[Federal Register Volume 73, Number 229 (Wednesday, November 26, 2008)]
[Rules and Regulations]
[Pages 72130-72180]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E8-27287]



[[Page 72129]]

-----------------------------------------------------------------------

Part II





Department of Homeland Security





-----------------------------------------------------------------------



Transportation Security Administration



-----------------------------------------------------------------------



49 CFR Parts 1520 and 1580



Rail Transportation Security; Final Rule

  Federal Register / Vol. 73, No. 229 / Wednesday, November 26, 2008 / 
Rules and Regulations  

[[Page 72130]]


-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

Transportation Security Administration

49 CFR Parts 1520 and 1580

[Docket No. TSA-2006-26514; Amendment Nos. 1520-5, 1580-(New)]
RIN 1652-AA51


Rail Transportation Security

AGENCY: Transportation Security Administration, DHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Transportation Security Administration (TSA) issues this 
final rule to enhance the security of our Nation's rail transportation 
system. This rule establishes security requirements for freight 
railroad carriers; intercity, commuter, and short-haul passenger train 
service providers; rail transit systems; and rail operations at 
certain, fixed-site facilities that ship or receive specified hazardous 
materials by rail. This rule codifies the scope of TSA's existing 
inspection program and requires regulated parties to allow TSA and 
Department of Homeland Security (DHS) officials to enter, inspect, and 
test property, facilities, conveyances, and records relevant to rail 
security. This rule also requires that regulated parties designate rail 
security coordinators and report significant security concerns.
    This rule further requires that freight rail carriers and certain 
facilities handling specified hazardous materials be able to report 
location and shipping information to TSA upon request and implement 
chain of custody requirements to ensure a positive and secure exchange 
of specified hazardous materials. TSA also clarifies and amends the 
sensitive security information (SSI) protections to cover certain 
information associated with rail transportation.

DATES: This final rule is effective December 26, 2008.

FOR FURTHER INFORMATION CONTACT: For questions related to freight rail 
security: Scott Gorton, Transportation Sector Network Management, 
Freight Rail Security, TSA-28, Transportation Security Administration, 
601 South 12th Street, Arlington, VA 22202-4220; telephone (571) 227-
1251; facsimile (571) 227-1923; e-mail [email protected].
    For questions related to passenger rail security: Morvarid 
Zolghadr, Mass Transit and Passenger Rail Security, TSA-28, 
Transportation Security Administration, 601 South 12th Street, 
Arlington, VA 22202-4220; telephone (571) 227-2957; e-mail 
[email protected].
    For legal questions: David H. Kasminoff, Office of Chief Counsel, 
TSA-2, Transportation Security Administration, 601 South 12th Street, 
Arlington, VA 22202-4220; telephone (571) 227-3583; facsimile (571) 
227-1378; e-mail [email protected].
    For questions related to SSI: Andrew E. Colsky, Office of the 
Special Counselor, SSI Office, TSA-31, Transportation Security 
Administration, 601 South 12th Street, Arlington, VA 22202-4220; 
telephone (571) 227-3513; facsimile (571) 227-2945; e-mail [email protected].

SUPPLEMENTARY INFORMATION:

Availability of Rulemaking Document

    You can get an electronic copy of this rulemaking document by--
    (1) Searching the Department of Transportation's electronic Docket 
Management System (DMS) Web page at http://dms.dot.gov/search;
    (2) Visiting the Department of Transportation's Docket Operations 
facility located at 1200 New Jersey Avenue, SE., West Building, Ground 
Floor, Room W12-140, Washington, DC 20590. The facility is open from 9 
a.m. to 5 p.m., Monday through Friday, excluding legal holidays. The 
Docket Operations telephone number is (202) 366-9826;
    (3) Accessing the Government Printing Office's Web page at http://www.gpoaccess.gov/fr/index.html; or
    (4) Visiting TSA's Security Regulations Web page at http://www.tsa.gov and accessing the link for ``Research Center'' at the top 
of the page.
    In addition, copies are available by writing or calling one of the 
individuals in the FOR FURTHER INFORMATION CONTACT section. When making 
such a request, please identify the docket number of this rulemaking.

Small Entity Inquiries

    The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 
1996 requires TSA to comply with small entity requests for information 
and advice about compliance with statutes and regulations within TSA's 
jurisdiction. Any small entity that has a question regarding this 
document may contact one of the persons listed in the FOR FURTHER 
INFORMATION CONTACT section. Persons can obtain further information 
regarding SBREFA on the Small Business Administration's (SBA) Web page 
at http://www.sba.gov/advo/laws/law_lib.html.

Abbreviations and Terms Used in This Document

AAR--Association of American Railroads
AEI--Automatic Equipment Identification
ASLRRA--American Short Line & Regional Railroad Association
Amtrak--National Railroad Passenger Corporation
CFATS--Chemical Facility Anti-Terrorism Standards
CVI--Chemical-terrorism Vulnerability Information
DOD--Department of Defense
DOE--Department of Energy
DOT--Department of Transportation
EPA--Environmental Protection Agency
FIPS201--Federal Information Processing Standards Publication 201
FRA--Federal Railroad Administration
FRFA--Final Regulatory Flexibility Analysis
FSO--Facility Security Officer
FTA--Federal Transit Administration
FTE--Full Time Equivalent
GPS--Global Positioning System
HMR--Hazardous Materials Regulations
HSPD--Homeland Security Presidential Directive
HTUA--High Threat Urban Area
IED--Improvised Explosive Device
MOU--Memorandum of Understanding
MTSA--Maritime Transportation Security Act
NAICS--North American Industry Classification System
NRC--Nuclear Regulatory Commission
OA--State Safety Oversight Agency
PCII--Protected Critical Infrastructure Information
PHMSA--Pipeline and Hazardous Materials Safety Administration
PIH--Poisonous by Inhalation or Poison Inhalation Hazard (materials) 
(PIH is another term for TIH)
RSC--Rail Security Coordinator
SBA--Small Business Administration
SD--Security Directive
SGI--Safeguards Information Program
SSI--Sensitive Security Information
STB--Surface Transportation Board
TIH--Toxic Inhalation Hazard (TIH is another term for PIH)

