds the technology or the government establishes a national system.

TSA Response: TSA requires all Class I freight railroad carriers subject to 49 CFR 1580.103 to provide the location and shipping information to TSA within five minutes if the request concerns only one rail car and within thirty minutes if the request concerns two or more rail cars. See 49 CFR 1580.103(d). All other regulated parties subject to 49 CFR 1580.103 must provide the information to TSA within thirty minutes, regardless of how many rail cars the request concerns. See 49 CFR 1580.103(e). TSA has concluded that regulated parties can comply with these timeframes. The technological capability to locate the rail cars currently exists. While compliance with this final rule may require procedural changes to the carrier or facility's operations, it will not entail significant or costly technological changes.

Freight railroad carriers, both small and large, maintain systems to track and locate rail cars for both operational and revenue accounting purposes. Depending on the size and operational needs of the railroad, the sophistication of these systems will vary, but all perform the same basic functions. Railroad carriers trace the location of rail cars from the time that they are accepted for transportation at the point of origin until they are placed at the receiver's designated location. While in transit between the points of origin and destination, the progress of a rail car is tracked using a variety of methods including AEI, global positioning systems (GPSs), train dispatching systems, and train crew reporting. Railroad carriers then use computer-based systems to capture data on the location and progress of their rail cars. Carriers can use these types of systems to meet the reporting requirements of 49 CFR 1580.103.

TSA notes that railroad carriers transporting rail cars containing explosives, radioactive, or PIH materials have programs or procedures in place to quickly locate a single tank car on their property if they are provided with the car's reporting marks (initial & number). For purposes of complying with 49 CFR 1580.103, TSA anticipates that the vast majority of railroad carriers will determine the number and types of rail cars on their property containing PIH or other specified materials by utilizing car trace and yard management software that sorts car contents according to Standard Commodity Codes (STCC). In addition, TSA recognizes that railroad carriers can, and tend to, send car location messages to a central databank (Railinc ^[49] ), which allows the shipper, carrier(s), and receiver of the rail car to track the approximate location and trip progress of a particular rail car.

In 2006, TSA conducted audits of freight railroad carriers and their employees to determine the level of implementation of certain voluntary guidance.^[50] One of these standards concerned the ability of railroad carrier employees to locate cars containing PIH materials in a specific yard. TSA determined that all of the Class I railroads and over 80 percent of the Short Line and Terminal railroads had systems in place to locate cars containing PIH or other specified materials. In this regard, the majority of the railroad carriers have developed car tracing programs that allow them to identify those trains operating on their systems that have PIH or other specified material cars in the train.

As part of the process of analyzing the security threat to the freight railroad system, TSA has reviewed the ability of Class I, II, and III railroad carriers to respond to car location and shipping information requests. In all instances, when asked about rail cars containing the covered materials that were under their physical custody and control, Class I carriers were able to respond in five minutes or less when the request concerned one rail car and in 30 minutes or less when the request involved multiple rail cars. The Class I carriers used their existing programs and/or procedures to locate a single rail car on their property once TSA provided the car's reporting mark and serial number (car initial and number). These carriers also used car tracing programs to identify those trains operating on their systems that had hazardous material cars in the train.

In the case of Class II and III carriers, TSA is aware of at least one program that the industry developed for the purpose of locating hazardous materials rail cars being hauled on Short Line and Terminal railroads. TSA and FRA have funded a program known as FreightScope.^[51] The Federal government in conjunction with the American Short Line & Regional Railroad Association (ASLRRA), has tested the functional capability of this program. Representatives of the ASLRRA, acting as agents for their member railroads, maintained a means of accessing the information in the FreightScope program, as well as a means of transmitting the information to the Federal government upon request. In the tests performed, the ASLRRA representatives were able to provide the requested car location and reporting information in approximately 20 minutes. In one instance, the ASLRRA representative provided a verbal accounting of the information in less than five minutes.

Larger and medium size rail hazardous materials shippers and rail hazardous materials receivers of rail cars covered by this regulation have existing systems in place to record cars that enter or leave their facilities by rail. Railroad carriers notify shippers prior to dropping off residue cars and picking up loaded cars, and notify receivers when delivering a loaded car or picking up a residue car. Shippers are aware of the location and status of rail cars covered by this final rule as the cars pass through the facility, both while going through the loading process and while in temporary storage waiting to be shipped. Shippers also follow very specific company and DOT-required procedures for pre- and post-load inspections and necessary rail car maintenance and repair. While there is a constant movement of rail cars into, through, and out of a facility between these processes, plant personnel monitor the tank cars at each stage of the process, including loading and unloading operations and railroad carrier drop offs and pickups. Large and medium size receivers in HTUAs also follow very specific procedures and processes from the time a covered rail car enters the facility until the covered hazardous material is unloaded, including inspections prior to unloading. In addition, they perform pre-release checks before the residue cars are picked up by the railroad carrier.

Smaller rail hazardous materials shippers and smaller rail hazardous materials receivers in an HTUA have smaller inventories of rail cars and consequently a smaller turnover of cars. TSA anticipates that the facilities will comply with this final rule by maintaining a written list of rail cars with the relevant information, and perform a visual check for the requested cars. The location and shipping information requirement will not result in operational changes to the systems at these smaller facilities.

As noted in the preamble to the NPRM, TSA sought comment on an alternative to the proposed one-hour reporting timeframe, because in an emergency, “information concerning the location of certain hazardous materials * * * [is] critical to decisions concerning possible rerouting, stopping, or otherwise protecting shipments and populations to address specific security threats or incidents.” 71 FR at 65864 and 76871. TSA specifically asked for comment on how a shorter timeframe could be accomplished and at what financial cost. Based upon comments received and our understanding of the technological capabilities of freight railroad carriers and rail hazardous materials facilities, in this final rule, TSA has revised the timeframe for a regulated party to report location and shipping information. Each Class I railroad carrier must provide the requested information to TSA no later than five minutes after receiving the request if the request involves only one rail car and no later than 30 minutes if the request concerns two or more rail cars. All freight railroad carriers not otherwise identified as Class I carriers by the STB are permitted up to 30 minutes to provide the requested information, regardless of the number of rail cars involved. All rail hazardous materials shippers and all rail hazardous materials receivers in an HTUA are permitted up to 30 minutes to provide the requested information, regardless of the number of rail cars involved.

TSA has also added a new paragraph (g) to 49 CFR 1580.103, requiring each regulated party to provide a telephone number for TSA to use when requesting location and shipping information. In contrast to the RSC provision, which requires the regulated party to designate a named individual as TSA's contact person because of the potential need to convey extremely time-sensitive threat information or security procedures at any time of the day or night, paragraph (f) merely requires that the designated telephone number be monitored at all times by a live person. As long as the individual who answers TSA's telephone call can provide accurate information within the specified timeframe, paragraph (f) permits the regulated party to use a designated third party or agent to meet this performance standard, rather than exclusively a company employee. Since this provision allows the regulated party flexibility to determine how best to meet the reporting requirement, smaller railroad carriers and rail hazardous materials facilities that do not operate around the clock or maintain 24/7 operations centers can comply with minimal operational changes.

TSA is also deleting the words “in writing” from paragraph (f)(6) in this final rule (which was designated as paragraph (e)(6) in the NPRM), to allow regulated entities, on a case-by-case basis, to request an alternate reporting format and for TSA to immediately approve that request by telephone, without the need for a written response. TSA anticipates that a railroad carrier or rail hazardous materials facility may use this provision when they receive a request for information on only one rail car and can provide the answer easily by telephone. However, TSA does not anticipate approving the use of verbal communication if the requested information concerns numerous rail cars located at many different locations.

3. Technology for Reporting Information

Comments: Several commenters stressed that TSA should allow them to use existing resources to comply with the location and shipping information requirement. A commenter indicated that existing AEI readers and supporting two-way communications systems are fully capable of producing the location and shipping information requested by TSA. The commenter stated that GPS by itself does not add substantial benefits and has significant limitations, such as requiring a direct line of sight to the satellite and an independent power source, which will need replacement. Additionally, the frequency of transmission causes immediacy of location reports to vary.

TSA Response: TSA believes that the technology currently employed by freight railroad carriers and rail hazardous materials facilities is sufficient to comply with 49 CFR 1580.103. This final rule establishes a performance standard that requires the regulated entities to be able to provide the requested information in the timeframe specified, without mandating a particular technology or system protocol for obtaining it. Accordingly, while certain larger freight railroad carriers will meet the requirement by using AEI tags, smaller carriers that rarely haul rail cars containing the specified hazardous materials may elect to obtain the requested location and shipping information merely by calling the train crew on a two-way radio or cellular telephone. Depending on the number of rail cars present that contain one or more of the listed hazardous materials, rail hazardous materials facilities may choose to employ a sophisticated computer program (as appropriate) or simply assign an employee to physically count the rail cars containing the product and gather the requested information for each rail car. If the carrier, shipper, or receiver provides the location and shipping information to TSA within the specified timeframe and does so using one of the approved methods, the carrier or facility would be in full compliance with this final rule.

Comments: A few commenters supported enhancing the current AEI system with GPS-based tracking and monitoring systems. These commenters noted that GPS-based technologies can provide timely and accurate tracking information. They suggested that the current AEI-based system cannot meet the requirements of this rulemaking or provide the efficiency benefits. One commenter noted that in addition to location data, GPS-based systems can provide security information such as a notification if certain equipment becomes compromised in transit.

Other commenters opposed the use of a GPS-based system and supported the continued use of the current AEI system to meet the proposed requirements.

TSA Response: TSA appreciates the comments on AEI systems and GPS technology. TSA is not mandating any specific technology to meet the requirements of this final rule at this time. In order to better understand the security costs, benefits, and drawbacks of GPS, TSA has commissioned a comparative study between GPS and the current AEI-based system. Additionally, the study will provide the Federal government with an assessment of the AEI system and additional technologies that could be used to enhance the current system's fidelity.

4. TSA's Use of the Information

Comments: Several members of Congress requested information on how TSA intends to use the information gathered pursuant to the location and shipping information provisions of the regulation.

TSA Response: TSA intends to use the information obtained under § 1580.103 to prevent or mitigate a terrorist attack. TSA anticipates requesting information in cases of heightened threat or prior to or during an attack. In cases where TSA/DHS has threat information about a specific rail car, commodity, or area, or other relevant fact relating to the transportation of covered materials being shipped by rail, it is imperative that TSA be able to focus upon the affected entity or population as quickly as possible. Currently, the Federal government does not have in place a permanent system to locate rail cars or target hazardous materials in transportation and must partner with the private sector. By finalizing this provision of the rule and including a new requirement that each covered party must supply TSA with a 24-hour contact telephone number, TSA/DHS has a new tool to enable the Federal government to focus on potential or actual targets and take appropriate action when time is of the essence.

I. Whistleblower Protection for Employees

Comments: Two labor unions requested that the rule include whistleblower protection for employees of covered entities who report significant security concerns. The commenters indicated that absent such whistleblower protection, rail employees will remain subject to discipline and dismissal for reporting security concerns. One commenter provided regulatory language that would establish an appropriate level of whistleblower protection for employees who report security lapses to the relevant Federal entities. A third labor union asserted that the final rule must include mechanisms to ensure that employees are permitted to participate fully in reporting security concerns without harassment by employers. The union said that TSA inspectors and other agency officials should have the ability to talk directly with front-line workers about security concerns and any employer harassment they face. In addition, the union urged TSA to adopt regulations specifically prohibiting any type of employee harassment or intimidation with fines and penalties sufficient to discourage this conduct.

TSA Response: The topic of whistleblower protection is outside the scope of the NPRM, and therefore TSA has not addressed it in this final rule. TSA notes, however, that two provisions of the 9/11 Commission Act provide protections from retaliation for public transportation employees and railroad employees who, in good faith, provide information, or otherwise directly assist an investigation, about conduct that the employees reasonably believe is a violation of a Federal law, rule, or regulation related to railroad safety or security or gross fraud, waste, or abuse of Federal grants or other public funds.^[52] See §§ 1413 (Public Transportation Employee Protections) and 1521 (Railroad Employee Protections) of the 9/11 Commission Act; see also 49 U.S.C. 20109. Each provision includes protections for employees who refuse to violate or help in the violation of any Federal law, rule, or regulation relating to safety or security; file a complaint, or directly cause to be brought a proceeding related to the enforcement of certain laws and regulations; or furnish information to DOT, DHS, NTSB, or any Federal, State, or local regulatory or law enforcement agency as to the facts relating to any accident or incident resulting in injury or death to an individual or damage to property occurring in connection with (as applicable) public transportation or railroad transportation. The whistleblower protections are enforced through the filing of a complaint with the Department of Labor. See § 1413(c) of the 9/11 Commission Act and 49 U.S.C. 20109(c) (as amended by § 1521 of the 9/11 Commission Act).

J. Preemption

Comments: Section 1580.109 of the NPRM proposed to preempt any State laws, rules, regulations, orders or common law requirements covering the same subject matter as § 1580.107. TSA sought comment on the scope of the subject matter that the final rule should or should not preempt under 49 U.S.C. 20106. Commenters were sharply divided on the issue of the proposed rule's preemptive effect, with industry commenters in favor of preemption and State and local governments opposed.

Several chemical manufacturers expressed support for the proposed rule's preemption provision, because it would implement national uniformity and increase the effectiveness of compliance efforts. Several trade associations urged TSA to expand to provisions beyond those for chain of custody and control requirements.

One commenter asserted that TSA's statement in the preamble of the NPRM that it “does not intend to preempt inspection activities conducted in furtherance of State and local laws or preempt requirements to appoint an RSC, or report significant security concerns” (71 FR 76875) is inconsistent with the language in 49 U.S.C. 20106. In this regard, the commenter stated that § 20106 provides that the States cannot regulate a subject when DOT or DHS has regulated that subject. The commenter asserted, therefore, that TSA lacks discretion to allow States to enforce their own requirements relating to RSCs or the reporting of security concerns. Further, the commenter stated that State requirements could result in railroads being subjected to differing requirements for security coordinators and a duty to report different types of occurrences in every State, leading to compliance difficulties without enhancing security.

Other industry representatives also emphasized the importance of uniform national standards and supported broad preemption.

State commenters raised objections to preemption and urged TSA to explain its plans for coordination and information sharing with States. A State requested assurance that a State's right to inspect and regulate will not be abrogated. A municipality, citing 49 U.S.C. 20106, urged TSA to include language in the final rule text recognizing the right of a political subdivision to enact more stringent law when “necessary to eliminate or reduce an essentially local safety or security hazard” if it “is not incompatible” with a Federal regulation and “does not unreasonably burden interstate commerce.”

Another State objected to TSA's proposed “subject matter” preemption of chain of custody and control requirements, stating that it would prevent a necessary partnership among Federal, State, local, and tribal governments. The commenter preferred use of the “substantially the same” form of Federal preemption language contained in the Federal hazardous materials transportation laws, which would preserve State laws that do not act as an “obstacle” to compliance or accomplishment of the Federal requirements. See 49 U.S.C. 5125. Another commenter urged TSA to adopt a “conflict” preemption standard in lieu of its proposed “field” or “subject matter” standard.

An individual commenter opposed preemption of State and local requirements, and gave the example of cities that want to place restrictions on where rail cars storing Toxic Inhalation Hazard (TIH) materials can be located. The commenter supported State and local efforts to mandate what the commenter characterized as the most basic terrorism prevention measures: Routing and storing the most dangerous cargoes away from vulnerable target areas. Other commenters objected to preemption, because they believed that Federal regulations alone cannot effectively ensure that the public is protected from dangers associated with the shipment of potentially hazardous materials via rail.

TSA Response: TSA has fully considered the sharply divided comments on the issue of this final rule's preemptive effect. TSA has decided to retain the same language it proposed in the NPRM. In addition, after further consideration of the governing statutory provision, TSA has added a sentence to § 1580.109 that tracks the language of that governing statutory provision—i.e., 49 U.S.C. 20106. The new sentence conveys Congress' intent as to the standard for preemption in the area of rail security (and safety).

While in the past TSA's regulations have not included regulatory text about preemptive effect, the absence of such text does not necessarily indicate that TSA's regulations do not have preemptive effect. TSA has included such a provision here to make clear its finding about one aspect of this rulemaking.

Congress has clearly legislated the standard for preemption in rail security (and safety) legislation. 49 U.S.C. 20106 provides that all regulations prescribed by the Secretary of Homeland Security relating to railroad security preempt any State law, regulation, or order covering the same subject matter, except a provision that: (1) is necessary to eliminate or reduce an essentially local security hazard, (2) is not incompatible with a Federal law, regulation, or order, and (3) does not unreasonably burden interstate commerce. Unless a state law, regulation, or order meets all three of these conditions, § 20106 expresses Congress's intent that it will be preempted. With the exception of a provision directed at an essentially local security hazard that is not inconsistent with a Federal law, regulation, or order, and that does not unreasonably burden interstate commerce, § 20106 will preempt any State or local law or regulatory agency rule covering the same subject matter as § 1580.107.^[53]

In the context of railroad safety, the Supreme Court has consistently interpreted § 20106 to confer on the Secretary of Transportation the power to issue regulations that would preempt not only State statutes, but common law as well. See CSX Transp. v. Easterwood, 507 U.S. 658, 664 (1993) (“[L]egal duties imposed on railroads by the common law fall within the scope of [the] broad phrases” of § 20106). See also Norfolk Southern Ry. Co. v. Shanklin, 529 U.S. 344 (2000). The Court has further held that Federal regulations under the Federal railroad safety laws will preempt common law where the regulations “substantially subsume” the subject matter of the relevant State law. Easterwood, 507 U.S. at 664.