Outline of Final Rule Preamble

I. Background and Summary of the Final Rule
    A. Summary of the Rule
    B. Purpose of the Rule
    C. Changes From the NPRM
II. Overlap Between TSA's Rule and Other DHS Regulations
III. Rail Security-Sensitive Materials
IV. Public Comments on the NPRM and TSA Responses on Regulatory 
Provisions
    A. Summary
    B. Specification of Hazardous Materials
    C. Rail Security Coordinators
    D. Inspection Authority
    E. Reporting Significant Security Concerns
    F. Sensitive Security Information
    G. Chain of Custody and Control
    H. Location and Shipping Information for Certain Rail Cars
    I. Whistleblower Protection for Employees
    J. Preemption
    K. Comments on the Regulatory Impact Assessment

[[Page 72131]]

    L. Comments Beyond the Scope of the Rulemaking
V. Rulemaking Analyses and Notices
    A. Executive Order 12866 Assessment (Regulatory Planning and 
Review)
    B. Regulatory Flexibility Act Assessment
    C. Paperwork Reduction Act
    D. International Trade Impact Assessment
    E. Unfunded Mandates Reform Act Analyses
    F. Executive Order 13132 (Federalism)
    G. Environmental Analysis
    H. Energy Impact Analysis

I. Background and Summary of This Final Rule

A. Summary of This Rule

    TSA's final rule applies several general requirements to all 
freight and passenger railroad carriers, certain facilities that ship 
or receive specified hazardous materials by rail, and rail transit 
systems:
     Rail Security Coordinator. Covered entities must designate 
a rail security coordinator (RSC) and at least one alternate RSC to be 
available to TSA on a 24-hour, seven days per week basis to serve as 
the primary contact for receipt of intelligence information and other 
security-related activities.
     Reporting. Covered entities must immediately report 
incidents, potential threats, and significant security concerns to TSA.
     TSA Inspection. Covered entities must allow TSA 
inspectors, and DHS officials working with TSA, to enter and conduct 
inspections, copy records, perform tests, and conduct other activities 
necessary to carry out TSA's statutory responsibilities.
     Sensitive Security Information (SSI). This rule clarifies 
and extends the protection afforded to SSI in rail transportation and 
further identifies covered persons to include railroad carriers; 
certain facilities that ship or receive specified hazardous materials 
by rail; transit systems; and State, local, and tribal employees, 
contractors, and grantees.
    The rule also applies additional requirements to freight railroad 
carriers and certain facilities that ship or receive specified 
hazardous materials by rail:
     Location and Shipping Information. Covered entities must 
provide to TSA, upon request, the location and shipping information of 
rail cars within their physical custody or control that contain a 
specified category and quantity of hazardous material. Class I freight 
railroad carriers must provide the information to TSA no later than 
five minutes (for one car) or 30 minutes (for two or more cars) after 
receiving the request. Other railroad operators and rail hazardous 
materials shipper and receiver facilities must provide the information 
for one or more cars within 30 minutes after receiving the request.
     Chain of Custody and Control. Covered entities must 
provide for a secure chain of custody and control of rail cars 
containing a specified quantity and type of hazardous material.
    As TSA specified in its Notice of Proposed Rulemaking (NPRM) for 
this rulemaking (see 71 FR 76852, December 21, 2006), chain of custody 
and location requirements apply to specified quantities of three 
categories of hazardous materials based on the Department of 
Transportation's (DOT's) Hazardous Materials Regulations (HMR) (49 CFR 
parts 171-180):
    (1) A rail car containing more than 2,268 kg (5,000 lbs) of a 
Division 1.1, 1.2, or 1.3 (explosive) material, as defined in 49 CFR 
173.50;
    (2) A tank car containing a material poisonous by inhalation (PIH) 
as defined in 49 CFR 171.8, including anhydrous ammonia, Division 2.3 
gases poisonous by inhalation as set forth in 49 CFR 173.115(c), and 
Division 6.1 liquids meeting the defining criteria in 49 CFR 
173.132(a)(1)(iii) and assigned to hazard zone A or hazard zone B in 
accordance with 49 CFR 173.133(a), excluding residue quantities of 
these materials; and
    (3) A rail car containing a highway route-controlled quantity of a 
Class 7 (radioactive) material, as defined in 49 CFR 173.403.
    Appendix B to part 1580 of Title 49 of the Code of Federal 
Regulations, reproduced as Table 1 below, presents a brief summary of 
the security measures required for the different categories of rail 
transportation entities that this final rule governs.

                                                      Table 1--TSA Rail Security Final Rule Summary
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                         Freight      Rail operations
                                                        Freight          railroad        at certain    Rail operations                    Certain other
                                                        railroad         carriers     facilities that     at certain       Passenger     rail operations
                                                      carriers NOT     transporting     ship (i.e.,    facilities that      railroad        (private,
         Security measure and rule section            transporting      specified     offer, prepare,     receive or      carriers and      business/
                                                       specified        hazardous       or load for         unload        rail transit   office, circus,
                                                       hazardous     materials (Sec.  transportation)     hazardous         systems          tourist,
                                                       materials        1580.100(b))     hazardous        materials                         historic,
                                                                                         materials      within an HTUA                      excursion)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Allow TSA to inspect (Sec.   1580.5)..............               X                X                X                X                X                X
Appoint rail security coordinator (Sec.   1580.101               X                X                X                X                X            (\1\)
 freight; Sec.   1580.201 passenger)..............
Report significant security concerns (Sec.                       X                X                X                X                X                X
 1580.105 freight; Sec.   1580.203 passenger).....
Provide location and shipping information for rail  ...............               X                X                X   ...............  ...............
 cars containing specified hazardous materials if
 requested (Sec.   1580.103)......................
Chain of custody and control requirements for       ...............               X                X                X   ...............  ...............
 transport of specified hazardous materials that
 are or may be in an HTUA (Sec.   1580.107).......
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ Only if notified in writing that a security threat exists.

B. Purpose of the Rule

    In developing this rule, TSA identified and addressed threats to 
rail transportation. With respect to passenger rail, TSA recognizes 
that passenger railroad carriers, commuter operations, and subway 
systems are high consequence targets in terms of potential loss of life 
and economic disruption. They carry large numbers of people in a 
confined environment, offer the opportunity for specific populations to 
be targeted at particular destinations, and often have stations located 
below or adjacent to high profile government buildings, major office 
complexes, and iconic structures. Terrorist bombings since 1995 
highlight the need for improved government access to, and monitoring 
of, transportation of passengers by rail. Terrorists have attacked the 
Tokyo subway system (1995); areas in and around the Moscow subway 
system (2000, 2001, and 2004); Madrid commuter trains (2004); the 
London Underground system (2005);

[[Page 72132]]

and the train system in Mumbai (formerly known as Bombay), India 
(2006).
    TSA is also considering the threats that face freight rail 
transportation. Due to the open infrastructure of the rail 
transportation system, freight trains can be particularly vulnerable to 
attack. Currently, rail carriers and shippers lack positive chain of 
custody and control procedures for rail cars as they move through the 
transportation system (e.g., as entities load the rail cars at 
originating facilities, as carriers transport the cars over the tracks, 
and as entities unload the cars at receiving facilities). This can 
present a significant vulnerability. Whenever entities stop rail cars 
in transit and interchange them without appropriate security measures, 
it creates security vulnerabilities. Freight trains transporting 
hazardous materials are of even more concern, because an attack on 
those trains (e.g., through the placement of improvised explosive 
devices (IEDs) \1\ or other forms of sabotage) could result in the 
release of hazardous materials.
---------------------------------------------------------------------------

    \1\ An IED is a device fabricated in an improvised manner that 
incorporates explosives or destructive, lethal, noxious, 
pyrotechnic, or incendiary chemicals into its design. It generally 
includes a power supply, a switch or timer, and a detonator or 
initiator.
---------------------------------------------------------------------------

    TSA's NPRM proposed a number of measures to improve the security of 
freight rail and passenger rail, including rail transit. It also 
proposed security requirements for shippers and receivers of certain 
hazardous materials. This final rule adopts most of the provisions of 
the NPRM. TSA presented its rationale for each element of the NPRM in 
Section III of the preamble to the NPRM. 71 FR at 76861-76866. TSA 
describes the differences between the NPRM and this final rule in 
Section I.C of this preamble. TSA presents a summary of the public 
comments and responses in Section V of this preamble.
    TSA's final rule adopts a risk-based approach by focusing on 
shipments of certain hazardous materials and establishing chain of 
custody and control procedures and other measures for rail cars that 
pose the greatest security vulnerabilities. While an IED attached to 
any rail car (such as a car transporting coal or household appliances) 
would obviously cause major damage to that car and its contents upon 
detonation, the more likely scenario is that terrorists would target a 
rail car containing highly toxic, explosive, or radioactive hazardous 
materials, which would cause the greatest loss of life and property and 
damage to the national economy.
    To determine which hazardous materials to identify in the proposed 
regulation, TSA considered the hazardous materials for which security 
plans are required as specified in 49 CFR Part 172, Subpart I. (These 
requirements were included in a final rule adopted by the Pipeline and 
Hazardous Materials Safety Administration (PHMSA) under Docket Number 
HM-232.\2\) From the list of materials in 49 CFR 172.800(b), TSA 
identified three categories \3\ of hazardous materials that pose the 
greatest transportation security risk--materials that are poisonous by 
inhalation (PIH),\4\ explosive, and radioactive. In the NPRM, TSA 
proposed to apply specific requirements to certain carriers and 
facilities that handle these materials. This final rule focuses on the 
same materials.
---------------------------------------------------------------------------

    \2\ See Section II.B of the preamble to the NPRM for a detailed 
discussion of the HM-232 rule. 71 FR at 76856.
    \3\ TSA also identified specified quantities of those hazardous 
materials. See Section I.B of this preamble or 49 CFR 1580.100(b) 
for a list of the quantities.
    \4\ PIH materials are gases or liquids that are known or 
presumed on the basis of tests to be so toxic to humans as to pose a 
hazard to health during transportation. See 69 FR 50988. See also 49 
CFR 171.8, 173.115, and 173.132.
---------------------------------------------------------------------------

    Each of these three categories of hazardous materials presents 
serious security risks. The release of PIH materials in a densely 
populated urban area would have catastrophic consequences. Such a 
release would endanger significant numbers of people. The consequences 
of an accidental PIH release in a rural area were seen in the January 
6, 2005 rail accident in Graniteville, South Carolina. A Norfolk 
Southern Railway Company (NS) freight train carrying chlorine was 
improperly diverted from the main track onto a rail spur. The train 
struck a standing train on the rail spur, derailing three locomotives 
and sixteen rail cars and rupturing a single tank car carrying 
chlorine. Even in this sparsely populated area, the collision resulted 
in fatal injuries to eight residents and one railroad employee, 
injuries to 630 people, and the evacuation of 5,400 local residents. 
The property damage, including damages to the rolling stock and track, 
exceeded $6.9 million. While the accident was not the result of a 
terrorist attack, it nonetheless illustrates the danger of transporting 
PIH materials and the damage that can result from a release.
    Although the number of rail shipments carrying explosives and 
radioactive materials is relatively low, a release of these materials 
could cause serious and devastating harm. If terrorists detonated 
certain explosives \5\ at critical points in the transportation cycle, 
they could cause significant loss of life and damage to infrastructure, 
and harm the national economy through the accompanying disruption to 
commerce. Likewise, if terrorists perpetrated an attack against a rail 
car transporting certain radioactive materials,\6\ they could endanger 
a significant number of people as well as disrupt the supply chain as a 
result of contamination.
---------------------------------------------------------------------------

    \5\ Explosives in Class 1 are divided into six divisions. 
However, as discussed in Section III. A of this preamble, TSA 
proposes to apply subpart B to part 1580 only to rail cars 
containing more than 2,268 kg (5,000 lbs) of a Division 1.1, 1.2, or 
1.3 explosive material.
    \6\ See 49 CFR 173, subpart H.
---------------------------------------------------------------------------

    This final rule addresses the above-identified threats to rail 
transportation in several ways. This rule codifies the authority for 
TSA inspections, requires the designation of a rail security 
coordinator (RSC), and requires the reporting of significant security 
concerns by most entities to which the rule is applicable. These 
requirements will improve TSA's ability to inspect rail operations and 
communicate with railroads and rail facilities. Through these 
mechanisms, TSA and DHS will obtain better information and monitoring 
capabilities concerning potential transportation security incidents 
involving rail transportation and travel. Also, this final rule's 
requirements related to hazardous materials, such as additional 
monitoring and protection of certain rail cars and increased 
availability of location and shipping information for certain rail 
cars, will decrease the vulnerabilities of these hazardous materials 
shipments to attack.
    TSA has legal authority to impose these requirements. Under the 
Aviation and Transportation Security Act (ATSA) \7\ and delegated 
authority from the Secretary of Homeland Security, TSA has broad 
responsibility and authority for ``security in all modes of 
transportation * * * including security responsibilities * * * over 
modes of transportation that are exercised by the Department of 
Transportation.'' \8\ TSA