As provided in the regulatory text at § 1580.109, the preemptive effect of this rule extends to the rule's provisions regarding chain of custody and control, both within and outside of HTUAs, of rail cars containing hazardous materials. TSA finds that, consistent with § 20106, these provisions preempt State, local, and tribal requirements covering the same subject matter, including any such requirements prescribing or restricting security measures during the physical transfer of custody and control of rail cars containing the categories and quantities of hazardous materials set forth in § 1580.100(b), as well as any requirements that might attempt to impose a duty on freight railroad carriers or rail hazardous materials shippers, or rail hazardous materials receivers pertaining to the physical transfer of custody and control chain of rail cars containing hazardous materials that is not specifically set forth in § 1580.107. For example, TSA's rule would preempt any State law or common law theory of liability that would require a freight railroad carrier to hire armed security guards to attend the rail car during the physical transfer of custody; a rail hazardous materials shipper or receiver to use specifically-designated physical security measures to ensure that no unauthorized person gains access to the rail secure area; or additional physical inspections of the rail car by the carrier or facility than that specified in § 1580.107.

It would be impractical and burdensome to the secure chain of physical custody and control process to require regulated parties to develop multiple sets of procedures to comply with varying State and local requirements. TSA is aware that, if this final rule did not preempt State or local regulations regarding the chain of custody requirements in § 1580.107, a freight railroad carrier or rail hazardous materials facility may need to comply with different requirements in different jurisdictions. Clearly, § 20106 was intended to prevent this outcome. Any other result would require a substantial resource commitment, because it would require carriers and facilities to instruct individuals who carry out chain of custody requirements to do so according to a multitude of different operating rules and practices. This, in turn, could raise significant safety and security concerns. This also might require carriers to vary the size and training qualifications of the train crew based upon the varying laws in each jurisdiction. Because rail transportation of hazardous materials frequently involves transportation across jurisdictions and because of the resources necessary to comply with potentially varying chain of custody requirements, TSA believes that subjecting carriers to additional State regulations in this area would likely place an unreasonable burden on interstate commerce. TSA seeks to avoid this result. For these reasons, the chain of custody and control security measures must be subject to uniform national standards.

Whether the other provisions of this final rule preempt any such State, local, or tribal law, or types of laws, depends on an analysis of the specific State, local, or tribal law, or types of law, in the context of 49 U.S.C. 20106. At this time, TSA makes no finding as to whether those other provisions of this final rule preempt State, local, or tribal law.

Finally, TSA is not including language delegating inspection authority to the States, as requested by the New Jersey Office of Homeland Security & Preparedness. TSA does note, however, that if, in the course of performing an inspection, TSA identifies evidence of noncompliance with a State requirement, TSA will (as appropriate) provide the information to the appropriate State agency for action. In this regard, TSA would not directly enforce State security rules and would initiate a Federal inspection only when a security nexus exists. If TSA were to reconsider its position in the future, it would do so through the issuance of notice to the public.

K. Comments on the Regulatory Impact Assessment

To evaluate the impact of the proposed rule, TSA prepared a Regulatory Impact Assessment (RIA) and posted it to the public docket in December of 2006. We received a number of public comments that addressed many aspects of the assessment. The majority of commenters discussed what they perceive to be deficiencies or inaccuracies in our assessment. Several commenters, including individuals, businesses, and trade associations, questioned some of the analytical assumptions used to estimate the costs of the NPRM. Others pointed out instances where they believe that we failed to account for a compliance cost. TSA considered all comments on the original RIA and has summarized and responded to them below.

1. Whether the Benefits of the Rule Justify the Costs

Comments: Although we received multiple comments that supported the security objectives of the proposed rule, one commenter, a large Class I railroad, stated that the costs of the proposed regulatory action far outweigh the benefits. In its comprehensive public comments, the railroad implied that the costs of the proposed rule—both direct and indirect—could not be justified by the increase in security afforded by the regulation, and that the rule would only negligibly reduce risk in the rail transportation mode. The commenter asserted that it is impossible to completely secure the U.S. rail network. The commenter also asserted that the rule fails to strike the proper balance between compliance costs (both direct and indirect) and the probability of the occurrence of a transportation security incident in the rail mode.

The same commenter stated that the rule would not substantially increase the level of security in the rail transportation mode. The railroad noted that the U.S. rail network is an inherently open system, making it difficult to secure. Further, the railroad stated that while the proposed rule attempts to address the risk posed by hazardous materials, the very nature of the U.S. rail network would prevent a shipment of hazardous materials from ever being fully secured. It observed that the rail system will always be susceptible to attack and other incidents.

The commenter stated that the proposed rule would inflict significant direct and indirect costs on the rail transportation mode. In particular, the railroad singled out the chain of custody and control requirements as being potentially costly for freight railroad operators. The railroad noted that the requirement would force companies to make investments in security in lieu of investments aimed at increasing rail system capacity, an acute need in light of the continuing growth in freight rail shipments. The railroad implied that the rule, by curtailing the expansion of the rail network and slowing the movement of freight, would exact large costs on railroads, shippers, and ultimately the U.S. economy.

The commenter stated that TSA did not adequately estimate the costs in the RIA and that TSA did not satisfactorily weigh them against the benefits of the proposed regulation. The commenter also criticized TSA for failing to calculate the probability of the occurrence of a transportation security incident in the rail transportation mode, a step it believes is necessary in justifying the costs of the proposed rule. In the commenter's view, the agency examined the potential consequences of a security incident, without acknowledging the low probability of such an event. Consequently, the railroad did not agree with TSA's assessment that the costs of the proposed rule—and in particular that the financial impact of the chain of custody and control requirement—could be justified by security improvements.

TSA Response: TSA recognizes that the rule will have an economic impact on railroads, and we appreciate that the compliance costs of the regulation represent an investment in security for many in the industry. As part of the economic analysis required by E.O. 12866, we have made every attempt to include all known and quantifiable costs in the RIA.

The agency disagrees, however, with the assertion that the rule will impose costs on industry disproportionate to its benefits. Although the agency concurs with the portrayal of the U.S. rail system as an open, difficult-to-secure network, TSA believes that the provisions of the rule, including those not addressed by the comment, will improve security in the rail mode.

First, this final rule will protect the dissemination of sensitive rail security information by designating it as SSI. This provision of this final rule will impose no costs on covered individuals and businesses but will provide an additional measure of protection against possible threats. Information that could potentially be detrimental to security if publicly disclosed will be less likely to be distributed and misused under the SSI designation.

Second, this final rule will codify the authority of TSA, or DHS officials working with TSA, to enter and inspect covered entities at any time, including inspecting and testing property, facilities, equipment, and operations, and viewing, inspecting, and copying records. These inspections will assist TSA in carrying out its statutory authority, which includes the assessment of threats to transportation; enforcement of security-related regulations and requirements; inspection, maintenance, and testing of security facilities, equipment, and systems; and ensuring the adequacy of security measures for the transportation of freight and cargo. See 49 U.S.C. 114.

Third, this final rule will require freight and passenger railroad carriers, rail transit systems, and rail hazardous materials facilities to designate and use RSCs. This provision will prove beneficial, because it will result in more efficient communication between TSA and companies operating in the rail mode, particularly in the event of an emergency.

Fourth, this final rule will require freight and passenger railroad carriers, rail transit systems, and rail hazardous materials facilities to immediately report potential threats and significant security concerns to TSA. This requirement will help TSA “connect the dots,” pulling together seemingly disconnected or disparate reports of suspicious or unusual activities. These reports may provide the insight necessary to prevent a transportation security incident, if they can be analyzed quickly in the context of broader information derived from the intelligence community.

Fifth, this rulemaking will require freight railroad carriers transporting certain categories and quantities of hazardous materials, and rail hazardous materials facilities subject to the rule, to provide information to TSA on the location of certain rail cars. This requirement will increase security by providing information critical to re-routing or stopping shipments to address specific security threats or incidents. This information could amplify the ability of TSA, law enforcement, and emergency response agencies to respond to any potential threats or attacks involving rail cars transporting hazardous materials and to protect the populations that might otherwise be harmed.

Sixth, this final rule will require freight railroad carriers and rail hazardous materials facilities to eliminate practices that leave certain hazardous materials unattended before or during shipment, and after shipment until unloading of the rail car occurs. This requirement will apply: (1) To the rail hazardous materials shipper and freight railroad carrier until the freight railroad carrier takes physical custody of the rail car, (2) when two freight railroad carriers interchange a rail car within an HTUA, (3) when two freight railroad carriers interchange a rail car that may enter an HTUA after the interchange, (4) to the freight railroad carrier delivering a rail car to a rail hazardous materials receiver within an HTUA, and (5) to the rail hazardous materials receiver within an HTUA until the rail car is unloaded. Although these requirements will impose costs to industry, as highlighted by the commenter, TSA believes these provisions will significantly increase security in the rail mode. The agency believes strongly that the requirement will appreciably reduce the risk of a rail car being used in a transportation security incident inside a major U.S. metropolitan area.

Finally, while the commenter may view risk in the rail mode as low, risk is in fact dynamic, constantly evolving and shifting over time. Transportation modes once considered at low risk for a security incident may experience an increase in risk due to changes in the underlying threat, vulnerability, and consequence calculus—the three factors of which risk is a function.

For example, risk to the rail mode may rise due to the threat shifting behavior on the part of adversaries. Or, changes in standard industry practices may increase the vulnerability of the mode, causing an increase in overall risk. Conversely, natural developments, such as population growth in certain rail-centric locations across the country, may cause the consequences from a particular incident in the industry to rise, yielding an increase in the risk profile of the mode. For these reasons, the agency did not attempt to quantify benefits or risk reduction to the mode.

TSA's authority under ATSA with respect to transportation security is comprehensive and supported with specific powers related to the development and enforcement of security-related regulations and requirements. With its broad authority, the agency may assess a security risk for any mode of transportation, develop security measures for dealing with that risk, and enforce compliance with those measures. TSA strongly believes that the benefits enumerated above more than justify the potential compliance costs of this final rule. In fact, the agency is confident that the regulation will appreciably increase security in the rail mode.

2. Overestimated Compliance Costs

Comments: One information technology firm specializing in GPSs opined that TSA's estimate in the NPRM for the economic impact of the rule was too high. In its comment, the company estimated that there are approximately 50,000 affected rail tank cars in service, and that the affected firms could outfit all of them with GPS technology for less than $42 million, which represents a fraction of the economic impact TSA estimated in the RIA.

TSA Response: The rule does not require railroads or other covered entities to purchase and maintain GPS technologies. To comply with related provisions of the rulemaking, namely the location and shipping information requirement, a firm may choose to utilize GPS; however, that is the prerogative of the firm and not mandated by the regulation. The location and shipping information requirement is a performance standard, and TSA has not dictated the use of any specific technology to meet this standard.

Additionally, there are several other provisions of the rulemaking that the technology firm failed to account for when it estimated that the regulation would cost industry less than $42 million. For example, the company did not comment on the cost of RSCs, the reporting of significant security concerns, or the chain of custody and control requirements—all major provision of the rule. For these reasons, TSA did not adjust its analysis of the economic impact of the rule based on the information submitted by the commenter.

3. Underestimated Compliance Costs

A number of commenters indicated that some of the compliance costs estimated in the RIA for the NPRM were understated. Many companies, individuals, and trade associations that commented on compliance cost estimates focused on the chain of custody and control requirement, but others raised different concerns. TSA has summarized those comments by topic and responded to them below.

i. General

Comments: One individual commenter stated that the cost of this final rule will be twice as high as TSA estimated in the RIA. Without providing any details, this individual opined that the average annual cost of the rule, estimated by TSA at $15 million to the railroad industry and its shippers and receivers, was simply too low.

TSA Response: Without more detailed information on why the rule will cost industry twice the amount estimated by TSA in the RIA, we did not adjust the estimates.

ii. Chain of Custody and Control

Comments: Other commenters asserted that the proposed chain of custody provision might lead to economic issues resulting from the possible disruption of the continuous supply to chemical companies of raw materials. The commenters relayed concerns that certain Class I railroad carriers have informed some rail hazardous materials facilities that their railroads will no longer store chlorine. Instead, under the new rule, the commenters stated that receivers will have to accept product shipments on delivery.

TSA Response: TSA understands that the chain of custody and control requirements of the final rule will likely change the way that railroad carriers and rail hazardous materials facilities interact with each other with respect to the shipment of certain classes of hazardous materials. The agency agrees with the commenters that the changes spurred by the final rule will have real economic consequences. However, TSA disagrees that the chain of custody provisions will adversely affect the economy or result in supply chain disruptions of the hazardous materials to which this final rule applies.

In attempting to estimate the economic impact of the chain of custody and control provision, the agency assumed that rail hazardous materials facilities will need to modify their existing business procedures to ensure that someone is able to accept a hazardous materials shipment covered by the rule. As stated above, TSA accounted for the costs of these economic impacts in the RIA to the best of its abilities, estimating that the regulatory provision will not impose an insignificant cost on all rail hazardous materials facilities. TSA hopes that freight railroad carriers, rail hazardous materials shippers, and rail hazardous materials receivers will work together to minimize the costs of this regulation by working to speed the covered materials through the supply chain and better schedule deliveries to receivers. As the agency could not find any information to improve its RIA, the cost estimates for this provision remain unchanged.

Comments: A trade association representing the explosives industry stated that the attendance requirement, also known as the chain of custody and control provisions of the rule, could be very costly. The association also noted, however, that it could not provide any insight into the scope or level of costs that regulated parties will likely incur for this provision of the rule.

TSA Response: TSA acknowledges that there will be costs for entities in the railroad industry and others to comply with the chain of custody and control requirement. However, without more detailed information from the commenter, we decided not to change the cost estimates for this provision.

Comments: A large, Class I railroad commented that the RIA for the NPRM underestimated the direct costs for railroads and other firms to comply with the chain of custody and control requirement of the rulemaking. It stated that TSA's methodology for calculating the compliance costs of this provision was inadequate.

In particular, the railroad remarked that one of the key assumptions used in the calculation—that railroads and other firms will use a single security guard to monitor rail cars and interchanges affected by this requirement—was flawed. The carrier pointed out that a single individual supervising multiple cars in a classification yard, in many instances, will not be sufficient to comply with the rule. The company went on to state that many of its classification yards are large or constructed on a curve, making it difficult for a single person to maintain supervision of multiple cars if they are not all located adjacent to each other in a small area. In many situations, routine yard activities will also make it difficult for an individual to monitor affected cars. This flawed analytical assumption caused the agency to underestimate the cost of this requirement of the proposed rule.

TSA Response: The carrier presented several logical points in explaining how TSA failed to calculate the costs of the chain of custody provision in an accurate manner. We agree with some of the arguments put forth by the railroad, particularly the observation that a single individual, in many instances, will be unable to monitor multiple rail cars in a large area. TSA acknowledges that operational realities may make it difficult for an individual to have an “unobstructed view of the rail car prior to the delivering railroad carrier leaving the interchange point,” as we proposed in the NPRM.

For this reason, TSA has amended the language of the proposal to allow railroad carriers more flexibility in complying with the chain of custody and control provision. The final rule will not require affected entities to have an “unobstructed view of the rail car” when complying with this requirement. This change should assuage some of the concerns expressed by the railroad. It should also make it likelier that railroad carriers will be able to meet the requirement using the method described in the RIA.

TSA would also like to note that the chain of custody and control requirement is a performance standard. Different entities, using whatever means practicable, may meet the standard using different methods. So, while TSA appreciates the input from the particular railroad, its concerns may not be reflective of the broader industry. Moreover, TSA was unable to improve its estimate with the information given by the commenter. Furthermore, the agency could not find any credible data that would cause it to alter its original estimate.

Because of the rule change, and because of the lack of new, detailed information, we did not adjust our cost estimate for this provision of the final rule.

Comments: The same commenter also stated that TSA ignored the indirect costs of the chain of custody and control requirement when it estimated costs for the original RIA. In detailing the potentially significant indirect costs of the requirement, the railroad noted that the provision may force railroad firms to make sub-optimal changes to their operations, resulting in high costs to the industry.

The commenter claimed that the chain of custody and control requirement would slow the movement of freight on the national rail network. This would have serious consequences for railroad companies and their customers.

For railroad companies, constraining commodity flows could increase operating costs. For example, if the chain of custody and control requirement impedes the speed at which railroad companies currently deliver covered hazardous materials to locations in HTUAs, then companies may be forced to use multiple crews and multiple shifts for what presently takes only one crew and one shift. This would have obvious financial implications.

Likewise, the commenter stated that if shipments are slowed due to the new requirement, customers of the rail mode could also experience adverse effects, particularly to operations that are dependent on timely deliveries. In concluding this portion of its comment, the railroad stressed that anything it would have to do above and beyond current operations that would consume capacity would cost the company, and potentially its customers, money.

TSA Response: TSA agrees that the security improvements required by the final rule, particularly the chain of custody and control provision, will have cost impacts on the rail mode. We believe, however, that the provisions of the rule are essential to reducing risk in the industry and increasing the overall level of security and that the provisions need not be obstacles to efficient operations. TSA agrees that there will be changes but has considered both security and impact in finalizing the requirements.

While the carrier asserted that the rule may impact the flow of freight movements over the national rail network, the carrier failed to provide TSA with a clear, detailed exposition of how the rule will increase transit times of shipments and cause the railroads to increase staffing levels. As previously noted, railroads may well find several ways to comply with this provision. In fact, TSA contends that some railroads will be able to comply with the provision without adversely affecting rail operations. Without any new, detailed information, we could not reliably modify our original costs estimates for the final rule.

Comments: The same commenter also asserted that the RIA did not account for the fact that the number of HTUAs may expand in the future, which would increase the cost of complying with the chain of custody and control requirement of the rule. Chasing a potentially moving target, NS pointed out, would make it hard for firms to plan their operations and make long-term investments. This uncertainty would impose additional costs on the affected firms.

TSA Response: In estimating costs for the RIA, TSA did not forecast an expansion in the number of HTUAs over time, because TSA has finalized the list of HTUAs through this rulemaking. If TSA decides to make any changes to the list of applicable HTUAs, it will do so through further rulemaking. Thus, railroads and other entities affected by the rule will not need to plan for sudden changes in the list of HTUAs. Consequently, we did not adjust the RIA for potential changes to the number of HTUAs.

iii. Opportunity Cost of Foregone Investments in Rail Capacity

Comments: Maintaining and expanding railroad infrastructure to accommodate the continuing growth of freight shipments requires significant levels of investment, one commenter asserted. Money that is spent complying with Federal rules represents resources that railroad companies cannot use to expand rail capacity, something that is needed to meet the transportation needs of the nation. The commenter implied that investments in security improvements represent opportunity costs to the rail mode, and that TSA failed to account for these types of costs in the RIA.

TSA Response: For any given firm, part of the cost of every investment decision is the value of the benefits forgone from choices not taken. The issue is no different for investments in security improvements. To adequately evaluate the claims included in the comment, TSA would need data reflecting current rail capacity relative to future demand identifying projected capacity shortfalls. TSA could then compare the total cost of the chain of custody and control requirement to the total cost of industry investments in capacity. Without such data, which was not provided by the commenter, TSA could not credibly change its analysis. The agency was also unable to obtain this type of data from a public source.

4. Incidence of Compliance Costs

Comments: One commenter—a large Class I railroad—expressed concern that the private sector is expected to shoulder the costs of the final rule. It opined that shippers will pay for the cost of security regulations issued by TSA absent any government funding. An individual, echoing the comments made by the railroad, also predicted that the railroad companies would pass along compliance costs to customers in the form of rate increases.

TSA Response: Nothing in this final rule would prevent a freight railroad carrier or a rail hazardous materials facility or even a rail transit system from attempting to pass on its costs of compliance to its customers. That is a decision for each regulated party to make, one that falls outside the scope of the final rule.

Although TSA acknowledges that some firms might pass on their compliance costs, we were unable to conclusively determine if this would be a direct result of the final rule. Without further information from industry, TSA did not attempt to ascertain who would ultimately pay for the costs of the regulation other than the parties directly regulated by the rule.

5. Unintended Economic Consequence of Regulation

Comments: The cost of complying with the regulation will ultimately fall on consumers in the form of shipment rate increases, one individual stated. Increased rates for freight shipments will cause consumers to move shipments of hazardous materials from railroads to commercial motor carriers, making them more susceptible to attacks at truck stops within HTUAs. The commenter noted that it is widely accepted in risk analysis circles that chemicals are generally safer when transported by rail than by highway.

TSA Response: While some consumers may engage in intermodal substitution, the analysis put forth by the commenter is incomplete. To fully evaluate the substitution effect between rail and trucking services would require several additional pieces of information: How will the increase in railroad operating cost be reflected in the fee railroads charge to customers? Is there tank truck capacity to absorb the shifted volume such that current operating costs and fees of the trucking industry would be unaffected? Would delivery by tank truck rather than rail car require additional time in transportation? What additional capital costs would consumers be required to assume in order to accommodate a shift from rail to trucking? What additional costs would be incurred by consumers as a result of changes in plant operations to accommodate a shift from rail to trucking? How elastic or inelastic is the demand for rail transport of hazardous material? Absent these data, TSA decided it could not credibly change the cost estimates in the RIA in response to this comment.

6. Insufficient Calculation of Benefits

Comments: One individual stated that TSA failed to provide information on the approximate percentage of total risk that would be eliminated by the rule. He also noted that the re-routing of certain freight around various metropolitan areas would likely be more effective in mitigating risk to the public.

TSA Response: As previously noted, risk is dynamic—the risk of a transportation incident occurring in one mode of transportation may shift over time. In the rail mode, like all other modes, factors such as threat, vulnerability, and consequence are constantly evolving, making it difficult to quantitatively measure risk. For this reason, TSA did not attempt to quantify benefits or risk reduction to the rail industry. TSA has concluded, however, that investment in the security measures required by this rule remains a prudent course of action.

While we appreciate the individual's comments regarding the re-routing of certain types of freight around metropolitan areas, we have not evaluated that alternative at this time, although we suspect the costs of such a requirement could be significant. Further, it is illustrative that no railroads suggested this as a viable alternative to the rule. Moreover, this issue is outside the scope of this final rule, but PHMSA addressed it in its interim final rule published in the Federal Register on April 16, 2008.^[54]

Comments: Echoing the comment summarized above, a railroad carrier remarked that TSA did not weigh the costs of the regulation against the probability of a transportation security incident in the rail mode. The railroad implied that the agency, while only examining the potential consequences of an event, failed to acknowledge the relatively low probability of an attack on a rail car, and therefore did not complete a comprehensive analysis of the rule.

TSA Response: As stated several times above, risk is not a static concept. The ever-shifting, always evolving nature of risks to the transportation sector makes it very difficult for TSA to calculate the probability of an event in any particular mode. For this reason, we did not attempt to quantitatively gauge the level of risk to the rail transportation industry.

Moreover, TSA does not concede that the probability of an incident involving a rail car is relatively low. The commenter provided no facts or evidence to support its claim, and the agency strongly believes that security improvements in the industry are merited. Even if the probability of an incident in the rail mode were low, the potential consequences of such an incident could be very significant. If potential consequences are high, it is worth taking steps to deter an incident.

7. Impact on Small Entities

Comments: Some commenters expressed concern that the requirement for rail hazardous materials facilities to attend rail car exchanges during a physical transfer of custody might impose an economic burden on the industry. These commenters were particularly concerned about the economic effect on small companies that may not be open for business at the time of transfer.

TSA Response: TSA recognizes that a rail hazardous materials receiver located in an HTUA that is not open for business 24 hours a day, seven days a week, may incur some additional cost to meet the requirements of the final rule. To the best of its ability, TSA accounted for this economic impact in the RIA, estimating that rail hazardous materials facilities will collectively incur costs of over $70 million, discounted at 7 percent, over the 10-year period of analysis. To date, TSA has not received any information that would allow it to improve its estimate and therefore has not changed it for the final rule.

Comments: An industry trade association representing short line and regional railroads expressed reservations about how the chain of custody and control requirement will affect small railroad carriers. Explaining how the rule may fundamentally change the way small railroads operate, the trade association asserted that the requirement may impose a severe financial impact on the industry.

In its comment, the trade association stated that small railroad companies, unlike the large Class I railroads, generally operate less than 24 hours a day. In fact, many companies may also only operate two to three days a week, meaning that they are not always open for business when another railroad drops off a car for interchange. Furthermore, small railroads find it difficult to predict when a rail car will be dropped off for interchange, given the way many Class I railroads operate around the clock.

The commenter stated that the operational realities of the industry will make it difficult for small railroads to comply with the chain of custody and control requirement without making significant changes to their practices. The trade association contended that small railroad carriers will need to evolve from scheduled, weekday businesses into firms operating 24 hours a day, seven days a week, in order to adequately follow the chain of custody and control provision, which will require firms to document the transfer of custody of a rail car. With no new source of revenues to offset the increased operating costs, the commenter argued that the effects of this change will be financially devastating for small railroads.

TSA Response: TSA appreciates the special needs of the smaller railroads represented by the commenter and has no doubt that the unique characteristics of the industry pose special issues. The chain of custody and control requirement is a paramount feature of this rule and represents a new business process for the industry in general. We realize the provision will impact firms financially.

We do not agree, however, with some of the assertions made by a trade association. First, the rule does not require small Class II and Class III railroads to change their hours of operation. While it is true that the chain of custody and control requirement will impact current industry practices, small railroads are free to meet the requirement, which is a performance standard, in almost any way practicable. Because it is also incumbent upon Class I railroads to meet the performance standard, TSA anticipates railroads may need to increase their level of coordination with respect to interchanges of covered hazardous materials. The agency believes that this can occur without substantial changes to small railroads' hours of operations or staffing levels.

Furthermore, lacking detailed information on the types of costs likely to be incurred by smaller railroads, TSA could not credibly modify its cost estimates for this provision of the rule. In its comment, the trade association did not specifically lay out how affected small entities would meet the requirement, and how the small entities' actions would impose high financial costs. The trade association did not direct TSA to more information that would allow it to more fully understand the operational and financial impacts of the provision.

Despite all the comments on this provision, TSA strongly believes that the security benefits of improved chains of custody and control are critical for securing the nation's rail network. During the public comment period, TSA did not receive any recommendations for less-costly alternatives that would attain the security goal of this provision of the rule. For this reason, TSA sees no reason to exclude the chain of custody provision that TSA proposed in the NPRM.

Comments: With respect to rail hazardous materials facilities, an individual questioned whether TSA had any further information on the number of small facilities likely to incur costs to secure their property. This individual noted that, in the RIA provided with the NPRM, TSA estimated that between two and 14 small facilities will need to install security fencing to comply with the rule.

TSA Response: We have not adjusted the original estimate of the number of small facilities likely to incur cost as a result of the rule. During the comment period, the agency did not receive any new information that would cause it to modify its initial estimate, nor could it find any new information to belie its original claim. The estimate, therefore, of two to 14 small facilities remains the same for the RIA for the final rule.

8. Impact on International Trade

Comments: Another individual asserted that the RIA for the NPRM failed to adequately examine whether the rule will adversely impact international trade. Specifically, he stated that TSA did not sufficiently analyze whether the rule will interfere with international boundary crossing inspection procedures of tank cars.

TSA Response: The chain of custody requirements do not apply at any shipper facilities located outside the United States. Rather, for international shipments to the United States, the requirements begin at the first railroad carrier interchange point and apply to all subsequent carrier interchanges that are otherwise subject to this final rule. The requirements also apply at a rail hazardous materials receiver located in an HTUA, regardless of whether the rail car originated at a foreign or domestic location. Accordingly, this final rule does not affect any existing requirements applicable to inspections of tank cars entering the United States from a foreign location.

L. Comments Beyond the Scope of the Rule

Comments: Two commenters supported the rerouting of hazardous materials around cities. The Government of the District of Columbia (District) commented on the feasibility of using technologies that incorporate chemical sensors and open hatch detection into GPS tracking systems to immediately notify local officials and first responders of potential tank car leaks, in order to meet the proposed location and shipping information requirements in § 1580.103. The District asserted that because of the unique risks that the city faces, such security measures could not substitute for rerouting all hazardous materials around the District.

TSA Response: The topic of rerouting of hazardous materials around cities is outside the scope of the NPRM, and therefore TSA is not addressing it in this final rule. However, TSA notes that on December 21, 2006, PHMSA published an NPRM in the Federal Register, proposing to revise the current requirements in the HMR applicable to the safe and secure transportation of hazardous materials transported in commerce by rail. 71 FR 76852. Section I.B. “Purpose of the Rule” contains a discussion of PHMSA's proposed requirements. PHMSA published its interim final rule in the Federal Register on April 16, 2008.

V. Rulemaking Analyses and Notices

Changes to Federal regulations must undergo several economic analyses. First, Executive Order 12866 (E.O. 12866), Regulatory Planning and Review (58 FR 51735, October 4, 1993), directs each Federal agency to propose or adopt a regulation only upon a reasoned determination that the benefits of the intended regulation justify its costs. Second, the Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq., as amended by the Small Business Regulatory Enforcement Fairness Act of 1996), requires agencies to analyze the economic impact of regulatory changes on small entities. Third, the Trade Agreements Act (19 U.S.C. 2531-2533) prohibits agencies from setting standards that create unnecessary obstacles to the foreign commerce of the United States. Fourth, the Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1531-1538) requires agencies to prepare a written assessment of the costs, benefits, and other effects of proposed or final rules that include a Federal mandate likely to result in the expenditure by State, local, or tribal governments, in the aggregate, or by the private sector, of $100 million or more annually (adjusted for inflation). The OMB A-4 Accounting Statement is located in the full Regulatory Impact Assessment, which is located in the docket.

In conducting these analyses, TSA determined:

(1) This rulemaking does not constitute an economically ”significant regulatory action” as defined in E.O. 12866.

(2) This rulemaking is unlikely to have a significant economic impact on a substantial number of small entities under § 605(b) of the Regulatory Flexibility Act (5 U.S.C. 601 et seq.). To make this determination, we conducted a Final Regulatory Flexibility Analysis (FRFA), which is available below.

(3) This rulemaking does not constitute a barrier to international trade.

(4) This rulemaking does not impose an unfunded mandate on State, local, or tribal governments, or on the private sector.

TSA summarizes the E.O 12866 analysis, international trade analysis, and the unfunded mandates analysis, though provides the FRFA in its entirety.

A. Executive Order 12866 Assessment (Regulatory Planning and Review) Impact Summary

The rule addresses threats and vulnerabilities in the rail transportation sector. This summary provides a synopsis of the costs and benefits of the final rule.

Benefits of the Final Rule

The final rule enhances the security of rail transportation by: (1) Requiring the protection of SSI in the rail transportation sector; (2) clarifying TSA and DHS authority to conduct inspections in order to assess and mitigate threats to security; (3) providing TSA and DHS with a regulatory mechanism to locate rail cars containing certain hazardous materials; (4) mandating that rail hazardous materials facilities that ship or receive these materials conduct routine inspections of shipments; (5) creating a secure chain of custody requirement for the transfer of rail cars containing these materials; and (6) requiring certain rail hazardous materials shipper and receiver facilities to store rail cars containing these hazardous materials in areas with physical security controls.

Costs of the Final Rule

The costs of the final rule result primarily from the requirements for:(1) Freight railroad carriers and rail hazardous materials shippers and receivers to establish secure chains of custody for hazardous materials covered by the rule; and (2) railroad carriers, rail hazardous materials shippers, and rail hazardous materials receivers to provide TSA and DHS with various pieces of information. TSA concluded that the present value total cost (7 percent discount rate) of the rule will range from $152.8 million to $173.9 million. See Figure 1 for the primary 10-year cost estimate, which equals $163.3. TSA has provided a detailed discussion in the docket of how TSA calculated this estimate and the range of estimates discussed above.

B. Regulatory Flexibility Act Assessment

In accordance with the Regulatory Flexibility Act (5 U.S.C. 601-612), TSA prepared this Final Regulatory Flexibility Analysis (FRFA) that examines the impacts of the final rule on small entities. A small entity may be: (1) A small business, defined as any independently owned and operated business not dominant in its field that qualifies as a small business per the Small Business Act; (2) a small not-for-profit organization; or (3) a small governmental jurisdiction (locality with fewer than 50,000 people).

This FRFA addresses the following:

1. The objectives of and legal basis for the final rule;

2. The reason the agency is considering this action;

3. Significant issues raised during the public comment period;

4. The number and types of small entities to which the rule applies;

5. Projected reporting, recordkeeping, and other compliance requirements of the final rule, including the classes of small entities that will be subject to the requirements and the type of professional skills necessary for preparation of the reports and records; and

6. Flexibility in the final rule.

Background and Legal Authority

TSA has the responsibility for enhancing security in all modes of transportation. Under ATSA, and delegated authority from the Secretary of Homeland Security, TSA has broad responsibility and authority for “security in all modes of transportation * * * including security responsibilities * * * over modes of transportation that are exercised by the Department of Transportation.” ^[55] TSA has authorities in addition to those transferred from DOT. TSA is specifically empowered to develop policies, strategies, plans and regulations for dealing with threats to all modes of transportation, including mass transit.^[56] As part of its security mission, TSA is responsible for assessing intelligence and other information to identify individuals who pose a threat to transportation security and to coordinate countermeasures with other Federal agencies to address such threats.^[57] TSA also is empowered to enforce security-related regulations and requirements,^[58] ensure the adequacy of security measures for the transportation of cargo,^[59] oversee the implementation, and ensure the adequacy, of security measures at transportation facilities,^[60] and carry out other appropriate duties relating to transportation security.^[61] TSA has broad regulatory authority to achieve ATSA's objectives, and may issue, rescind, and revise such regulations as are necessary to carry out TSA functions,^[62] and may issue regulations and security directives without notice or comment or prior approval of the Secretary of DHS.^[63] TSA is also charged with serving as the primary liaison for transportation security to the intelligence and law enforcement communities.^[64]

TSA's authority with respect to transportation security is comprehensive and supported with specific powers related to the development and enforcement of regulations, security directives, security plans, and other requirements. Accordingly, under this authority, TSA may assess a security risk for any mode of transportation, develop security measures for dealing with that risk, and enforce compliance with those measures.

TSA's legal authority is supported by National policy. On December 17, 2003, the President issued Homeland Security Presidential Directive 7 (HSPD-7, Critical Infrastructure Identification, Prioritization, and Protection), which “establishes a national policy for Federal departments and agencies to identify and prioritize United States critical infrastructure and key resources and to protect them from terrorist attacks.” ^[65] In recognition of the lead role assigned to DHS for transportation security, and consistent with the powers granted to TSA by ATSA, the directive provides that the roles and responsibilities of the Secretary of DHS include coordinating protection activities for “transportation systems, including mass transit, aviation, maritime, ground/surface, and rail and pipeline systems.” ^[66] In furtherance of this coordination process, HSPD-7 provides that DHS and DOT will “collaborate on all matters relating to transportation security and transportation infrastructure protection.” ^[67] (HSPD-7, Paragraph 22(h).)

In accordance with the September 2004 Memorandum of Understanding (MOU) between DHS and DOT, the two departments consult and coordinate on security-related rail and hazardous materials transportation issues to ensure they are consistent with overall DHS security policy goals and objectives and the regulated industry is not confronted with inconsistent security guidance or requirements promulgated by multiple agencies.

Statement of Need for the Regulatory Action

TSA developed the final rule to mitigate threats and vulnerabilities in the rail transportation network. In the United States, the freight rail transportation system transports hundreds of millions of dollars worth of freight and employs hundreds of thousands of individuals annually.^[68] Passenger systems, including passenger railroad carriers as well as rail mass transit systems, carry millions of people daily throughout the country.

Rail transportation networks—both passenger and freight—are vulnerable to a variety of transportation security incidents. In the past, terrorists have targeted passenger and mass transit rail transportation systems to inflict mass casualties (e.g., Tokyo 1995; Moscow 2000, 2001, and 2004; Madrid 2004; London 2005; and Mumbai 2006). Freight rail systems also represent potential terrorist targets. Although not the result of a deliberate attack, the incident involving a ruptured chlorine tank car in Graniteville, South Carolina, killed nine people and injured hundreds more. These incidents highlight the fact that hazardous materials in rail transportation and rail passenger systems are possible targets of terrorism intended to inflict hundreds or even thousands of fatalities, with direct and indirect costs from transportation system disruption that could total billions of dollars.