[[Page 72133]]

has authorities in addition to those transferred from DOT.\9\ TSA is 
empowered to develop policies, strategies, plans, and regulations for 
dealing with threats to all modes of transportation. As part of its 
security mission, TSA is responsible for assessing intelligence and 
other information to identify individuals who pose a threat to 
transportation security and to coordinate countermeasures with other 
Federal agencies to address such threats.\10\ TSA enforces security-
related regulations and requirements,\11\ ensures the adequacy of 
security measures for the transportation of cargo,\12\ oversees the 
implementation and ensures the adequacy of security measures at 
transportation facilities,\13\ and carries out other appropriate duties 
relating to transportation security.\14\ TSA has broad regulatory 
authority to achieve ATSA's objectives, and may issue, rescind, and 
revise such regulations as are necessary to carry out TSA 
functions.\15\ TSA is also charged with serving as the primary liaison 
for transportation security to the intelligence and law enforcement 
communities.\16\
---------------------------------------------------------------------------

    \7\ Pub. L. 107-71, 115 Stat. 597 (November 19, 2001).
    \8\ See 49 U.S.C. 114(d). The TSA Assistant Secretary's current 
authorities under ATSA have been delegated to him by the Secretary 
of Homeland Security. Section 403(2) of the Homeland Security Act 
(HSA) of 2002, Pub. L. 107-296, 116 Stat. 2315 (2002), transferred 
all functions of TSA, including those of the Secretary of 
Transportation and the Under Secretary of Transportation for 
Security related to TSA, to the Secretary of Homeland Security. 
Pursuant to DHS Delegation Number 7060.2, the Secretary delegated to 
the Assistant Secretary (then referred to as the Administrator of 
TSA), subject to the Secretary's guidance and control, the authority 
vested in the Secretary with respect to TSA, including that in 
section 403(2) of the HSA.
    \9\ 49 U.S.C. 114(f).
    \10\ 49 U.S.C. 114(f)(1)-(5); (h)(1)-(4).
    \11\ 49 U.S.C. 114(f)(7).
    \12\ 49 U.S.C. 114(f)(10).
    \13\ 49 U.S.C. 114(f)(11).
    \14\ 49 U.S.C. 114(f)(15).
    \15\ 49 U.S.C. 114(l)(1).
    \16\ 49 U.S.C. 114(f)(1) and (5).
---------------------------------------------------------------------------

    TSA's authority with respect to transportation security is 
comprehensive and supported with specific powers related to the 
development and enforcement of regulations, security directives (SDs), 
security plans, and other requirements. Accordingly, under this 
authority, TSA may assess a security risk for any mode of 
transportation, develop security measures for dealing with that risk, 
and enforce compliance with those measures.
    The Federal hazardous materials transportation law (Federal hazmat 
law, 49 U.S.C. 5101 et seq.), authorizes the Secretary of DOT to 
``prescribe regulations for the safe transportation, including 
security, of hazardous material in intrastate, interstate, and foreign 
commerce.'' The Secretary of DOT has delegated this authority to PHMSA. 
Under the mandate in Sec.  5103(b), PHMSA promulgated the HMR (49 CFR 
parts 171-180), which govern safety aspects, including security, of the 
transportation of hazardous material the Secretary of DOT considers 
appropriate. In accordance with its security authority, in March 2003, 
PHMSA adopted new transportation security requirements for offerors and 
transporters of certain classes and quantities of hazardous materials 
and new security training requirements for hazardous materials 
employees. The security regulations require offerors and carriers to 
develop and implement security plans and to train their employees to 
recognize and respond to possible security threats.
    On August 9, 2006, DOT/PHMSA and DHS/TSA signed an annex to the 
September 28, 2004, ``Memorandum of Understanding Between the 
Department of Homeland Security and the Department of Transportation on 
Roles and Responsibilities'' (DHS-DOT MOU).\17\ The purpose of the 
annex is to delineate clear lines of authority and responsibility, 
promote communication and efficiency, and avoid duplication of effort 
through cooperation and collaboration in the area of hazardous 
materials transportation security based on existing legal authorities 
and core competencies. The annex acknowledges that DHS has lead 
authority and primary responsibility for security activities in all 
modes of transportation and notes that TSA is the lead Federal entity 
for transportation security.
---------------------------------------------------------------------------

    \17\ The annex is entitled ``Annex to the Memorandum of 
Understanding Between the Department of Homeland Security and the 
Department of Transportation Concerning Transportation Security 
Administration and Pipeline and Hazardous Materials Safety 
Administration Cooperation on Pipeline and Hazardous Materials 
Transportation Security.''
---------------------------------------------------------------------------

    Similarly, on September 28, 2006, DOT's Federal Railroad 
Administration (FRA) and TSA signed an annex to the DHS-DOT MOU to 
address each agency's roles and responsibilities for rail 
transportation security. The FRA-TSA annex recognizes that TSA is the 
lead Federal entity for transportation security in general and rail 
security in particular. Concerning safety, the FRA-TSA annex recognizes 
that FRA has authority over every area of railroad safety (including 
security) and that FRA enforces PHMSA's HMR. The FRA-TSA annex includes 
procedures for coordinating: (1) Planning, inspection, training, and 
enforcement activities; (2) criticality and vulnerability assessments 
and security reviews; (3) communication with affected stakeholders; and 
(4) the use of personnel and resources. Copies of the two annexes are 
available for review in the public docket for this rulemaking. 
Consistent with the principles outlined in the PHMSA-TSA and FRA-TSA 
annexes, PHMSA and FRA collaborated with TSA to develop this final 
rule.
    On April 16, 2008, PHMSA published an interim final rule in the 
Federal Register to revise the current requirements in the HMR 
applicable to the safe and secure transportation of hazardous materials 
transported in commerce by rail. 73 FR 20752. Specifically, PHMSA 
adopted the following:
     Rail carriers transporting certain explosives, PIH 
material, and radioactive materials must compile information and data 
on the commodities transported, including the transportation routes 
over which they transport these commodities.
     Rail carriers transporting the specified hazardous 
materials must use the data they compile on commodities they transport 
to analyze the safety and security risks for the transportation routes 
used and all practicable alternative routes to the one used. Rail 
carriers must utilize these analyses to make transportation decisions 
that result in the transportation of these materials over the safest 
and most secure commercially practicable routes posing the least 
overall safety and security risks.
     Rail carriers must specifically address the security risks 
associated with shipments delayed in transit or temporarily stored in 
transit as part of their security plans.
     Rail carriers transporting covered hazardous materials 
must notify consignees if there is a significant unplanned delay 
affecting the delivery of the hazardous material.
     Rail carriers must work with shippers and consignees to 
minimize the time a rail car containing one of the specified hazardous 
materials is placed on track awaiting pick-up or delivery or transfer 
from one carrier to another.
     Rail carriers must conduct visual security inspections at 
ground level of rail cars containing hazardous materials to inspect for 
signs of tampering or the introduction of an IED.