The final rule attempts to reduce the probability that such an event will occur by: (1) Requiring the protection of sensitive security information in the rail sector; (2) clarifying TSA's authority to conduct inspections of rail security operations; (3) requiring the designation of an RSC and an alternate; (4) requiring covered entities to have the ability to report on rail car locations and shipping information for cars under their physical custody and control; (5) requiring covered entities to report significant security concerns to TSA; and (6) requiring covered entities to establish chain of custody and control standards for certain hazardous shipments.

Issues Raised in Public Comments

TSA received public comments on the Initial Regulatory Flexibility Analysis that was issued in support of the NPRM during the public comment period. All comments are available for the public to view at the Federal Docket Management System: http://www.regulations.gov/​search/​index.jsp.

As part of this rulemaking effort, TSA has summarized and responded to all public comments relating to the Initial Regulatory Flexibility Analysis issued with the NPRM. Comment summaries and responses are located in the preamble to the final rule, which is also available at http://www.regulations.gov/​search/​index.jsp and in the Federal Register.

Description and Estimated Number of Small Entities

The regulated entities are divided into railroad carriers, transit systems, and rail hazardous materials facilities. Rail hazardous materials facilities are primarily chemical manufacturers, although some wholesalers may also ship chemicals. Additionally, some ammonia producers classify themselves as support activities for agriculture or agricultural wholesalers. Figure 1 provides the North American Industry Classification System (NAICS) codes and SBA standards for defining small entities for the sectors expected to be affected by the rule.

Figure 1—Firm Size Standards

Industry	NAICS	Small business standard
Line Haul railroads	482111	1,500 FTEs.
Short line railroads	482112	500 FTEs.
Transit Systems	485	$6.5 million.
Petrochemical manufacturing	32511	1,000 FTEs.
Alkalis and chlorine manufacturing	325181	1,000 FTEs.
All other basic inorganics	325188	1,000 FTEs.
All other basic organics	325199	1,000 FTEs.
Plastic and resin manufacturing	32511	750 FTEs.
Nitrogen fertilizer manufacturing	325311	1,000 FTEs.
Other chemical manufacturing	325	500-1,000 FTEs.
Support activities for rail	48821	$6.5 million.
Petroleum refineries	32411	1,500 FTEs.
Pulp and paper mills	3221	750 FTEs.
Support activities for agriculture	1151	$6.5 million.
Chemical wholesalers	42469	100 FTEs.
Agricultural wholesalers	42491	100 FTEs.
Electric utilities	2111	<4 m megawatt hours/year.
Water and sewage systems, private	2213	$6.5 million.
Water and sewage systems, public	92	<50,000 people serviced.
Source: Small Business Administration.

Overall, of all the regulated parties, TSA identified 651 entities that may meet the SBA definition of a small entity. These entities reflect the following makeup:

Figure 2—Types of Small Entities

Type	Count
Railroads	549
Transit, Other	86
Small Rail Hazardous Materials Facilities	16
Total	651

The number of small railroad carriers potentially affected by the rule is difficult to estimate accurately, because most local railroad carriers are privately owned. Based on the Association of American Railroads (AAR) data on employment and revenues, TSA assumed that all railroad carriers, except the seven Class I railroads, are small entities. This assumption may be conservative, because some private companies own a number of local railroads and may exceed the 500 full-time equivalent (FTE) size limits. Figure 3 presents the AAR data on the number of railroads, average revenues, and average number of FTEs.

Figure 3—Railroad Types by Average Revenue and Number of Employees

Type	Number	Average freight revenue	Average number of FTEs
Class I	7	$5,590,000,000	21,100
Regional	31	45,483,871	239
Local	314	3,121,019	17
Switching and Terminal	204	3,137,255	32
Source: American Association of Railroads.

The Bureau of Transportation Statistics (BTS) lists 152 transit systems (21 commuter rail systems, 45 rail transit systems, and 86 other rail transit systems).^[69] Of these 86 listed as “other,” the systems include cable car, inclined plane, monorail, and automated guideway.^[70] As shown in Figure 4, only the systems in the “other” category have average passenger revenues of less than $6.5 million, which is the SBA standard for small transit entities. The other transit systems not only have average passenger revenues that exceed the standard, but are also generally operated by governmental entities that receive financial support from the Federal and State governments. TSA did not identify any systems that qualified as small. It is unlikely that local governments that meet the SBA standard for small governments (50,000 people served) operate rail transit systems. Consequently, TSA has included only the “other” entities as potentially affected small entities.

Figure 4—Transit Systems by Average Revenues

Type	Number	Average annual passenger revenue
Heavy Rail	14	$189,590,000
Light Rail	27	8,490,000
Commuter Rail	21	73,910,000
Other	86	590,000
Source: BTS.

Of the 241 rail hazardous materials facilities identified from the Risk Management Program (RMP) data, there are 29 facilities that at first review appeared to be small entities based upon the facility employee count. However, within these 29, research on corporate relationships revealed that, at most, 16 facilities are potentially small. As explained in Section 5.6.1 of the separate full evaluation, only facilities with less than 21 employees are expected to incur incremental costs related to creating secure storage areas, while all will incur costs for the other requirements. Based upon this threshold of 20 or less employees, at most eight facilities could have costs. Three of these facilities have revenue data that suggests a large firm. Additionally, descriptions of operating locations and business lines on the World Wide Web suggest that these three facilities have a higher number of employees than small entities and that they are parts of much larger firms. Although TSA is using eight as the number of facilities for purposes of the analysis below, this may overstate the number of firms.

Figure 5 presents the data distribution by FTE for hazardous materials facilities that may be SBA-defined small entities. Of the total facilities assumed to be small, 14 have less than 100 employees while only two have 100 or more.^[71]

Figure 5—Affected Small Rail Hazardous Materials Facilities

Number of FTEs	Rail hazardous materials facilities
100+	2
50-99	3
21-49	5
10-20	5
1-9	1
Potential Small Entities	16
Source: TSA Calculations.

Description of Compliance Requirements

Railroads will have to submit the name(s) of and engage in training of the RSC, document chain of custody transfers, and file incident reports and car location reports as needed. TSA assumed that regional and local railroad carriers handled hazardous materials shipments in proportion to their percentage of total freight carried. Again, this assumption may be conservative because it is likely that Class I carriers move most chemicals. Figure 6 presents the costs for an average regional, local, and shortline and terminal (S&T) rail carrier to comply with the requirements.

Figure 6—Average Costs to Railroads by Size

Requirement	Unit cost	Number Activities/year	Regional	Local	S & T
RSC	$91.00	2	$182	$182	$182
Incident Report	63.00	2	126	126	126
Chain of Custody	4,969,723	Weighted by % of Revenue	5,362	368	370
Location	91.00	1	91	91	91
Total			5,761	767	769
Source: TSA Calculations.

As discussed above, only the 86 transit systems in the “other” category in Figure 4 are expected to be small entities according to SBA standards.^[72] These small transit systems will only incur unit costs for submission of RSC information and incident reporting. Both the RSC and incident reporting costs are expected to be incurred on average just once per year per small transit system, resulting in average costs per system of just $245, as shown in Figure 7.

Figure 7—Average Costs for Small Transit Systems

Requirement	Unit cost	Number of activities/year	Regional
	A	B	A × B
RSC	$91.00	2	$182
Incident Report	63.00	1	63
Total			245
Source: TSA Calculations.

As explained above, the cost for hazardous materials facilities includes the cost of adding fencing, training, and inspections, plus the types of cost incurred by railroads. TSA assumed that each facility will train an average of 10 workers and the number of inspections per small facility is based on the assumption that the number of inspections is proportional to the quantity of chemical held. The 16 small rail hazardous materials facilities represent about 2.7 percent of the covered hazardous materials affected chemicals; therefore 2.7 percent of the inspections were divided among the 16 firms to estimate 191 inspections a year. Figure 8 presents the average costs for a hazardous materials facility with 20 or fewer employees. Because fencing is a capital cost, Figure 8 and Figure 9 also present the cost based on amortizing the fencing cost over 10 years at 7% discount rate.^[73]

Figure 8—Average Costs for Small Rail Hazardous Materials Facilities (<21 Employees)

Requirement	Unit cost	Number	First-year cost	Annual after 1st year
	A	B	A × B
Secure Storage Area	$16,150	1	$16,150	$2,299
RSC	91	1	91	91
Training	63	10	630	630
Inspections	11	191	2,006	2,006
Incident Report	63	1	63	63
Chain of Custody	42,481	1	42,481	42,481
Location Reporting	91	1	91	91
Total			61,512	47,661
Source: TSA Calculations.

Figure 9—Average Costs for Small Rail Hazardous Materials Facilities (>=21 Employees)

Requirement	Unit cost	Number	First-year cost	Annual after 1st year
	A	B	A × B
RSC	$91	1	$91	$91
Training	63	10	630	630
Inspections	11	191	2,006	2,006
Incident Report	63	1	63	63
Location Reporting	0	0	0	0
Total			2,790	2,790
Source: TSA Calculations.

To examine the overall impact on small firms, a traditional method is to compare costs as a percentage of revenue. TSA was unable to find revenue information on six of the 16 small rail hazardous materials facilities. One approximation method is to use known average revenues per employee as a proxy. For those firms in this group of small facilities with revenue information available, the average revenue per employee is approximately $685,000. There is, however, one firm with revenue as low as $50,000 per employee. This wide range suggests an alternative value must also be considered. For the compliance impacts in Figure 10, TSA used the smallest revenue per employee number to create a proxy for the missing revenue values as the “Low End” estimate. For the “Average” estimate, TSA substituted the average $685,000 as the revenue per employee. For each identified rail hazardous materials facility that may be a small entity, a letter identification label is used to avoid listing specific business names. For the railroads, averages appeared to be representative and only one estimate for each rail or transit type is presented. Figure 10 presents the average costs as a percent of average revenues with the missing data replacement described above. As can be seen, most instances have a relatively low cost/revenue relationship. However, five instances in the “low-end” case and two in the “average” case could have much higher impact if the unknown firm revenues are reflected by the estimation technique.

Figure 10—Average First-Year Compliance Costs as a Percent of Revenue

(A) ID	(B) Revenue: low end estimate	(C) Revenue: average estimate	(D) Cost impact	(E = D/B) Cost ÷ revenue (low end) (percent)	(F = D/C) Cost ÷ revenue (average) (percent)
Rail and Transit
Regional		$45,483,871	$16,624		0.0
Local		3,121,019	1,465		0.0
S & T		3,137,255	2,411		0.1
Small Transit		590,000	154		0.0
Small Rail Hazardous Materials Facilities
A	$300,000	4,108,192	61,512	20.5	1.5
B	600,000	8,216,383	61,512	10.3	0.7
C	650,000	8,901,082	61,512	9.5	0.7
D	24,400,000	24,400,000	61,512	0.3	0.3
E	850,000	11,639,876	61,512	7.2	0.5
F	1,000,000	1,000,000	61,512	6.2	6.2
G	4,600,000	4,600,000	2,790	0.1	0.1
H	1,100,000	1,100,000	2,790	0.3	0.3
I	12,000,000	12,000,000	2,790	0.0	0.0
J	10,000,000	10,000,000	2,790	0.0	0.0
K	27,000,000	27,000,000	2,790	0.0	0.0
L	24,400,000	24,400,000	2,790	0.0	0.0
M	2,500,000	34,234,930	2,790	0.1	0.0
N	19,600,000	19,600,000	2,790	0.0	0.0
O	190,000,000	190,000,000	2,790	0.0	0.0
P	130,000,000	130,000,000	2,790	0.0	0.0

Flexibility in the Final Rule

Four parts of the final rule provide small entities with regulatory flexibility, helping them to minimize their compliance costs.

First, the final rule will not require some railroad carriers, including certain tourist and scenic railroads, to maintain RSCs unless otherwise notified by TSA. This should provide some flexibility to certain smaller railroads not hauling freight.

Second, the provision that requires freight railroad carriers and rail hazardous materials facilities to provide TSA with the location and shipping information of certain rail cars has been modified to allow smaller companies more flexibility. Upon request by TSA, each Class I railroad must provide information to TSA no later than five minutes if the request concerns only one rail car and no later than 30 minutes if the request concerns more than one rail car. Conversely, the rule will require rail hazardous materials facilities and freight railroads other than the Class I carriers, upon request by TSA, to provide the agency with location and shipping information of rail cars within 30 minutes, regardless of the number of rail cars covered by the request. Moreover, the rule will also allow carriers to use a designated third party or agent to provide the car location and shipping information so long as the designated third party can provide accurate information within the specified timeframe. These policies should provide smaller railroads and rail hazardous materials facilities with some regulatory relief.

Third, with respect to the chain of custody provision of the final rule, TSA added a new definition for what constitutes an “attended” rail car during an exchange of custody. The new definition, which TSA created after receiving many comments from industry, allows railroad carriers and rail hazardous materials facilities greater flexibility by stating that a representative of a railroad or rail hazardous materials facility does not have to maintain a line of sight with all rail cars during an exchange of custody. Railroads and rail hazardous materials facilities will now only need to ensure that an employee or representative is in reasonable proximity to the rail car(s), monitoring an exchange of custody in a manner that would allow them to properly detect unauthorized activity. This flexibility should allow firms to comply with the provisions using less costly methods than would have been otherwise possible.

Fourth, the final rule will allow rail hazardous materials facilities that receive covered shipments located in HTUAs to request an exemption from the chain of custody and control section if they believe, based on operational and geographic characteristics, that the potential security threat to the facility does not warrant the application of the security measure.

These measures should allow affected firms—both large and small—some flexibility in complying with the rule.

Identification of Duplication, Overlap, and Conflict With Other Rules

This rail transportation security rule affects entities that are also subject to the requirements of other DHS rules—the DHS Chemical Facility Anti-Terrorism Standards (CFATS) regulation and the Coast Guard's Maritime Transportation Security Act (MTSA) regulations. TSA has provided a more detailed discussion in Section II of this preamble.

Conclusion

While approximately 70% of the total affected entities were identified as small entities, the estimated compliance costs associated with this rulemaking are low on a per entity basis except for the identified five (“low end case”) and two (“average case”) facilities. Rail hazardous materials facilities are allowed great flexibility in selecting the physical security measures needed to ensure no unauthorized persons gain access to the rail secure area, and may select lighting, video surveillance, or other appropriate methods besides fencing to meet the performance standard. Certain rail hazardous materials facilities may receive an exemption from some or all of the chain of custody and control requirements. TSA notes that these cases with the significant impact are costed using the most expensive compliance method (fencing). These businesses may in fact have much lower impacts based upon the performance standard compliance alternatives or exemption. Based on this analysis, TSA believes that this FRFA shows that an estimated impact of the two cost scenarios with impact of over 6% on either five out of 651 firms (0.8 percent) or 2 out of 651 firms (0.3 percent) is unlikely to constitute a substantial number under section 605(b) of the RFA (5 U.S.C. 601 et seq.).

C. Paperwork Reduction Act

The Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.) requires that TSA consider the impact of paperwork and other information collection burdens imposed on the public and, under the provisions of § 3507(d), obtain approval from the Office of Management and Budget (OMB) for each collection of information it conducts, sponsors, or requires through regulations.

This final rule contains new information collection activities subject to the PRA. Accordingly, TSA has submitted the following information requirements to OMB for its review.

This final rule will require: (1) Freight and passenger railroad carriers, rail transit systems, certain rail hazardous materials shipper and receiver facilities, tourist, scenic, historic, and excursion rail operations (whether operating on or off the general railroad system of transportation), and private rail car operations (on or connected to the general railroad system of transportation) to allow TSA and DHS officials working with TSA to enter and be present within any area or within any conveyance to conduct inspections, tests, or to perform such other duties as TSA directs, including copying of records; (2) freight railroad carriers, certain rail hazardous materials shipper and receiver facilities, passenger railroad carriers, and rail mass transit systems to designate and submit contact information for an RSC and at least one alternate RSC to be available to TSA on a 24-hours, 7 days a week basis to serve as the primary contact for receipt of intelligence information and other security-related activities and coordinator of security practices and procedures with appropriate law enforcement and emergency response agencies; (3) freight and passenger railroad carriers, certain rail hazardous materials shippers and receivers, passenger railroad carriers, rail mass transit systems, tourist, scenic, historic, and excursion rail operations (whether operating on or off the general railroad system of transportation), and private rail car operations (on or connected to the general railroad system of transportation) to immediately report potential threats and significant security concerns to DHS; and (4) freight railroad carriers and certain rail hazardous materials shippers and receivers to provide for a secure chain of custody and control of rail cars containing a specified quantity and type of hazardous material.

This proposal would support the information needs of TSA to enhance security in the following modes of transportation: freight rail, including freight railroad carriers, rail hazardous materials facilities which offer, load, prepare, receive and/or unload certain types and quantities of hazardous materials, and private cars; passenger rail, including passenger railroad carriers such as intercity and commuter passenger rail operations, rail transit systems, tourist, scenic, historic, and excursion rail operations (whether operating on or off the general railroad system of transportation), and private rail car operations (on or connected to the general railroad system of transportation).

TSA estimates that the final rule will affect 945 respondents, including freight railroad carriers, passenger railroad carriers and rail hazardous materials facilities. TSA has revised this estimate slightly from 949 respondents estimated in the NPRM after further consideration. These different respondents will have different reporting responsibilities under this final rule. TSA will require all affected entities to submit RSC contact information to TSA. The agency estimates that each of the 945 freight and passenger railroad carriers, rail transit systems, and rail hazardous materials shippers and receivers will respond once to submit RSC information to TSA, resulting in 945 responses.

Additionally, all affected entities will need to report significant security concerns to TSA. To forecast the number of responses, TSA adopted assumptions on the number of incidents by industry segment (e.g., freight rail, passenger rail, etc.). First, the agency estimates that each freight railroad carrier will respond anywhere from one to 36 times per year depending on the amount of PIH materials the carrier transports. TSA estimates that each passenger railroad and rail transit entity will respond between zero and 1,460 times per year. TSA estimates that each rail hazardous materials shipper and receiver facility will respond from zero to two times per year. In total, the agency expects the affected entities to send the government information anywhere from 45,893 to 93,073 times per year for this requirement, down from the 49,762-99,862 annually frequency TSA estimated in the NPRM. As a primary estimate, TSA estimates that there will be 69,483 incident reports per year.

Finally, this final rule will require affected entities to provide TSA with information on the location and shipping information on certain railcars upon request. TSA estimates that it will initiate between 105 and 255 requests per year, with a primary estimate of 150 requests per year.

Thus, the annual frequency of information requirements is between 46,943 and 94,273. Adding the three primary estimates yields a total of 70,578 responses per year. (945 + 69,483 + 150 = 70,578).

TSA estimates that the total annual hour burden is 288,945 hours. This figure was derived by adding the annual burdens for RSC reporting (312) + location and shipping reporting (150) + primary significant security concerns reporting (69,483) + chain of custody reporting (219,000) = 288,945. After further consideration, TSA has revised its annual recordkeeping and reporting cost burden from the range of $3,420,655 to $6,576,955 to an estimated $9,388,567. This figure was derived by adding the annual costs for RSC reporting ($28,378) + location and shipping reporting ($13,650) + primary significant security concerns reporting ($4,377,429) + chain of custody reporting ($4,969,110) = $9,388,567. Larger reporting burdens are anticipated for passenger rail systems due to higher estimates of suspicious incident reports.

TSA received various comments related to the information collection generally. One mass transit agency asked whether a list of security coordinators previously sent to TSA to comply with the rail security directives would satisfy § 1580.201's requirement to appoint an RSC. Passenger railroad carriers and rail transit systems that have already provided the required information on their primary and alternate RSCs to TSA do not have to take further action unless any of the contact information changes. However, all changes to the names, titles, telephone numbers, and e-mail addresses of the RSCs and alternate RSCs must be reported to TSA within seven calendar days.

TSA received numerous comments about the interrelationship between the reporting requirements of this rule and the reporting that occurs in response to other regulatory programs or other procedures. Commenters urged TSA to increase coordination and eliminate unnecessary duplication. For example, one trade association said that certain facilities are currently reporting significant security concerns to the FBI, local authorities, and the Coast Guard. The association said that TSA should use these existing reports to gather information rather than creating an additional reporting requirement. The association suggested that if TSA maintains this reporting requirement in the final rule, it should only apply to the certain hazardous materials determined to pose a higher security risk (such as materials poisonous by inhalation, explosives, and radioactive materials).

Several commenters wrote about the relationship between the proposed reporting requirement and the reporting requirement in 49 CFR 659.33, asking TSA to clarify the role of State oversight agencies in the reporting process. Some State DOTs said that the proposed reporting would partially duplicate the reporting requirements of the State oversight program, which would force rail systems to develop multiple sets of procedures and processes.

Commenters suggested the following options for coordinating or merging the proposed reporting requirement with similar existing requirements:

• Create a centralized or “one stop” reporting process for stakeholders.
• Avoid any “excessive” duplication between the safety oversight and rail security programs.
• Minimize redundant reporting and ensure there is coordination of FRA, National Transportation Safety Board (NTSB), and TSA reporting requirements.
• Parallel the proposed reporting requirement with existing requirements (or vice versa).
• Allow reporting to other jurisdictional law enforcement agencies to meet the requirement of reporting to TSA.
• Allow reporting to the State oversight agency to fulfill TSA's requirement.
• Make the proposed reporting requirement more consistent with posting to the public transportation portion of the Homeland Security Information Network.
• Modify the reporting requirements for the National Transit Database to support TSA's needs.
• Require that covered entities send reports to the National Response Center as the primary and sole reporting center for the purposes of this section and develop a mechanism for TSA to receive reports of significant security concerns from the National Response Center.

A trade association asserted that many jurisdictions and authorities also want immediate reports. The association suggested that TSA consider adding language that helps regulated entities prioritize all of the notifications that they are required to make.

In response to these comments, TSA has determined that it needs information immediately on potential threats, suspicious activities, and security incidents for the purposes of comprehensive intelligence analysis, threat assessment, and allocation of security resources. Reporting of security concerns must be made to the Freedom Center, which maintains communications networks with other Federal operations centers, such as DOT's Crisis Management Center, to convey reported security concerns to interested entities throughout the Federal government.

Reports submitted to State oversight agencies under 49 CFR 659.33 will not satisfy the requirements of this final rule. Reports to the oversight agencies meet a more general need for situational awareness, particularly pertaining to safety conditions. There is not extensive overlap between the required reporting under this final rule and the reporting under 49 CFR 659.33. Where there is overlap, TSA would expect that rail transit systems would follow procedures for reporting to TSA as well as to the State agencies.

Reporting requirements to the National Response Center are not co-extensive with the reporting requirements of this rule, which is broader in scope. For example, this rule would require reporting of such things as threat information and the discovery of suspicious items. Covered entities need not report these to the National Response Center, but are useful pieces of information to TSA as indicators of potential terrorist activities. Therefore, TSA cannot rely on obtaining reports from the National Response Center. Moreover, obtaining reports indirectly from the National Response Center, the States, or other third parties might delay a needed response or may not contain adequate information for TSA's purposes.

The Chairman and four members of the U.S. House Committee on Homeland Security expressed the view that the proposed reporting requirements would not improve rail security. They commented that the reporting requirements would not make the industry proactive in deterring terrorists and that, instead of collecting data for study after incidents have occurred, TSA should provide the industry with mandatory, standardized security practices and mandated training programs. TSA believes that the requirements to report significant security concerns have great value in the overall approach to enhancing rail security, and disagrees with the commenters' view that the reporting requirements do not advance that objective. When TSA analyzes reports of significant security concerns from passenger rail carriers (including rail transit systems), freight railroad carriers, and rail hazardous materials shippers and receivers, TSA will be able to determine if there are geographic or other patterns to the reported activities. These analyses may enable TSA to prevent or interrupt terrorist planning or attack. In addition, these analyses assist TSA in determining whether inspections should be targeted at particular areas or activities. Finally, TSA can use the reported incidents to determine whether to encourage or require particular security measures either immediately or in the future.

Many commenters said that TSA's definition of reportable events is too broad and should be more narrowly focused. Several comments from transit authorities said that the proposed reporting requirements would impose a substantial burden on transit systems and even on TSA itself. They also asserted that the proposed requirements would result in an overload of information that would divert attention from truly significant threats and dilute the effectiveness of the reporting system. Other commenters asked for a more specific description of “suspicious” activities or a list of examples that would, or would not, be considered “suspicious.” A commenter identified “youth vandalism” as an incident that should not be reportable.

Several commenters offered specific suggestions for which activities or incidents should be considered reportable. Some commenters suggested that the requirement focus only on activities that pose a security threat to rail cars carrying the hazardous materials specifically covered by the regulation.

An industry association noted that the events that must be reported to DOT are very specific (such as a person being killed or requiring hospitalization) and suggested that TSA's reportable events be more specific and similar to DOT's. One commenter suggested that TSA only require the reporting of certain specific crimes. Another commenter made specific suggestions regarding the categories of events that should be reported to TSA.

In response to these comments, TSA is aware that the proposed reporting requirements are broad and, in some respects—such as the requirement to report “suspicious” activities—are not as specific as the regulated community would like. However, TSA has not changed the reporting requirements in the final rule for several reasons. The reporting requirements are intended to reduce risk to the rail transportation systems by providing TSA with information to intervene on a timely basis to thwart a threat or further attack. Detecting activities that may compromise transportation security entails piecing together seemingly unrelated incidents or observations and conducting analysis in context with information from other sources. As the threat environment is dynamic and indications of planning and preparation for an incident that may compromise transportation security are subject to change, a threshold for reportable events or a specific definition cannot be provided.

TSA has decided not to accept commenters' suggestions to limit the scope of the reporting requirement. Limiting the scope to the DOT reporting requirements, which are intended to identify safety concerns, would reduce the data that TSA could use for trend analysis to anticipate and prevent an attack. Limiting incident reporting to only those materials that are determined to be sensitive security materials also would limit TSA's domain awareness and intelligence gathering.

As provided by the PRA, as amended, an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number. Under the PRA, TSA is not authorized to impose a penalty on persons for violating information collection requirements that do not display a current OMB control number. TSA will publish the OMB control number for this information collection in the Federal Register after OMB approves it.

D. International Trade Impact Assessment

The Trade Agreement Act of 1979 prohibits Federal agencies from establishing any standards or engaging in related activities that create unnecessary obstacles to the foreign commerce of the United States. Legitimate domestic objectives, such as safety, are not considered unnecessary obstacles. The statute also requires consideration of international standards and, where appropriate, that they be the basis for U.S. standards. TSA has assessed the potential effect of this rulemaking and has determined that it will have only a domestic impact and therefore no effect on any trade-sensitive activity.

E. Unfunded Mandates Reform Act Analysis

The Unfunded Mandates Reform Act of 1995 is intended, among other things, to curb the practice of imposing unfunded Federal mandates on State, local, and tribal governments. Title II of the Act requires each Federal agency to prepare a written statement assessing the effects of any Federal mandate in a proposed or final agency rule that may result in a $100 million or more expenditure (adjusted annually for inflation) in any one year by State, local, and tribal governments, in the aggregate, or by the private sector; such a mandate is deemed to be a “significant regulatory action.” This rulemaking does not contain such a mandate. The requirements of Title II of the Act, therefore, do not apply, and TSA has not prepared a statement under the Act.

F. Executive Order 13132, Federalism

TSA has analyzed this final rule under the principles and criteria of E.O. 13132, entitled “Federalism,” issued August 4, 1999. Executive Order 13132 requires TSA to develop an accountable process to ensure “meaningful and timely input by State and local officials in the development of regulatory policies that have federalism implications.” According to the E.O.,“[p]olicies that have federalism implications” include regulations that have “substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.”

In this final rule, TSA is preempting certain State, local, and tribal requirements, including any such requirements prescribing or restricting security measures during the physical transfer of custody and control of a rail car containing hazardous materials. This is consistent with applicable statutes and with sound policy. Congress has enacted comprehensive Federal railroad laws (49 U.S.C. 20101 et seq.), which mandate that “[l]aws, regulations and orders related to railroad safety and laws, regulations, and orders related to railroad security [] be nationally uniform to the extent practicable.” See 49 U.S.C. 20106. To achieve national uniformity, the Federal railroad laws “expressly preempt[] state authority to adopt safety rules, save for two exceptions.” See Union Pacific Railroad Co. v. California Public Utilities Comm'n, 346 F.3d 851, 858 (9th Cir. 2003); see also 49 U.S.C. 20106. A state may enact or continue in force a law related to railroad safety or security “until the Secretary of Transportation (with respect to railroad safety matters), or the Secretary of Homeland Security (with respect to railroad security matters), prescribes a regulation or issues an order covering the subject matter of the State requirement.” 49 U.S.C. 20106. “Even after such a federal regulation issues, a State may adopt a more stringent law when `necessary to eliminate or reduce an essentially local safety or security hazard' if it `is not incompatible' with the federal regulation and `does not unreasonably burden interstate commerce.' ” CSX Transportation, Inc. v. Williams, 406 F.3d at 670-71; 49 U.S.C. 20106.

A primary security concern related to the rail transportation of hazardous materials is the prevention of a catastrophic release or explosion in proximity to densely populated areas, including urban areas and events or venues with large numbers of people in attendance. Also of major concern is the release or explosion of a rail car in proximity to iconic buildings, landmarks, or environmentally significant areas. These are national concerns that require a uniform national regulatory approach that does not require regulated parties to implement different measures in different jurisdictions across the nation. TSA is therefore proposing a nationally-uniform regulatory provision requiring chain of custody procedures. This would avoid the burden on interstate commerce that would result if multiple States, localities, and tribes established their own chain of custody requirements.

Although § 1580.107 preempts State and local requirements addressing the same matters, TSA does not believe that the custody and control requirements of this rulemaking will have an immediate substantial direct effect on the States, the relationship between the national government and the States, or the distribution of power and responsibilities among the various levels of government. The final rule will not require any actions by States, localities, or tribes. In addition, only one State has enacted a measure addressing chain of custody and control requirements for the rail transportation of hazardous materials.^[74] Thus, the final rule does not have sufficient federalism implications to warrant the preparation of a Federalism Assessment.

G. Environmental Analysis

TSA reviewed this action under DHS Management Directive 5100.1, Environmental Planning Program (effective April 19, 2006), which guides TSA compliance with the National Environmental Policy Act of 1969 (NEPA) (42 U.S.C. 4321-4370f). We determined that this final rule is categorically excluded under number A3(a) (administrative and regulatory activities involving the promulgation of rules and the development of policies), number A4 (information gathering and data analysis), number A7(d) (conducting audits, surveys and data collection of a minimally intrusive nature, to include vulnerability, risk and structural integrity assessments of infrastructures), number B3 (proposed activities and operations to be conducted in existing structures that are compatible with ongoing functions), and number B11 (routine monitoring and surveillance activities that support homeland security, such as patrols, investigations and intelligence gathering).

H. Energy Impact Analysis

TSA has assessed the energy impact of the final rule in accordance with the Energy Policy and Conservation Act (EPCA), Public Law 94-163, as amended (42 U.S.C. 6362). We have determined that this rulemaking is not a major regulatory action under the provisions of the EPCA. We also have analyzed this final rule under E.O. 13211, “Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use,” 66 FR 28355 (May 18, 2001). We have determined that it is not a “significant energy action” under that order. While it is a “significant regulatory action” under E.O. 12866, it is not likely to have a significant adverse effect on the supply, distribution, or use of energy. The Administrator of the Office of Information and Regulatory Affairs has not designated it as a significant energy action. Therefore, a Statement of Energy Effects is not required for this rule under E.O. 13211.

List of Subjects

49 CFR Part 1520

• Air carriers
• Aircraft
• Airports
• Maritime carriers
• Rail hazardous materials receivers
• Rail hazardous materials shippers
• Rail transit systems
• Railroad carriers
• Railroad safety
• Railroads
• Reporting and recordkeeping requirements
• Security measures
• Vessels

49 CFR Part 1580

• Hazardous materials transportation
• Mass transportation
• Rail hazardous materials receivers
• Rail hazardous materials shippers
• Rail transit systems
• Railroad carriers
• Railroad safety
• Railroads
• Reporting and recordkeeping requirements
• Security measures

The Final Rule

For the reasons set forth in the preamble, the Transportation Security Administration amends Chapter XII, of Title 49, Code of Federal Regulations, as follows:

PART 1520—PROTECTION OF SENSITIVE SECURITY INFORMATION

1. The authority citation for part 1520 continues to read as follows:

Authority: 46 U.S.C. 70102-70106, 70117; 49 U.S.C. 114, 40113, 44901-44907, 44913-44914, 44916-44918, 44935-44936, 44942, 46105.

2. In § 1520.3, add definitions of “Rail facility,” “Rail hazardous materials receiver,” “Rail hazardous materials shipper,” “Rail secure area,” “Rail transit facility,” “Rail transit system,” “Railroad,” and “Railroad carrier” in alphabetical order, and revise the definition of “Vulnerability assessment” to read as follows:

§ 1520.3

Terms used in this part.

* * * * *

Rail facility means “rail facility” as defined in 49 CFR 1580.3.

Rail hazardous materials receiver means “rail hazardous materials receiver” as defined in 49 CFR 1580.3.

Rail hazardous materials shipper means “rail hazardous materials shipper” as defined in 49 CFR 1580.3.

Rail secure area means “rail secure area” as defined in 49 CFR 1580.3.

Rail transit facility means “rail transit facility” as defined in 49 CFR 1580.3.

Rail transit system or Rail Fixed Guideway System means “rail transit system” or “Rail Fixed Guideway System” as defined in 49 CFR 1580.3.

Railroad means “railroad” as defined in 49 U.S.C. 20102(1).

Railroad carrier means “railroad carrier” as defined in 49 U.S.C. 20102(2).

* * * * *

Vulnerability assessment means any review, audit, or other examination of the security of a transportation infrastructure asset; airport; maritime facility, port area, or vessel; aircraft; railroad; railroad carrier, rail facility; train; rail hazardous materials shipper or receiver facility; rail transit system; rail transit facility; commercial motor vehicle; or pipeline; or a transportation-related automated system or network to determine its vulnerability to unlawful interference, whether during the conception, planning, design, construction, operation, or decommissioning phase. A vulnerability assessment may include proposed, recommended, or directed actions or countermeasures to address security concerns.

* * * * *

3. In § 1520.5, revise paragraphs (b)(6)(i), (b)(8) introductory text, (b)(10), (b)(11)(i)(A), (b)(12) introductory text, and (b)(15) to read as follows:

§ 1520.5

Sensitive security information.

* * * * *

(b) * * *

(6) Security inspection or investigative information. (i) Details of any security inspection or investigation of an alleged violation of aviation, maritime, or rail transportation security requirements of Federal law that could reveal a security vulnerability, including the identity of the Federal special agent or other Federal employee who conducted the inspection or audit.

* * * * *

(8) Security measures. Specific details of aviation, maritime, or rail transportation security measures, both operational and technical, whether applied directly by the Federal government or another person, including—

* * * * *

(10) Security training materials. Records created or obtained for the purpose of training persons employed by, contracted with, or acting for the Federal government or another person to carry out aviation, maritime, or rail transportation security measures required or recommended by DHS or DOT.

(11) * * *

(i) * * *

(A) Having unescorted access to a secure area of an airport, a rail secure area, or a secure or restricted area of a maritime facility, port area, or vessel;

* * * * *

(12) Critical aviation, maritime, or rail infrastructure asset information. Any list identifying systems or assets, whether physical or virtual, so vital to the aviation, maritime, or rail transportation system (including rail hazardous materials shippers and rail hazardous materials receivers) that the incapacity or destruction of such assets would have a debilitating impact on transportation security, if the list is—

* * * * *

(15) Research and development. Information obtained or developed in the conduct of research related to aviation, maritime, or rail transportation security activities, where such research is approved, accepted, funded, recommended, or directed by DHS or DOT, including research results.

* * * * *

4. In § 1520.7, add new paragraph (n) to read as follows:

§ 1520.7

Covered persons.

* * * * *

(n) Each railroad carrier, rail hazardous materials shipper, rail hazardous materials receiver, and rail transit system subject to the requirements of part 1580 of this chapter.