C. Changes From the NPRM

    This section summarizes the regulatory text changes that TSA has 
made to the NPRM in this final rule. In addition to the summary 
contained in this section, in many cases TSA has provided a more 
extensive discussion of the change, and the reason for the change, in 
the response to comments below. See Section IV ``Public Comments on the 
NPRM and TSA Responses on Regulatory Provisions.'' Finally, to the 
extent TSA has made technical corrections or corrected typographical 
errors, we do not specifically discuss them.

[[Page 72134]]

1. Sensitive Security Information
    TSA has revised paragraph (b)(15) of 49 CFR 1520.5 to add rail to 
the categories of research and development information related to 
transportation security activities that is protected as SSI. TSA has 
revised paragraph (b) of 49 CFR 1520.11 to add State, local, and tribal 
government employees, contractors, and grantees to the list of persons 
with a potential need to know SSI. TSA made this change to be 
consistent with DHS policy on information sharing and allow States, 
localities and tribal governments, and their contractors and grantees, 
to have access to SSI if the information is needed for the performance 
of official duties, such as the prevention or mitigation of security 
incidents, contracts, or grants.
2. Rail Security-Sensitive Materials
    This final rule defines the term ``rail security-sensitive 
materials'' to mean one or more of the categories and quantities of the 
materials set forth in the new Sec.  1580.100(b), the transportation of 
which requires the operators to carry out the security measures in this 
rule. TSA has introduced this term to comply with Sec. Sec.  1501(13) 
and 1551 of the ``Implementing the Recommendations of the 9/11 
Commission Act of 2007'' (9/11 Commission Act).\18\ Section 1501(13) 
defines ``security-sensitive material'' to mean a material or group of 
materials, in a particular quantity and form that the Secretary of 
Homeland Security, in consultation with the Secretary of 
Transportation, determines through rulemaking with opportunity for 
public comment, poses a significant risk to national security while 
being transported in commerce. Section 1551 directs the Secretary of 
Transportation, in consultation with the Secretary of Homeland 
Security, to publish a final rule based on the PHMSA NPRM published on 
December 21, 2006.\19\ That section directs the Secretary of 
Transportation to ensure that the PHMSA final rule requires railroad 
carriers of ``security-sensitive materials'' to ``select the safest and 
most secure route to be used in transporting'' those materials and to 
select such route based on the railroad carrier's analysis of the 
safety and security risks on primary and alternate transportation 
routes over which the carrier has authority to operate.
---------------------------------------------------------------------------

    \18\ Pub. L. 110-53; 121 Stat. 266; August 3, 2007.
    \19\ The PHMSA NPRM proposed to require railroad carriers to 
compile annual data on specified shipments of hazardous materials, 
use the data to analyze safety and security risks along rail 
transportation routes where those materials are transported, assess 
alternative routing options, and make routing decisions based on 
those assessments. PHMSA also proposed clarifications of the current 
security plan requirements to address en route storage, delays in 
transit, delivery notification, and additional security inspection 
requirements for hazardous materials shipments. See 71 FR 76834 
(December 21, 2006).
---------------------------------------------------------------------------

    Through this Rail Transportation Security rulemaking, TSA has 
provided the public with an opportunity to comment on its 
identification of security-sensitive materials in the rail sector. See 
Section III of this preamble. TSA has added the term ``rail security-
sensitive material'' to 49 CFR 1580.3 to denote that the Secretary of 
Homeland Security has determined that the categories and quantities of 
hazardous materials set forth in 49 CFR 1580.100(b) pose a significant 
risk to national security while being transported in commerce by rail 
due to the potential use of one or more of these materials in an act of 
terrorism. TSA has therefore concluded that these categories and 
quantities of hazardous materials constitute ``security-sensitive 
material'' for purposes of triggering the railroad routing requirements 
in Sec.  1551 of the 9/11 Commission Act.
3. Inspection Authority
    In response to commenters who expressed concerns about verifying 
the identity and credentials of TSA inspectors, TSA has added a new 
paragraph (d) to 49 CFR 1580.5. It provides that TSA inspectors, and 
DHS officials working with TSA, will present their credentials for 
examination, at the request of the entity being inspected, with the 
understanding that the credentials may not be reproduced. Any regulated 
party wishing to authenticate the identity of an individual purporting 
to represent TSA may contact the Freedom Center at 703-563-3240 or 1-
877-456-8722.\20\
---------------------------------------------------------------------------

    \20\ The Freedom Center is a facility dedicated solely to 
transportation-security operations. Until June 21, 2007, the Freedom 
Center was known as the Transportation Security Operations Center, 
or TSOC. With state-of-the-art equipment and systems, the Freedom 
Center integrates all available capabilities to gather intelligence 
and conduct analysis related to transportation security. The Freedom 
Center correlates and fuses real-time intelligence and operational 
information across all modes of transportation, and coordinates with 
all homeland security agencies and with appropriate law enforcement 
agencies and stakeholders to gather additional information or to 
assist in the prevention of, and response to, transportation 
security-related incidents.
---------------------------------------------------------------------------