5. In § 1520.11, revise paragraph (b) to read as follows:

* * * * *

(b) Federal, State, local, or tribal government employees, contractors, and grantees. (1) A Federal, State, local, or tribal government employee has a need to know SSI if access to the information is necessary for performance of the employee's official duties, on behalf or in defense of the interests of the Federal, State, local, or tribal government.

(2) A person acting in the performance of a contract with or grant from a Federal, State, local, or tribal government agency has a need to know SSI if access to the information is necessary to performance of the contract or grant.

* * * * *

6. Add part 1580 to read as follows:

PART 1580—RAIL TRANSPORTATION SECURITY

Subpart A—General

1580.1

Scope.

1580.3

Terms used in this part.

1580.5

Inspection authority.

Subpart B—Freight Rail Including Freight Railroad Carriers, Rail Hazardous Materials Shippers, Rail Hazardous Materials Receivers, and Private Cars

1580.100

Applicability.

1580.101

Rail security coordinator.

1580.103

Location and shipping information for certain rail cars.

1580.105

Reporting significant security concerns.

1580.107

Chain of custody and control requirements.

1580.109

Preemptive effect.

1580.111

Harmonization of federal regulation of nuclear facilities.

Subpart C—Passenger Rail Including Passenger Railroad Carriers, Rail Transit Systems, Tourist, Scenic, Historic and Excursion Operators, and Private Cars

1580.200

Applicability.

1580.201

Rail security coordinator.

1580.203

Reporting significant security concerns.

Appendix A to Part 1580—High Threat Urban Areas.

Appendix B to Part 1580—Summary of the Applicability of Part 1580.

Authority: 49 U.S.C. 114.

Subpart A—General

§ 1580.1

Scope.

(a) Except as provided in paragraph (b) of this section, this part includes requirements for the following persons. Appendix B of this part summarizes the general requirements for each person, and the specific sections in this part provide detailed requirements.

(1) Each freight railroad carrier that operates rolling equipment on track that is part of the general railroad system of transportation;

(2) Each rail hazardous materials shipper that offers, prepares, or loads for transportation in commerce by rail one or more of the categories and quantities of rail security-sensitive materials set forth in § 1580.100(b) of this part;

(3) Each rail hazardous materials receiver, located within a High Threat Urban Area (HTUA) that receives in commerce by rail or unloads one or more of the categories and quantities of rail security-sensitive materials set forth in § 1580.100(b) of this part;

(4) Each passenger railroad carrier, including each carrier operating light rail or heavy rail transit service on track that is part of the general railroad system of transportation, each carrier operating or providing intercity passenger train service or commuter or other short-haul railroad passenger service in a metropolitan or suburban area (as described by 49 U.S.C. 20102), and each public authority operating passenger train service;

(5) Each passenger or freight railroad carrier hosting an operation described in paragraph (a)(4) of this section;

(6) Each tourist, scenic, historic, and excursion rail operator, whether operating on or off the general railroad system of transportation;

(7) Each operator of private cars, including business/office cars and circus trains, on or connected to the general railroad system of transportation; and

(8) Each operator of a rail transit system that is not operating on track that is part of the general railroad system of transportation, including heavy rail transit, light rail transit, automated guideway, cable car, inclined plane, funicular, and monorail systems.

(b) This part does not apply to a freight railroad carrier that operates rolling equipment only on track inside an installation that is not part of the general railroad system of transportation.

§ 1580.3

Terms used in this part.

For purposes of this part:

Commuter passenger train service means “train, commuter” as defined in 49 CFR 238.5, and includes a railroad operation that ordinarily uses diesel or electric powered locomotives and railroad passenger cars to serve an urban area, its suburbs, and more distant outlying communities in the greater metropolitan area. A commuter operation is part of the general railroad system of transportation regardless of whether it is physically connected to other railroads.

General railroad system of transportation means the network of standard gage track over which goods may be transported throughout the Nation and passengers may travel between cities and within metropolitan and suburban areas. See 49 CFR part 209, Appendix A.

Hazardous material means “hazardous material” as defined in 49 CFR 171.8.

Heavy rail transit means service provided by self-propelled electric railcars, typically drawing power from a third rail, operating in separate rights-of-way in multiple cars; also referred to as subways, metros, or regional rail.

High Threat Urban Area (HTUA) means an area comprising one or more cities and surrounding areas including a 10-mile buffer zone, as listed in Appendix A to this part.

Improvised explosive device means a device fabricated in an improvised manner that incorporates explosives or destructive, lethal, noxious, pyrotechnic, or incendiary chemicals in its design, and generally includes a power supply, a switch or timer, and a detonator or initiator.

Intercity passenger train service means both “train, long-distance intercity passenger” and “train, short-distance intercity passenger” as defined in 49 CFR 238.5.

Light rail transit means service provided by self-propelled electric railcars, typically drawing power from an overhead wire, operating in either exclusive or non-exclusive rights-of-way in single or multiple cars and with shorter distance trips and frequent stops; also referred to as streetcars, trolleys, and trams.

Offers or offeror means:

(1) Any person who does either or both of the following:

(i) Performs, or is responsible for performing, any pre-transportation function for transportation of the hazardous material in commerce.

(ii) Tenders or makes the hazardous material available to a carrier for transportation in commerce.

(2) A carrier is not an offeror when it performs a function required as a condition of acceptance of a hazardous material for transportation in commerce (such as reviewing shipping papers, examining packages to ensure that they are in conformance with the HMR, or preparing shipping documentation for its own use) or when it transfers a hazardous material to another carrier for continued transportation in commerce without performing a pre-transportation function. See 49 CFR 171.8.

Passenger car means rail rolling equipment intended to provide transportation for members of the general public and includes a self-propelled car designed to carry passengers, baggage, mail, or express. This term includes a passenger coach, cab car, and a Multiple Unit (MU) locomotive. In the context of articulated equipment, “passenger car” means that segment of the rail rolling equipment located between two trucks. This term does not include a private car. See 49 CFR 238.5.

Passenger train means a train that transports or is available to transport members of the general public. See 49 CFR 238.5.

Private car means rail rolling equipment that is used only for excursion, recreational, or private transportation purposes. A private car is not a passenger car. See 49 CFR 238.5.

Rail facility means a location at which rail cargo or infrastructure assets are stored, cargo is transferred between conveyances and/or modes of transportation, where transportation command and control operations are performed, or maintenance operations are performed. The term also includes, but is not limited to, passenger stations and terminals, rail yards, crew management centers, dispatching centers, transportation terminals and stations, fueling centers, and telecommunication centers.

Rail hazardous materials receiver means any operator of a fixed-site facility that has a physical connection to the general railroad system of transportation and receives or unloads from transportation in commerce by rail one or more of the categories and quantities of rail security-sensitive materials set forth in § 1580.100(b) of this part, but does not include the operator of a facility owned or operated by a department, agency, or instrumentality of the Federal government.

Rail hazardous materials shipper means the operator of any fixed-site facility that has a physical connection to the general railroad system of transportation and offers, prepares, or loads for transportation by rail one or more of the categories and quantities of rail security-sensitive materials set forth in § 1580.100(b) of this part, but does not include the operator of a facility owned or operated by a department, agency, or instrumentality of the Federal government.

Rail secure area means a secure location(s) identified by a rail hazardous materials shipper or rail hazardous materials receiver where security-related pre-transportation or transportation functions are performed or rail cars containing the categories and quantities of rail security-sensitive materials are prepared, loaded, stored, and/or unloaded.

Rail security-sensitive material means one or more of the categories and quantities of hazardous materials set forth in § 1580.100(b) of this part.

Rail transit facility means rail transit stations, terminals, and locations at which rail transit infrastructure assets are stored, command and control operations are performed, or maintenance is performed. The term also includes rail yards, crew management centers, dispatching centers, transportation terminals and stations, fueling centers, and telecommunication centers.

Rail transit system or “Rail Fixed Guideway System” means any light, heavy, or rapid rail system, monorail, inclined plane, funicular, cable car, trolley, or automated guideway that traditionally does not operate on track that is part of the general railroad system of transportation.

Railroad means any form of nonhighway ground transportation that runs on rails or electromagnetic guideways, including: Commuter or other short-haul railroad passenger service in a metropolitan or suburban area and commuter railroad service that was operated by the Consolidated Rail Corporation on January 1, 1979; and high speed ground transportation systems that connect metropolitan areas, without regard to whether those systems use new technologies not associated with traditional railroads; but does not include rapid transit operations in an urban area that are not connected to the general railroad system of transportation. The term includes rail transit service operating on track that is part of the general railroad system of transportation but does not include rapid transit operations in an urban area that are not connected to the general railroad system of transportation. See 49 U.S.C. 20102(1).

Railroad carrier means a person providing railroad transportation. See 49 U.S.C. 20102(2).

Residue means the hazardous material remaining in a packaging, including a tank car, after its contents have been unloaded to the maximum extent practicable and before the packaging is either refilled or cleaned of hazardous material and purged to remove any hazardous vapors. See 49 CFR 171.8.

Tourist, scenic, historic, or excursion operation means a railroad operation that carries passengers, often using antiquated equipment, with the conveyance of the passengers to a particular destination not being the principal purpose. Train movements of new passenger equipment for demonstration purposes are not tourist, scenic, historic, or excursion operations. See 49 CFR 238.5.

Transit means mass transportation by a conveyance that provides regular and continuing general or special transportation to the public, but does not include school bus, charter, or sightseeing transportation. See 49 U.S.C 5302(a). Transit may occur on or off the general railroad system of transportation. For purposes of this part, the term “transit” excludes buses and commuter passenger train service.

Transportation or transport means the movement of property including loading, unloading, and storage. Transportation or transport also includes the movement of people, boarding, and disembarking incident to that movement.

§ 1580.5

Inspection authority.

(a) This section applies to the following:

(1) Each freight railroad carrier that operates rolling equipment on track that is part of the general railroad system of transportation.

(2) Each rail hazardous materials shipper.

(3) Each rail hazardous materials receiver located within an HTUA.

(4) Each passenger railroad carrier, including each carrier operating light rail or heavy rail transit service on track that is part of the general railroad system of transportation, each carrier operating or providing intercity passenger train service or commuter or other short-haul railroad passenger service in a metropolitan or suburban area (as described by 49 U.S.C. 20102), and each public authority operating passenger train service.

(5) Each passenger or freight railroad carrier hosting an operation described in paragraph (a)(4) of this section.

(6) Each tourist, scenic, historic, and excursion rail operator, whether operating on or off the general railroad system of transportation.

(7) Each operator of private cars, including business/office cars and circus trains, on or connected to the general railroad system of transportation.

(8) Each operator of a rail transit system that is not operating on track that is part of the general railroad system of transportation, including heavy rail transit, light rail transit, automated guideway, cable car, inclined plane, funicular, and monorail systems.

(b) The persons described in paragraph (a) of this section must allow TSA and other authorized DHS officials, at any time and in a reasonable manner, without advance notice, to enter, inspect, and test property, facilities, equipment, and operations; and to view, inspect, and copy records, as necessary to carry out TSA's security-related statutory or regulatory authorities, including its authority to—

(1) Assess threats to transportation;

(2) Enforce security-related regulations, directives, and requirements;

(3) Inspect, maintain, and test the security of facilities, equipment, and systems;

(4) Ensure the adequacy of security measures for the transportation of passengers and freight, including hazardous materials;

(5) Oversee the implementation, and ensure the adequacy, of security measures at rail yards, stations, terminals, transportation-related areas of rail hazardous materials shipper and receiver facilities, crew management centers, dispatch centers, telecommunication centers, and other transportation facilities and infrastructure;

(6) Review security plans; and

(7) Carry out such other duties, and exercise such other powers, relating to transportation security, as the Assistant Secretary of Homeland Security for the TSA considers appropriate, to the extent authorized by law.

(c) TSA and DHS officials working with TSA, may enter, without advance notice, and be present within any area or within any conveyance without access media or identification media issued or approved by a railroad carrier, rail transit system owner or operator, rail hazardous materials shipper, or rail hazardous materials receiver in order to inspect or test compliance, or perform other such duties as TSA may direct.

(d) TSA inspectors and DHS officials working with TSA will, on request, present their credentials for examination, but the credentials may not be photocopied or otherwise reproduced.

Subpart B—Freight Rail Including Freight Railroad Carriers, Rail Hazardous Materials Shippers, Rail Hazardous Materials Receivers, and Private Cars

§ 1580.100

Applicability.

(a) Applicability. The requirements of this subpart apply to:

(1) Each freight railroad carrier that operates rolling equipment on track that is part of the general railroad system of transportation.

(2) Each rail hazardous materials shipper.

(3) Each rail hazardous materials receiver located with an HTUA.

(4) Each freight railroad carrier hosting a passenger operation described in § 1580.1(d) of this part.

(5) Each operator of private cars, including business/office cars and circus trains, on or connected to the general railroad system of transportation.

(b) Rail security-sensitive materials. The requirements of this subpart apply to:

(1) A rail car containing more than 2,268 kg (5,000 lbs) of a Division 1.1, 1.2, or 1.3 (explosive) material, as defined in 49 CFR 173.50;

(2) A tank car containing a material poisonous by inhalation as defined in 49 CFR 171.8, including anhydrous ammonia, Division 2.3 gases poisonous by inhalation as set forth in 49 CFR 173.115(c), and Division 6.1 liquids meeting the defining criteria in 49 CFR 173.132(a)(1)(iii) and assigned to hazard zone A or hazard zone B in accordance with 49 CFR 173.133(a), excluding residue quantities of these materials; and

(3) A rail car containing a highway route-controlled quantity of a Class 7 (radioactive) material, as defined in 49 CFR 173.403.

§ 1580.101

Rail security coordinator.

(a) Applicability. This section applies to:

(1) Each freight railroad carrier that operates rolling equipment on track that is part of the general railroad system of transportation.

(2) Each rail hazardous materials shipper.

(3) Each rail hazardous materials receiver located with an HTUA.

(4) Each freight railroad carrier hosting the passenger operations described in § 1580.1(d) of this part.

(5) Each operator of private cars, including business/office cars and circus trains, on or connected to the general railroad system of transportation, when notified by TSA in writing, that a threat exists concerning that operation.

(b) Each person described in paragraph (a) of this section must designate and use a primary and at least one alternate Rail Security Coordinator (RSC).

(c) The RSC and alternate(s) must be appointed at the corporate level.

(d) Each freight railroad carrier, rail hazardous materials shipper, and rail hazardous materials receiver required to have an RSC must provide to TSA the names, title, phone number(s), and e-mail address(es) of the RSCs and alternate RSCs, and must notify TSA within 7 calendar days when any of this information changes.

(e) Each freight railroad carrier, rail hazardous materials shipper, and rail hazardous materials receiver required to have an RSC must ensure that at least one RSC:

(1) Serves as the primary contact for intelligence information and security-related activities and communications with TSA. Any individual designated as an RSC may perform other duties in addition to those described in this section;

(2) Is available to TSA on a 24-hours a day, 7 days a week basis; and

(3) Coordinates security practices and procedures with appropriate law enforcement and emergency response agencies.

§ 1580.103

Location and shipping information for certain rail cars.

(a) Applicability. This section applies to:

(1) Each freight railroad carrier transporting one or more of the categories and quantities of rail security-sensitive materials.

(2) Each rail hazardous materials shipper.

(3) Each rail hazardous materials receiver located with an HTUA.

(b) General requirement. Each person described in paragraph (a) of this section must have procedures in place to determine the location and shipping information for each rail car under its physical custody and control that contains one or more of the categories and quantities of rail security-sensitive materials.

(c) Required information. The location and shipping information required in paragraph (b) of this section must include the following:

(1) The rail car's current location by city, county, and state, including, for freight railroad carriers, the railroad milepost, track designation, and the time that the rail car's location was determined.

(2) The rail car's routing, if a freight railroad carrier.

(3) A list of the total number of rail cars containing the materials listed in § 1580.100(b) of this part, broken down by:

(i) The shipping name prescribed for the material in column 2 of the table in 49 CFR 172.101;

(ii) The hazard class or division number prescribed for the material in column 3 of the table in 49 CFR 172.101; and

(iii) The identification number prescribed for the material in column 4 of the table in 49 CFR 172.101.

(4) Each rail car's initial and number.

(5) Whether the rail car is in a train, rail yard, siding, rail spur, or rail hazardous materials shipper or receiver facility, including the name of the rail yard or siding designation.

(d) Timing-class I freight railroad carriers. Upon request by TSA, each Class I freight railroad carrier described in paragraph (a) of this section must provide the location and shipping information to TSA no later than:

(1) Five minutes if the request concerns only one rail car; and

(2) Thirty minutes if the request concerns two or more rail cars.

(e) Timing-other than class I freight railroad carriers. Upon request by TSA, all persons described in paragraph (a) of this section, other than Class I freight railroad carriers, must provide the location and shipping information to TSA no later than 30 minutes, regardless of the number of cars covered by the request.

(f) Method. All persons described in paragraph (a) of this section must provide the requested location and shipping information to TSA by one of the following methods:

(1) Electronic data transmission in spreadsheet format.

(2) Electronic data transmission in Hyper Text Markup Language (HTML) format.

(3) Electronic data transmission in Extensible Markup Language (XML).

(4) Facsimile transmission of a hard copy spreadsheet in tabular format.

(5) Posting the information to a secure website address approved by TSA.

(6) Another format approved by TSA.

(g) Telephone number. Each person described in paragraph (a) of this section must provide a telephone number for use by TSA to request the information required in paragraph (a)(4) of this section.

(1) The telephone number must be monitored at all times.

(2) A telephone number that requires a call back (such as an answering service, answering machine, or beeper device) does not meet the requirements of paragraph (f) of this section.

(h) Definition. As used in this section, Class I has the meaning assigned by regulations of the Surface Transportation Board (STB) (49 CFR part 1201; General Instructions 1-1).

§ 1580.105

Reporting significant security concerns.

(a) Applicability. This section applies to:

(1) Each freight railroad carrier that operates rolling equipment on track that is part of the general railroad system of transportation.

(2) Each rail hazardous materials shipper.

(3) Each rail hazardous materials receiver located with an HTUA.

(4) Each freight railroad carrier hosting a passenger operation described in § 1580.1(d) of this part.

(5) Each operator of private cars, including business/office cars and circus, on or connected to the general railroad system of transportation.

(b) Each person described in paragraph (a) of this section must immediately report potential threats and significant security concerns to DHS by telephoning the Freedom Center at 703-563-3240 or 1-877-456-8722.

(c) Potential threats or significant security concerns encompass incidents, suspicious activities, and threat information including, but not limited to, the following:

(1) Interference with the train crew.

(2) Bomb threats, specific and non-specific.

(3) Reports or discovery of suspicious items that result in the disruption of railroad operations.

(4) Suspicious activity occurring onboard a train or inside the facility of a freight railroad carrier, rail hazardous materials shipper, or rail hazardous materials receiver that results in a disruption of operations.

(5) Suspicious activity observed at or around rail cars, facilities, or infrastructure used in the operation of the railroad, rail hazardous materials shipper, or rail hazardous materials receiver.

(6) Discharge, discovery, or seizure of a firearm or other deadly weapon on a train, in a station, terminal, facility, or storage yard, or other location used in the operation of the railroad, rail hazardous materials shipper, or rail hazardous materials receiver.

(7) Indications of tampering with rail cars.

(8) Information relating to the possible surveillance of a train or facility, storage yard, or other location used in the operation of the railroad, rail hazardous materials shipper, or rail hazardous materials receiver.

(9) Correspondence received by the freight railroad carrier, rail hazardous materials shipper, or rail hazardous materials receiver indicating a potential threat. Other incidents involving breaches of the security of the freight railroad carrier, rail hazardous materials shipper, or rail hazardous materials receiver's operations or facilities.

(d) Information reported should include, as available and applicable:

(1) The name of the reporting freight railroad carrier, rail hazardous materials shipper, or rail hazardous materials receiver and contact information, including a telephone number or e-mail address.

(2) The affected train, station, terminal, rail hazardous materials facility, or other rail facility or infrastructure.

(3) Identifying information on the affected train, train line, and route.

(4) Origination and termination locations for the affected train, including departure and destination city and the rail line and route, as applicable.

(5) Current location of the affected train.

(6) Description of the threat, incident, or activity.

(7) The names and other available biographical data of individuals involved in the threat, incident, or activity.

(8) The source of any threat information.

§ 1580.107

Chain of custody and control requirements.

(a) Within or outside of an HTUA, rail hazardous materials shipper transferring to carrier. Except as provided in paragraph (e) of this section, at each location within or outside of an HTUA, a rail hazardous materials shipper transferring custody of a rail car containing one or more of the categories and quantities of rail security-sensitive materials to a freight railroad carrier must:

(1) Physically inspect the rail car before loading for signs of tampering, including closures and seals; other signs that the security of the car may have been compromised; suspicious items or items that do not belong, including the presence of an improvised explosive device.

(2) Keep the rail car in a rail secure area from the time the security inspection required by paragraph (a)(1) of this section or by 49 CFR 173.31(d), whichever occurs first, until the freight railroad carrier takes physical custody of the rail car.

(3) Document the transfer of custody to the railroad carrier in writing or electronically.

(b) Within or outside of an HTUA, carrier receiving from a rail hazardous materials shipper. At each location within or outside of an HTUA where a freight railroad carrier receives from a rail hazardous materials shipper custody of a rail car containing one or more of the categories and quantities of rail security-sensitive materials, the freight railroad carrier must document the transfer in writing or electronically and perform the required security inspection in accordance with 49 CFR 174.9.

(c) Within an HTUA, carrier transferring to carrier. Within an HTUA, whenever a freight railroad carrier transfers a rail car containing one or more of the categories and quantities of rail security-sensitive materials to another freight railroad carrier, each freight railroad carrier must adopt and carry out procedures to ensure that the rail car is not left unattended at any time during the physical transfer of custody. These procedures must include the receiving freight railroad carrier performing the required security inspection in accordance with 49 CFR 174.9. Both the transferring and the receiving railroad carrier must document the transfer of custody in writing or electronically.

(d) Outside of an HTUA, carrier transferring to carrier. Outside an HTUA, whenever a freight railroad carrier transfers a rail car containing one or more of the categories and quantities of rail security-sensitive materials to another freight railroad carrier, and the rail car containing this hazardous material may subsequently enter an HTUA, each freight railroad carrier must adopt and carry out procedures to ensure that the rail car is not left unattended at any time during the physical transfer of custody. These procedures must include the receiving railroad carrier performing the required security inspection in accordance with 49 CFR 174.9. Both the transferring and the receiving railroad carrier must document the transfer of custody in writing or electronically.

(e) Within an HTUA, carrier transferring to rail hazardous materials receiver. A freight railroad carrier delivering a rail car containing one or more of the categories and quantities of rail security-sensitive materials to a rail hazardous materials receiver located within an HTUA must not leave the rail car unattended in a non-secure area until the rail hazardous materials receiver accepts custody of the rail car. Both the railroad carrier and the rail hazardous materials receiver must document the transfer of custody in writing or electronically.

(f) Within an HTUA, rail hazardous materials receiver receiving from carrier. Except as provided in paragraph (j) of this section, a rail hazardous materials receiver located within an HTUA that receives a rail car containing one or more of the categories and quantities of rail security-sensitive materials from a freight railroad carrier must:

(1) Ensure that the rail hazardous materials receiver or railroad carrier maintains positive control of the rail car during the physical transfer of custody of the rail car.

(2) Keep the rail car in a rail secure area until the car is unloaded.

(3) Document the transfer of custody from the railroad carrier in writing or electronically.

(g) Within or outside of an HTUA, rail hazardous materials receiver rejecting car. This section does not apply to a rail hazardous materials receiver that does not routinely offer, prepare, or load for transportation by rail one or more of the categories and quantities of rail security-sensitive materials. If such a receiver rejects and returns a rail car containing one or more of the categories and quantities of rail security-sensitive materials to the originating offeror or shipper, the requirements of this section do not apply to the receiver. The requirements of this section do apply to any railroad carrier to which the receiver transfers custody of the rail car.

(h) Document retention. Covered entities must maintain the documents required under this section for at least 60 calendar days and make them available to TSA upon request.

(i) Rail secure area. The rail hazardous materials shipper and the rail hazardous materials receiver must use physical security measures to ensure that no unauthorized person gains access to the rail secure area.

(j) Exemption for rail hazardous materials receivers. A rail hazardous materials receiver located within an HTUA may request from TSA an exemption from some or all of the requirements of this section if the receiver demonstrates that the potential risk from its activities is insufficient to warrant compliance with this section. TSA will consider all relevant circumstances, including—

(1) The amounts and types of all hazardous materials received.

(2) The geography of the area surrounding the receiver's facility.

(3) Proximity to entities that may be attractive targets, including other businesses, housing, schools, and hospitals.

(4) Any information regarding threats to the facility.

(5) Other circumstances that indicate the potential risk of the receiver's facility does not warrant compliance with this section.

(k) Terms used in this section. (1) As used in this section, a rail car is attended if an employee or authorized representative:

(i) Is physically located on site in reasonable proximity to the rail car;

(ii) Is capable of promptly responding to unauthorized access or activity at or near the rail car, including immediately contacting law enforcement or other authorities; and

(iii) Immediately responds to any unauthorized access or activity at or near the rail car either personally or by contacting law enforcement or other authorities.

(2) As used in this section, maintains positive control means that the rail hazardous materials receiver and the railroad carrier communicate and cooperate with each other to provide for the security of the rail car during the physical transfer of custody. Attending the rail car is a component part of maintaining positive control.

(3) As used in this section, document the transfer means documentation uniquely identifying that the rail car was attended during the transfer of custody, including:

(i) Car initial and number.

(ii) Identification of individuals who attended the transfer (names or uniquely identifying employee number).

(iii) Location of transfer.

(iv) Date and time the transfer was completed.

§ 1580.109

Preemptive effect.

Under 49 U.S.C. 20106, issuance of the regulations in this part preempts any State law, regulation, or order covering the same subject matter, except an additional or more stringent law, regulation, or order that is necessary to eliminate or reduce an essentially local security hazard; that is not incompatible with a law, regulation, or order of the United States Government; and that does not unreasonably burden interstate commerce. For example, under 49 U.S.C. 20106, issuance of § 1580.107 of this subpart preempts any State or tribal law, rule, regulation, order or common law requirement covering the same subject matter.

§ 1580.111

Harmonization of federal regulation of nuclear facilities.

TSA will coordinate activities under this subpart with the Nuclear Regulatory Commission (NRC) and the Department of Energy (DOE) with respect to regulation of rail hazardous materials shippers and receivers that are also licensed or regulated by the NRC or DOE under the Atomic Energy Act of 1954, as amended, to maintain consistency with the requirements imposed by the NRC and DOE.

Subpart C—Passenger Rail Including Passenger Railroad Carriers, Rail Transit Systems, Tourist, Scenic, Historic and Excursion Operators, and Private Cars

§ 1580.200

Applicability.

This subpart includes requirements for:

(a) Each passenger railroad carrier, including each carrier operating light rail or heavy rail transit service on track that is part of the general railroad system of transportation, each carrier operating or providing intercity passenger train service or commuter or other short-haul railroad passenger service in a metropolitan or suburban area (as described by 49 U.S.C. 20102), and each public authority operating passenger train service.

(b) Each passenger railroad carrier hosting an operation described in paragraph (a) of this section.

(c) Each tourist, scenic, historic, and excursion rail operator, whether operating on or off the general railroad system of transportation.

(d) Each operator of private cars, including business/office cars and circus trains, on or connected to the general railroad system of transportation.

(e) Each operator of a rail transit system that is not operating on track that is part of the general railroad system of transportation, including heavy rail transit, light rail transit, automated guideway, cable car, inclined plane, funicular, and monorail systems.

§ 1580.201

Rail security coordinator.

(a) Applicability. This section applies to:

(1) Each passenger railroad carrier, including each carrier operating light rail or heavy rail transit service on track that is part of the general railroad system of transportation, each carrier operating or providing intercity passenger train service or commuter or other short-haul railroad passenger service in a metropolitan or suburban area (as described by 49 U.S.C. 20102), and each public authority operating passenger train service.

(2) Each passenger railroad carrier hosting an operation described in paragraph (a)(1) of this section.

(3) Each operator of a rail transit system that is not operating on track that is part of the general railroad system of transportation, including heavy rail transit, light rail transit, automated guideway, cable car, inclined plane, funicular, and monorail systems.

(4) Each operator of private cars, including business/office cars and circus trains, on or connected to the general railroad system of transportation, when notified by TSA, in writing, that a security threat exists concerning that operation.

(5) Each tourist, scenic, historic, or excursion operations, whether on or off the general railroad system of transportation, when notified by TSA, in writing, that a security threat exists concerning that operation.

(b) Each person described in paragraph (a) of this section must designate and use a primary and at least one alternate RSC.

(c) The RSC and alternate(s) must be appointed at the corporate level.

(d) Each passenger railroad carrier and rail transit system required to have an RSC must provide to TSA the names, titles, phone number(s), and e-mail address(es) of the RSCs, and alternate RSCs, and must notify TSA within 7 calendar days when any of this information changes.

(e) Each passenger railroad carrier and rail transit system required to have an RSC must ensure that at least one RSC:

(1) Serves as the primary contact for intelligence information and security-related activities and communications with TSA. Any individual designated as an RSC may perform other duties in addition to those described in this section.

(2) Is available to TSA on a 24-hours a day, 7 days a week basis.

(3) Coordinate security practices and procedures with appropriate law enforcement and emergency response agencies.

§ 1580.203

Reporting significant security concerns.

(a) Applicability. This section applies to:

(1) Each passenger railroad carrier, including each carrier operating light rail or heavy rail transit service on track that is part of the general railroad system of transportation, each carrier operating or providing intercity passenger train service or commuter or other short-haul railroad passenger service in a metropolitan or suburban area (as described by 49 U.S.C. 20102), and each public authority operating passenger train service.

(2) Each passenger railroad carrier hosting an operation described in paragraph (a)(1) of this section.

(3) Each tourist, scenic, historic, and excursion rail operator, whether operating on or off the general railroad system of transportation.

(4) Each operator of private cars, including business/office cars and circus trains, on or connected to the general railroad system of transportation.

(5) Each operator of a rail transit system that is not operating on track that is part of the general railroad system of transportation, including heavy rail transit, light rail transit, automated guideway, cable car, inclined plane, funicular, and monorail systems.

(b) Each person described in paragraph (a) of this section must immediately report potential threats or significant security concerns to DHS by telephoning the Freedom Center at 703-563-3240 or 1-877-456-8722.

(c) Potential threats or significant security concerns encompass incidents, suspicious activities, and threat information including, but not limited to, the following:

(1) Interference with the train or transit vehicle crew.

(2) Bomb threats, specific and non-specific.

(3) Reports or discovery of suspicious items that result in the disruption of rail operations.

(4) Suspicious activity occurring onboard a train or transit vehicle or inside the facility of a passenger railroad carrier or rail transit system that results in a disruption of rail operations.

(5) Suspicious activity observed at or around rail cars or transit vehicles, facilities, or infrastructure used in the operation of the passenger railroad carrier or rail transit system.

(6) Discharge, discovery, or seizure of a firearm or other deadly weapon on a train or transit vehicle or in a station, terminal, facility, or storage yard, or other location used in the operation of the passenger railroad carrier or rail transit system.

(7) Indications of tampering with passenger rail cars or rail transit vehicles.

(8) Information relating to the possible surveillance of a passenger train or rail transit vehicle or facility, storage yard, or other location used in the operation of the passenger railroad carrier or rail transit system.

(9) Correspondence received by the passenger railroad carrier or rail transit system indicating a potential threat to rail transportation.

(10) Other incidents involving breaches of the security of the passenger railroad carrier or the rail transit system operations or facilities.

(d) Information reported should include, as available and applicable:

(1) The name of the passenger railroad carrier or rail transit system and contact information, including a telephone number or e-mail address.

(2) The affected station, terminal, or other facility.

(3) Identifying information on the affected passenger train or rail transit vehicle including number, train or transit line, and route, as applicable.

(4) Origination and termination locations for the affected passenger train or rail transit vehicle, including departure and destination city and the rail or transit line and route.

(5) Current location of the affected passenger train or rail transit vehicle.

(6) Description of the threat, incident, or activity.

(7) The names and other available biographical data of individuals involved in the threat, incident, or activity.

(8) The source of any threat information.

Appendix A to Part 1580—High Threat Urban Areas (HTUAs)

State	Candidate urban area	Geographic area captured in the data count	Previously designated urban areas included
AZ	Phoenix Area *	Chandler, Gilbert, Glendale, Mesa, Peoria, Phoenix, Scottsdale, Tempe, and a 10-mile buffer extending from the border of the combined area	Phoenix, AZ.
CA	Anaheim/Santa Ana Area	Anaheim, Costa Mesa, Garden Grove, Fullerton, Huntington Beach, Irvine, Orange, Santa Ana, and a 10-mile buffer extending from the border of the combined area	Anaheim, CA; Santa Ana, CA.
	Bay Area	Berkeley, Daly City, Fremont, Hayward, Oakland, Palo Alto, Richmond, San Francisco, San Jose, Santa Clara, Sunnyvale, Vallejo, and a 10-mile buffer extending from the border of the combined area	San Francisco, CA; San Jose, CA; Oakland, CA.
	Los Angeles/Long Beach Area	Burbank, Glendale, Inglewood, Long Beach, Los Angeles, Pasadena, Santa Monica, Santa Clarita, Torrance, Simi Valley, Thousand Oaks, and a 10-mile buffer extending from the border of the combined area	Los Angeles, CA; Long Beach, CA.
	Sacramento Area *	Elk Grove, Sacramento, and a 10-mile buffer extending from the border of the combined area	Sacramento, CA.
	San Diego Area *	Chula Vista, Escondido, and San Diego, and a 10-mile buffer extending from the border of the combined area	San Diego, CA.
CO	Denver Area	Arvada, Aurora, Denver, Lakewood, Westminster, Thornton, and a 10-mile buffer extending from the border of the combined area	Denver, CO.
DC	National Capital Region	National Capital Region and a 10-mile buffer extending from the border of the combined area	National Capital Region, DC.
FL	Fort Lauderdale Area	Fort Lauderdale, Hollywood, Miami Gardens, Miramar, Pembroke Pines, and a 10-mile buffer extending from the border of the combined area	N/A.
	Jacksonville Area	Jacksonville and a 10-mile buffer extending from the city border	Jacksonville, FL.
	Miami Area	Hialeah, Miami, and a 10-mile buffer extending from the border of the combined area	Miami, FL.
	Orlando Area	Orlando and a 10-mile buffer extending from the city border	Orlando, FL.
	Tampa Area *	Clearwater, St. Petersburg, Tampa, and a 10-mile buffer extending from the border of the combined area	Tampa, FL.
GA	Atlanta Area	Atlanta and a 10-mile buffer extending from the city border	Atlanta, GA.
HI	Honolulu Area	Honolulu and a 10-mile buffer extending from the city border	Honolulu, HI.
IL	Chicago Area	Chicago and a 10-mile buffer extending from the city border	Chicago, IL.
IN	Indianapolis Area	Indianapolis and a 10-mile buffer extending from the city border	Indianapolis, IN.
KY	Louisville Area *	Louisville and a 10-mile buffer extending from the city border	Louisville, KY.
LA	Baton Rouge Area *	Baton Rouge and a 10-mile buffer extending from the city border	Baton Rouge, LA.
	New Orleans Area	New Orleans and a 10-mile buffer extending from the city border	New Orleans, LA.
MA	Boston Area	Boston, Cambridge, and a 10-mile buffer extending from the border of the combined area	Boston, MA.
MD	Baltimore Area	Baltimore and a 10-mile buffer extending from the city border	Baltimore, MD.
MI	Detroit Area	Detroit, Sterling Heights, Warren, and a 10-mile buffer extending from the border of the combined area	Detroit, MI.
MN	Twin Cities Area	Minneapolis, St. Paul, and a 10-mile buffer extending from the border of the combined entity	Minneapolis, MN; St. Paul, MN.
MO	Kansas City Area	Independence, Kansas City (MO), Kansas City (KS), Olathe, Overland Park, and a 10-mile buffer extending from the border of the combined area	Kansas City, MO.
	St. Louis Area	St. Louis and a 10-mile buffer extending from the city border	St. Louis, MO.
NC	Charlotte Area	Charlotte and a 10-mile buffer extending from the city border	Charlotte, NC.
NE	Omaha Area *	Omaha and a 10-mile buffer extending from the city border	Omaha, NE.
NJ	Jersey City/Newark Area	Elizabeth, Jersey City, Newark, and a 10-mile buffer extending from the border of the combined area	Jersey City, NJ; Newark, NJ.
NV	Las Vegas Area *	Las Vegas, North Las Vegas, and a 10-mile buffer extending from the border of the combined entity	Las Vegas, NV.
NY	Buffalo Area *	Buffalo and a 10-mile buffer extending from the city border	Buffalo, NY.
	New York City Area	New York City, Yonkers, and a 10-mile buffer extending from the border of the combined area	New York, NY.
OH	Cincinnati Area	Cincinnati and a 10-mile buffer extending from the city border	Cincinnati, OH.
	Cleveland Area	Cleveland and a 10-mile buffer extending from the city border	Cleveland, OH.
	Columbus Area	Columbus and a 10-mile buffer extending from the city border	Columbus, OH.
	Toledo Area *	Oregon, Toledo, and a 10-mile buffer extending from the border of the combined area	Toledo, OH.
OK	Oklahoma City Area *	Norman, Oklahoma and a 10-mile buffer extending from the border of the combined area	Oklahoma City, OK.
OR	Portland Area	Portland, Vancouver, and a 10-mile buffer extending from the border of the combined area	Portland, OR.
PA	Philadelphia Area	Philadelphia and a 10-mile buffer extending from the city border	Philadelphia, PA.
	Pittsburgh Area	Pittsburgh and a 10-mile buffer extending from the city border	Pittsburgh, PA.
TN	Memphis Area	Memphis and a 10-mile buffer extending from the city border	Memphis, TN.
TX	Dallas/Fort Worth/Arlington Area	Arlington, Carrollton, Dallas, Fort Worth, Garland, Grand Prairie, Irving, Mesquite, Plano, and a 10-mile buffer extending from the border of the combined area	Dallas, TX; Fort Worth, TX; Arlington, TX.
	Houston Area	Houston, Pasadena, and a 10-mile buffer extending from the border of the combined entity	Houston, TX.
	San Antonio Area	San Antonio and a 10-mile buffer extending from the city border	San Antonio, TX.
WA	Seattle Area	Seattle, Bellevue, and a 10-mile buffer extending from the border of the combined area	Seattle, WA.
WI	Milwaukee Area	Milwaukee and a 10-mile buffer extending from the city border	Milwaukee, WI.
* FY05 Urban Areas eligible for sustainment funding through the FY06 Urban Areas Security Initiative (UASI) program; any Urban Area not identified as eligible through the risk analysis process for two consecutive years will not be eligible for continued funding under the UASI program.