4. Reporting Significant Security Concerns
    In the NPRM, TSA stated that reports of potential threats and 
significant security concerns to DHS would be required ``in a manner 
prescribed by TSA.'' See 49 CFR 1580.105(b) and 1580.203(b). In this 
final rule, TSA has revised paragraph (b) of each section to indicate 
that the regulated parties must make the required reports by 
telephoning the Freedom Center at 703-563-3240 or 1-877-456-8722.
5. Chain of Custody and Control Requirements
    Some commenters asked TSA to explain the concept of ``attending a 
rail car'' in the context of complying with the requirement in 
paragraphs (c) and (d) of 49 CFR 1580.107 ``to ensure that the rail car 
is not left unattended at any time during the physical transfer of 
custody.'' One commenter asked if ``maintain[ing] positive control of 
the rail car'' for purposes of 49 CFR 1580.107(f)(1) was merely 
synonymous with a prohibition against unattended pick up and delivery. 
In response, TSA has added a new paragraph (k) to 49 CFR 1580.107 to 
explain the terms ``attended'' and ``maintains positive control.'' As 
used in Sec.  1580.107, a rail car is ``attended'' if an employee or 
authorized representative of the freight railroad carrier: (1) Is 
physically located on site in reasonable proximity to the rail car; (2) 
is capable of promptly responding to unauthorized access or activity at 
or near the rail car, including immediately contacting law enforcement 
or other authorities, and (3) immediately responds to any unauthorized 
access or activity at or near the rail car either personally or by 
contacting law enforcement or other authorities. Electronic monitoring 
is permitted so long as the responsible party is located on site and 
can accomplish an equivalent level of surveillance, response, and 
notification. Attending a rail car is a component part of maintaining 
positive control. As used in Sec.  1580.107, when the rail hazardous 
materials receiver and freight railroad carrier communicate and 
cooperate with each other to ensure the security of the rail car during 
the physical transfer of custody, they are ``maintaining positive 
control'' of the car.
    TSA has also included an explanation in paragraph (k) of the term 
``document the transfer.'' As used in Sec.  1580.107, a transfer of 
physical custody of a rail car is properly documented, either in 
writing or electronically, when the documentation contains, at a 
minimum: (1) The car's initial (also known as the reporting mark) and 
number; (2) the names or employee numbers of the individuals who 
attended the transfer; (3) the location where the transfer took place; 
and (4) the date and time the transfer was completed.

[[Page 72135]]

6. Location and Shipping Information for Certain Rail Cars
    In the NPRM, TSA proposed a one-hour timeframe for freight railroad 
carriers, rail hazardous materials shippers, and rail hazardous 
materials receivers to report the location and shipping information to 
TSA or other DHS officials for a specified rail car(s). However, in 
recognition of the fact that such information is critical to addressing 
specific security threats or incidents, TSA sought comment on the 
feasibility of a shorter timeframe, such as five minutes or thirty 
minutes. Based upon comments received and TSA's understanding of the 
technological capabilities of the regulated parties, we have changed 
the reporting timeframe in 49 CFR 1580.103 by revising paragraph (d) 
and adding a new paragraph (e). Paragraph (d) requires all Class I 
freight railroad carriers subject to Sec.  1580.103 to provide location 
and shipping information to TSA within five minutes if the request 
concerns only one car and within thirty minutes if the request concerns 
two or more rail cars. Paragraph (e) requires all other entities 
subject to Sec.  1580.103 to provide the information to TSA within 
thirty minutes, regardless of how many rail cars the request concerns. 
TSA has also added a new paragraph (h) to Sec.  1580.103 to indicate 
that TSA has adopted the same definition of ``Class I carrier'' as used 
by the Surface Transportation Board (STB). See 49 CFR part 1201, 
General Instructions 1-1.
    The NPRM would have required each regulated party to develop 
procedures for determining location and shipping information, if 
requested by TSA, for covered rail cars under their physical custody 
and control, but the NPRM did not propose to require the regulated 
party to provide TSA with a contact telephone number to use when 
requesting this information. TSA has added a new paragraph (g) to Sec.  
1580.103, requiring each regulated party to provide TSA with a 
telephone number that is monitored by a live person on a 24-hours a 
day, seven days a week basis. This will assure a prompt response on 
those occasions when TSA needs information.
7. Harmonization of Federal Regulation of Nuclear Facilities
    TSA recognizes that its statutory authorities and obligations may 
extend to facilities involved in the production and utilization of 
nuclear materials or weapons already subject to safety, security, and 
inspection requirements imposed by the Nuclear Regulatory Commission 
(NRC) and the Department of Energy (DOE). To ensure that regulated 
entities are not subject to duplicative or conflicting regulatory or 
inspection requirements, TSA has included section 1580.111 of the 
regulations, which states that TSA will coordinate activities under 
this subpart with the NRC and DOE with respect to regulation of rail 
hazardous materials shippers and receivers that are also licensed or 
regulated by the NRC or DOE under the Atomic Energy Act of 1954, as 
amended, to maintain consistency with the requirements imposed by the 
NRC and DOE. TSA will enter into appropriate agency-to-agency 
agreements with the NRC and DOE to carry out section 1580.111.

II. Overlap Between TSA's Rule and Other DHS Regulations

    This Rail Transportation Security final rule affects entities that 
also may be subject to the requirements of other DHS rules--e.g., the 
DHS Chemical Facility Anti-Terrorism Standards (CFATS) regulation \21\ 
and the Coast Guard's Maritime Transportation Security Act (MTSA) \22\ 
regulations. This section describes the interrelationships of this rule 
with the CFATS and MTSA regulations.
---------------------------------------------------------------------------

    \21\ 6 CFR Part 27.
    \22\ Pub. L. 107-295; Nov. 25, 2002, as codified in 46 U.S.C. 
chapter 701.
---------------------------------------------------------------------------

    Pursuant to Sec.  550 of the Department of Homeland Security 
Appropriations Act of 2007 (2007 DHS Appropriations Act) (Pub. L. 109-
295), which provides DHS with the authority to regulate the security of 
certain high-risk chemical facilities in the United States, DHS issued 
an interim final rule on Chemical Facility Anti-Terrorism Standards. 
See 72 FR 17688 (April 9, 2007). The CFATS rule establishes risk-based 
performance standards for the security of our Nation's high-risk 
chemical facilities. It requires facilities that possess specified 
chemicals at or above specified amounts to provide information to DHS. 
From this information, DHS will initially determine which facilities 
are high-risk and preliminarily place high-risk chemical facilities 
\23\ in risk-based tiers. Such facilities must then prepare Security 
Vulnerability Assessments, which identify facility security 
vulnerabilities, and develop and implement Site Security Plans, which 
include measures that satisfy the DHS-identified risk-based performance 
standards. The CFATS rule contains associated provisions addressing 
inspections and audits, recordkeeping, and protection of information 
that constitutes Chemical-terrorism Vulnerability Information (CVI).
---------------------------------------------------------------------------

    \23\ Pursuant to 6 CFR 27.105, a ``covered facility'' or 
``covered chemical facility'' is a ``chemical facility determined by 
the Assistant Secretary to present high levels of security risk, or 
a facility that the Assistant Secretary has determined is 
presumptively high risk under Sec.  27.200.''
---------------------------------------------------------------------------