Appendix B to Part 1580—Summary of the Applicability of Part 1580

[This is a summary—see body of text for complete requirements]

Security measure and rule section	Freight railroad carriers NOT transporting specified hazardous materials	Freight railroad carriers transporting specified hazardous materials (§ 1580.100(b))	Rail operations at certain facilities that ship (i.e., offer, prepare, or load for transportation) hazardous materials	Rail operations at certain facilities that receive or unload hazardous materials within an HTUA	Passenger railroad carriers and rail transit systems	Certain other rail operations (private, business/office, circus, tourist, historic, excursion)
Allow TSA to inspect (§ 1580.5)	X	X	X	X	X	X
Appoint rail security coordinator (§ 1580.101 freight; § 1580.201 passenger)	X	X	X	X	X	(1)
Report significant security concerns (§ 1580.105 freight; § 1580.203 passenger)	X	X	X	X	X	X
Provide location and shipping information for rail cars containing specified hazardous materials if requested (§ 1580.103)		X	X	X
Chain of custody and control requirements for transport of specified hazardous materials that are or may be in HTUA (§ 1580.107)		X	X	X
1 Only if notified in writing that a security threat exists.

Issued in Arlington, Virginia, on November 11, 2008.

Kip Hawley,

Assistant Secretary.

Footnotes

1.  An IED is a device fabricated in an improvised manner that incorporates explosives or destructive, lethal, noxious, pyrotechnic, or incendiary chemicals into its design. It generally includes a power supply, a switch or timer, and a detonator or initiator.

2.  See Section II.B of the preamble to the NPRM for a detailed discussion of the HM-232 rule. 71 FR at 76856.

3.  TSA also identified specified quantities of those hazardous materials. See Section I.B of this preamble or 49 CFR 1580.100(b) for a list of the quantities.

4.  PIH materials are gases or liquids that are known or presumed on the basis of tests to be so toxic to humans as to pose a hazard to health during transportation. See 69 FR 50988. See also 49 CFR 171.8, 173.115, and 173.132.

5.  Explosives in Class 1 are divided into six divisions. However, as discussed in Section III. A of this preamble, TSA proposes to apply subpart B to part 1580 only to rail cars containing more than 2,268 kg (5,000 lbs) of a Division 1.1, 1.2, or 1.3 explosive material.

6.  See 49 CFR 173, subpart H.

7.  Pub. L. 107-71, 115 Stat. 597 (November 19, 2001).

8.  See 49 U.S.C. 114(d). The TSA Assistant Secretary's current authorities under ATSA have been delegated to him by the Secretary of Homeland Security. Section 403(2) of the Homeland Security Act (HSA) of 2002, Pub. L. 107-296, 116 Stat. 2315 (2002), transferred all functions of TSA, including those of the Secretary of Transportation and the Under Secretary of Transportation for Security related to TSA, to the Secretary of Homeland Security. Pursuant to DHS Delegation Number 7060.2, the Secretary delegated to the Assistant Secretary (then referred to as the Administrator of TSA), subject to the Secretary's guidance and control, the authority vested in the Secretary with respect to TSA, including that in section 403(2) of the HSA.

9.  49 U.S.C. 114(f).

10.  49 U.S.C. 114(f)(1)-(5); (h)(1)-(4).

11.  49 U.S.C. 114(f)(7).

12.  49 U.S.C. 114(f)(10).

13.  49 U.S.C. 114(f)(11).

14.  49 U.S.C. 114(f)(15).

15.  49 U.S.C. 114(l)(1).

16.  49 U.S.C. 114(f)(1) and (5).

17.  The annex is entitled “Annex to the Memorandum of Understanding Between the Department of Homeland Security and the Department of Transportation Concerning Transportation Security Administration and Pipeline and Hazardous Materials Safety Administration Cooperation on Pipeline and Hazardous Materials Transportation Security.”

18.  Pub. L. 110-53; 121 Stat. 266; August 3, 2007.

19.  The PHMSA NPRM proposed to require railroad carriers to compile annual data on specified shipments of hazardous materials, use the data to analyze safety and security risks along rail transportation routes where those materials are transported, assess alternative routing options, and make routing decisions based on those assessments. PHMSA also proposed clarifications of the current security plan requirements to address en route storage, delays in transit, delivery notification, and additional security inspection requirements for hazardous materials shipments. See 71 FR 76834 (December 21, 2006).

20.  The Freedom Center is a facility dedicated solely to transportation-security operations. Until June 21, 2007, the Freedom Center was known as the Transportation Security Operations Center, or TSOC. With state-of-the-art equipment and systems, the Freedom Center integrates all available capabilities to gather intelligence and conduct analysis related to transportation security. The Freedom Center correlates and fuses real-time intelligence and operational information across all modes of transportation, and coordinates with all homeland security agencies and with appropriate law enforcement agencies and stakeholders to gather additional information or to assist in the prevention of, and response to, transportation security-related incidents.

21.  6 CFR Part 27.

22.  Pub. L. 107-295; Nov. 25, 2002, as codified in 46 U.S.C. chapter 701.

23.  Pursuant to 6 CFR 27.105, a “covered facility” or “covered chemical facility” is a “chemical facility determined by the Assistant Secretary to present high levels of security risk, or a facility that the Assistant Secretary has determined is presumptively high risk under § 27.200.”

24.  PHMSA requires any person offering a hazardous material for transportation to provide an emergency response telephone number for use in the event of an emergency involving the hazardous material. See 49 CFR 172.604(a). The regulation requires that the telephone number be monitored at all times by “a person who is either knowledgeable of the hazardous material being shipped and has comprehensive emergency response and incident mitigation information for that material, or has immediate access to a person who possesses such knowledge and information,” but permits the offeror to meet this requirement by providing the telephone number of an agency or organization. See 49 CFR 172.604(a) and (b).

25.  In 1971, the chemical industry established CHEMTREC as a public service hotline for fire fighters, law enforcement, and other emergency responders to obtain information and assistance for emergency incidents involving chemicals and hazardous materials. Additionally, for a fee, CHEMTREC helps shippers of hazardous materials comply with the PHMSA regulatory requirement to provide an emergency telephone number on shipping documents that can be called in the event of an emergency involving the hazardous material that is being shipped. CHEMTREC also provides emergency responders with the information they need in the event of an incident.

26.  On May 24, 2004, TSA issued SD-RAILPAX-04-01 and SD-RAILPAX-04-02, which require passenger rail systems to implement certain security measures to address the terrorist threat and establish a consistent baseline of protective measures applicable to all passenger rail operators. One of the protective measures required each regulated party to designate a primary and alternate Security Coordinator and provide these names to TSA.

27.  FECA is a law administered by the Office of Workers' Compensation Programs (OWCP) of the U.S. Department of Labor. It provides compensation benefits to civilian employees of the United States for disability due to personal injury sustained while in the performance of duty or to employment-related disease. These benefits include payment of medical expenses and compensation for wage loss. FECA also provides for the payment of benefits to dependents of employees if the injury or disease causes the employee's death.

28.  The FTCA specifies how the Federal government can be sued in tort, and for what torts it can be sued.

29.  The objectives of HSPD-12 are to ensure that the credentialing processes are administered by accredited providers; are based on sound criteria for verifying an individual's identity; include a credential that is resistant to fraud, tampering, counterfeiting and terrorist exploitation, and can be authenticated quickly and electronically.

30.  On February 25, 2005, the Department of Commerce issued the Federal Information Processing Standards Publication 201 (FIPS 201), Personal Identification Verification of Federal Employees and Contractors in response toHSPD-12.

31.  49 U.S.C. 114(f)(3).

32.  49 U.S.C. 114(f)(9).

33.  TSA also works closely with DOT by consulting and coordinating on security-related transportation requirements to ensure they are consistent with the overall security policy goals and objectives established by DHS so that the regulated industry is not confronted with inconsistent security guidance or requirements promulgated by multiple agencies. While inspectors from both departments may sometimes perform joint inspections and share compliance information, each agency enforces its own regulatory requirements.

34.  49 U.S.C. 114(f)(10).

35.  49 U.S.C. 114(f)(11).

36.  49 U.S.C. 114(f)(15).

37.  49 U.S.C. 114(f)(10).

38.  See http://www.tsa.gov/​assets/​xls/​FY2007_​TSGP_​Training_​Cost_​Matrix.xls.

39.  See http://www.tsa.gov/​assets/​pdf/​TSGP_​Training_​IB243.pdf.

40.  As defined in 49 CFR 1580.3, a “rail secure area” is a secure location designated by a rail hazardous materials shipper or rail hazardous materials receiver where security-related pre-transportation or transportation functions are performed or rail cars containing the covered hazardous materials are prepared, loaded, stored, and/or unloaded.

41.  Accordingly, a regulated party that has an on-site employee (or authorized representative) who can use electronic monitoring to (for example) promptly notify law enforcement personnel to investigate the presence of a trespasser near a rail car would be in full compliance with the attendance requirement.

42.  TSA recognizes that the development of systems and technologies to enhance the physical security of assets and infrastructure is an evolving process. TSA does not wish to preclude the use of advanced technologies that would provide the regulated parties with additional options for meeting the requirements of 49 CFR 1580.107.

43.  For information on the exemption, see 49 CFR 1580.107(j).

44.  For purposes of accounting and reporting, the Surface Transportation Board (STB) groups freight railroad carriers into the following three classes:

Class I: Carriers having annual carrier operating revenues of $250 million or more after applying the railroad revenue deflator formula.

Class II: Carriers having annual carrier operating revenues of less than $250 million but in excess of $20 million after applying the railroad revenue deflator formula.

Class III: Carriers having annual carrier operating revenues of $20 million or less after applying the railroad revenue deflator formula.

See 49 CFR 1201; General Instructions 1-1. The railroad revenue deflator formula is based on the Railroad Freight Price Index developed by the Bureau of Labor Statistics. The formula is as follows:

Current Year's Revenues × (1991 Average Index/Current Year's Average Index)

The STB is an economic regulatory agency that Congress charged with the fundamental missions of resolving railroad rate and service disputes and reviewing proposed railroad mergers. See ICC Termination Act of 1995, Pub. L. 104-88, 109 Stat. 803 (December 31, 1995).

45.  In pertinent part, in 49 CFR 171.8, DOT defines a “person who offers” or “offeror” as:

(1) Any person who does either or both of the following:

(i) Performs, or is responsible for performing, any pre-transportation function required under [Subchapter C] for transportation of the hazardous material in commerce.

(ii) Tenders or makes the hazardous material available to a carrier for transportation in commerce.*  *  *  *  *

46.  In 49 CFR 171.8, DOT defines a “consignee” as “the person or place shown on a shipping document, package marking, or other media as the location to which a carrier is directed to transport a hazardous material.”

47.  Note that the preamble to the CFATS IFR stated that DHS may re-evaluate the coverage of railroads under that regulation, and if so would conduct a new rulemaking for that purpose. See 72 FR 17699 (April 9, 2007).

48.  TSA presumes that the commenter is referring to the Federal hours of service laws (49 U.S.C. 21101-21108), which includes requirements concerning maximum on-duty and minimum off-duty periods for individuals engaged in or connected with the movement of a train. See 49 U.S.C. 21101 and 21103.

49.  Railinc is a leading provider of information technology and related business services to the North American railroad industry. The company hosts a variety of rail industry revenue, equipment, and operations management applications.

50.  On June 23, 2006, DHS and DOT issued 24 recommended security action items for the rail transportation of materials poisonous by inhalation, commonly referred to as TIH materials. The security action items are divided into three categories: (1) System security; (2) access control; and (3) en-route security. On November 21, 2006, the two Departments issued three additional recommended security action items. The security action items are available on TSA's public Web site.

51.  Railinc, a subsidiary of the AAR, developed FreightScope from ASLRRA specifications and with sponsorship and funding from FRA. It provides a Web-based interactive dashboard of near-real-time rail shipment location information for North America. Users can quickly determine the last reported location of hazardous materials shipments that are in the control of Short Line railroads.

52.  The investigation stemming from the information must be conducted by: A Federal, State, or local regulatory or law enforcement agency; a Member or committee of Congress or the General Accounting Office; or a person with supervisory authority over the employee or such other person who has the authority to investigate, discover, or terminate the misconduct.

53.  Although § 1528 of the 9/11 Commission Act restructured the preemption provision in 49 U.S.C. 20106, Congress did so for “for clarification purposes” without intending “any substantive change in the meaning of the provision.” See 9/11 Commission Act, Conference Report to accompany H.R. 1, page 351 (July 25, 2007).

54.  See Section IV.G “Chain of Custody and Control.”

55.  See, 49 U.S.C. 114(d). The TSA Assistant Secretary's current authorities under ATSA have been delegated to him by the Secretary of Homeland Security. Under Section 403(2) of the Homeland Security Act (HSA) of 2002, Pub. L. 107-296, 116 Stat. 2315 (2002), all functions of TSA, including those of the Secretary of Transportation and the Undersecretary of Transportation of Security related to TSA, transferred to the Secretary of Homeland Security. Pursuant to DHS Delegation Number 7060.2, the Secretary's guidance and control, the authority vested in the Secretary with respect to TSA, including that in Section 403(2) of the HSA.

56.  49 U.S.C. 114(f)(3).

57.  49 U.S.C. 114(f)(1)-(5); (h)(1)-(4).

58.  49 U.S.C. 114(f)(7).

59.  49 U.S.C. 114(f)(10).

60.  49 U.S.C. 114(f)(11).

61.  49 U.S.C. 114(f)(15).

62.  49 U.S.C. 114(l)(1).

63.  49 U.S.C. 114(l)(2).

64.  49 U.S.C. 114(f)(1) and (5).

65.  HSPD-7, Paragraph 1.

66.  HSPD-7, Paragraph 15.

67.  HSPD-7, Paragraph 22(h).

68.  U.S. Department of Transportation, Research and Innovative Technology Administration, Bureau of Transportation Statistics, Pocket Guide to Transportation 2006 (Washington, D.C.: Bureau of Transportation Statistics, 2006).

69.  Bureau of Transportation Statistics, National Transportation Statistics, Modal Profile Transit Systems, Updated April 2005. Note, however, that four of the 152 transit systems listed by BTS are classified as trolley bus and would not be covered by this final rule. This is represented in Figure 4, which only shows 41 transit systems (14 heavy rail and 27 light rail).

70.  The estimate for “Other Rail Transit Systems” impacted by this final rule shown in Figure 4 is conservative because it includes conveyances such as vanpools and aerial tramways, which will not be affected by this rule.

71.  The number of facilities that actually are part of firms that meet the small entity definitions may be lower. TSA excluded only those facilities that could be clearly identified as belonging to corporations or municipalities that exceed the SBA standards.

72.  Again, it is important to note that the estimate of 86 “Other Rail Transit Systems” impacted by the rule is in all likelihood conservative.

73.  Note that calculations in Figures 8 and 9 may be off due to rounding.

74.  

California adopted the “Local Community Rail Security Act of 2006” on October 1, 2006.