    In the CFATS interim final rule (IFR), DHS recognized that with 
respect to chemical security, certain aspects of Sec.  550 and TSA's 
authorities are concurrent and overlapping. In the preamble to the 
CFATS IFR, DHS stated that it does not presently plan to screen 
railroad facilities for inclusion in the Sec.  550 program (although 
DHS reserves the right to reevaluate their possible coverage at a 
future date). See 72 FR 17698-17699. Nevertheless, it is possible that 
some chemical facilities will be subject to both CFATS and this TSA 
final rule. Specifically, it is possible that some facilities, which 
are rail hazardous materials shippers or receivers as defined in this 
final rule, may be subject to the CFATS screening requirements and may 
become covered facilities (i.e., high-risk facilities) under the CFATS 
rule. In such situations, the facilities will have to comply with the 
requirements of both regulatory programs (including requirements to 
provide information under both programs). TSA and DHS, however, will 
work closely together to ensure that the efforts directed at these 
facilities are coordinated and consistent.
    MTSA requires the Secretary of Homeland Security to issue 
regulations to strengthen the security of American ports and waterways 
and the ships that use them. This authority, in addition to other 
grants of authority, serves as the basis for a comprehensive maritime 
security regime. Under these authorities, the Coast Guard issued 
regulations to ensure the security of vessels, facilities, and other 
elements of the maritime transportation system. Part 105 of Title 33 of 
the Code of Federal Regulations imposed requirements on a range of 
maritime facilities, including hazardous material and petroleum 
facilities and those fleeting facilities that receive barges carrying, 
in bulk, cargoes regulated by Subchapters D and O of Chapter I, Title 
46, Code of Federal Regulations or Certain Dangerous Cargoes.
    Pursuant to these maritime security regulations, the Coast Guard 
requires these facilities to perform security assessments and then, 
based on these assessments, develop security plans, and implement 
security measures and procedures in order to reduce the risk of, and to 
mitigate the results of, any security incident that threatens the 
facility, its personnel, the public, the environment, and the economy.

[[Page 72136]]

    A few commenters requested that TSA not apply certain provisions of 
this final rule to facilities that comply with 33 CFR part 105 of the 
MTSA regulations. Specifically, commenters requested that TSA exempt 
these facilities from the Rail Transportation Security rule's 
requirements for appointing RSCs, for reporting of significant security 
concerns, and for chain of custody and controls. TSA addresses those 
specific comments in Section V of this preamble. Generally, however, 
TSA has decided not to exempt MTSA-regulated facilities from these 
requirements.
    Regulating rail security at maritime facilities is a complex issue, 
and TSA recognizes that certain aspects of the Coast Guard's maritime 
security regulations and TSA's authorities are concurrent and 
overlapping. In some respects, compliance with the Coast Guard 
regulations and with these regulations can be achieved through the same 
operational practices. For example, the Facility Security Officer (FSO) 
can serve as the RSC. Also, the rail secure area required by this rule 
can be the same area as the restricted area designated in the facility 
security assessment required by 33 CFR 105.305, so long as the 
regulated party employs physical security measures to ensure that no 
unauthorized person gains access to the area. However, to the extent 
that the two sets of requirements are different to account for mode-
specific differences in the security issues being addressed by the 
Coast Guard and TSA, the facility would have to satisfy both sets of 
regulatory requirements. TSA and the Coast Guard will work closely 
together to make sure that the requirements of the two programs are 
complementary, not inconsistent, with each other.

III. Rail Security-Sensitive Material

    As discussed in section I.C.3 of this preamble, Sec.  1501(13) of 
the 9/11 Commission Act defines the term ``security-sensitive 
material'' to mean ``a material, or a group or class of material, in a 
particular amount and form that the Secretary [of Homeland Security], 
in consultation with the Secretary of Transportation, determines, 
through a rulemaking with the opportunity for public comment, poses a 
significant risk to national security while being transported in 
commerce due to the potential use of the material in an act of 
terrorism.'' In making such a determination, the Secretary of Homeland 
Security is directed to consider at least the following: (1) Class 7 
radioactive materials; (2) Division 1.1, 1.2, and 1.3 explosives; (3) 
materials poisonous or toxic by inhalation, including Division 2.3 
gases and Division 6.1 materials; and (4) a select agent or toxin 
regulated by the Centers for Disease Control and Prevention (CDC) under 
42 CFR part 73.
    As discussed in section IV.B of this preamble, DHS and DOT assessed 
the security vulnerabilities associated with the transportation of 
different types and classes of hazardous materials before proposing to 
apply enhanced security requirements for the categories and quantities 
of explosive, PIH, and radioactive materials specified in proposed 
Sec.  1580.100(b). TSA sought comment on whether to apply the 
requirements in this final rule to fewer or additional hazardous 
materials or to extend the requirements to include tank cars containing 
residue. TSA also sought comment on whether there are other hazardous 
materials that could cause significant loss of life, transportation 
system disruption, or economic disruption and whether TSA should apply 
the requirements in this final rule to those other materials.
    TSA did not propose to include select agents or toxins regulated by 
the CDC under 42 CFR part 73, because railroads transport few, if any, 
shipments of these types of materials. Generally, shipments of 
infectious substances, including select agents and toxins, must be 
transported quickly from point of origin to destination to prevent 
degradation of samples that can occur over time and to ensure swift 
diagnosis and treatment of infectious diseases. For these reasons, 
highway (for short distances) and air (for longer distances) are the 
preferred modes of transportation for these materials.
    TSA provided notice and invited public comment in the NPRM on the 
list of materials that the Secretary of Homeland Security is required 
to consider under Sec.  1501(13) of the 9/11 Commission Act when 
defining ``security-sensitive material.'' The hazardous materials set 
forth in Sec.  1580.100(b) of this final rule constitute the Secretary 
of Homeland Security's list of ``security-sensitive materials'' for 
purposes of rail transportation. See Sec.  1551 of the 9/11 Commission 
Act. Accordingly, the Secretary of Homeland Security, in consultation 
with the Secretary of Transportation, has satisfied the requirements of 
Sec.  1551 with respect to the rail mode of transportation and has 
determined that ``rail security-sensitive materials'' are: (1) More 
than 2,268 kg (5,000 lbs) in a single carload of a Division 1.1, 1.2, 
or 1.3 explosive; (2) a tank car containing a material poisonous by 
inhalation, as defined in 49 CFR 171.8, including anhydrous ammonia but 
excluding residue quantities of these materials; and (3) a highway 
route-controlled quantity of a Class 7 (radioactive) material, as 
defined in 49 CFR 173.403.
    The list of ``rail security-sensitive materials'' represents the 
materials that TSA has determined are appropriate at this time for 
purposes of this final rule and the PHMSA interim final rule. DHS, in 
consultation with DOT, will continue to evaluate the transportation 
security risks posed by all types of hazardous materials and may 
regulate the transportation by rail of other materials at a later time. 
TSA notes that although PHMSA must require railroad carriers 
transporting the categories and quantities of materials identified on 
the DHS list of ``rail security-sensitive materials'' to comply with 
the routing requirements in the PHMSA interim final rule, DOT is not 
precluded by Sec.  1551 of the 9/11 Commission Act from regulating the 
railroad routing of additional materials or quantities of materials, 
such as rail cars transporting residue amounts of hazardous materials.

IV. Public Comments on the NPRM and TSA Responses on Regulatory 
Provisions

A. Summary

    To gain additional commenter input on the proposed rail security 
requirements, TSA held a public meeting on February 2, 2007 in 
Arlington, Virginia. Sixty-one persons attended the meeting. The oral 
presentations given by stakeholders mirrored their written comments. 
Transcripts from the public meeting are available for review in the 
public docket for this rulemaking. The public comment period for the 
NPRM closed on February 20, 2007. TSA received approximately 73 public 
comments on the NPRM. Comments were submitted by trade associations, 
individual companies, labor unions, States and localities, and private 
individuals.
    Below is a summary of the public comments and TSA's responses, 
organized as follows: Section A describes the overall organization of 
this section of the preamble, and Section B includes comments and 
responses related to the specification of hazardous materials. Sections 
C, D, and E include comments and responses on issues that apply to 
passenger rail (including rail transit), freight rail, and hazardous 
materials facilities that ship or receive materials by rail. These 
issues relate to the appointment of an RSC, TSA's inspection authority, 
and the requirement to report suspicious incidents or activities. 
Section F

[[Page 72137]]

includes comments and responses on SSI issues. Sections G and H include 
comments and responses on issues that relate to freight railroad 
carriers and hazardous materials facilities that ship or receive 
materials by rail. Section I includes comments and responses on 
whistleblower protection. Section J includes comments and responses on 
preemption. Section K includes comments and responses on the regulatory 
impact assessment. Section L concerns comments that are beyond the 
scope of this rulemaking.

B. Specification of Hazardous Materials

    As explained in the NPRM, TSA, PHMSA, and FRA have assessed the 
security vulnerabilities associated with the transportation of 
different types and classes of hazardous materials. TSA applied 
enhanced security requirements for certain categories and quantities of 
hazardous materials (i.e., as specified in proposed Sec.  1580.100(b)) 
based upon specific railroad transportation scenarios depicting how 
individuals could deliberately use hazardous materials to cause 
significant casualties and property damage. 71 FR at 76861. The 
materials specified in the NPRM present a significant rail 
transportation security risk and an attractive target for terrorists 
because of the potential for these materials to be used as weapons of 
mass effect. The proposed rule excluded tank cars containing only 
residue quantities of the hazardous material, because TSA concluded 
that, from a security perspective, the consequences of the release of a 
residue quantity of a PIH material would be significantly less than the 
consequences involving a loaded tank car. 71 FR at 76861. TSA sought 
comment on whether to apply the requirements in the final rule to fewer 
or additional hazardous materials or to extend the requirements to 
include tank cars containing residue quantities. TSA also sought 
comment on whether there are other hazardous materials that could cause 
significant loss of life, transportation system disruption, or economic 
disruption and whether TSA should apply the requirements in the final 
rule to those other materials.
    Comments: An association commented that this final rule should not 
apply to Division 1.3 explosives, which consist of materials such as 
fireworks, smokeless powder, and rocket motors. The commenter noted 
that while TSA characterizes Division 1.3 explosives as commodities 
presenting ``a fire hazard and either a minor blast hazard or a minor 
projection hazard or both, but not a mass explosion hazard'' (71 FR at 
76861), many commodities present a fire hazard that are not included in 
the commodities identified by TSA as warranting special security 
protection.
    TSA Response: TSA is retaining Division 1.3 explosives in Sec.  
1580.100(b) of the final rule, because these explosive materials in the 
quantities covered in this rule present a significant security risk in 
transportation. Although a Division 1.3 explosive presents a minor 
blast and/or projection hazard, this material is extremely flammable 
and could be used as a weapon of mass effect. If compromised in transit 
by detonation or as a secondary explosion to an IED, Division 1.3 
explosives could result in substantial damage to people, public and 
private property, and rail infrastructure.
    Comments: A labor union recommended that TSA reduce the 5,000 pound 
applicability trigger for explosives in Sec.  1580.100(b) to 100 
pounds.
    TSA Response: TSA has not adopted this recommendation. A low 
threshold quantity of 100 pounds of explosives, even if compromised or 
detonated in transit, is unlikely to have the potential to turn the 
rail shipment into a weapon of mass effect.
    Comments: Several commenters expressed some concern that the TSA 
and PHMSA rail security NPRMs are not consistent in terms of their 
application to shipments of PIH materials. The PHMSA NPRM applies to 
bulk quantities of PIH materials. A ``bulk quantity'' as used in the 
HMR means a quantity that exceeds 450 L (119 gallons) for liquids, a 
net mass greater than 400 kg (882 pounds) for solids, or a water 
capacity greater than 454 kg (1,000 pounds) as a receptacle for gas. 
See 49 CFR 171.8. Thus, the provisions of the PHMSA NPRM would apply to 
PIH shipments transported in tank cars, including residue amounts 
exceeding 119 gallons, and portable tanks and other bulk containers. In 
contrast, the TSA NPRM would apply to tank cars containing PIH 
materials but exclude residues. Commenters suggested that the two rules 
should be applied consistently. They recommended that both final rules 
adopt the TSA tank-car threshold and exclude residue shipments, because 
they represent a low security threat.
    TSA Response: We believe that there are important distinctions 
between the quantities of concern from a security perspective and the 
quantities of concern from a safety perspective. These distinctions 
account for the differences between the two rules. The amount of 
residue remaining in a tank car varies, but in most instances, tank car 
residues will total approximately 1-2 percent of the original amount of 
material in the tank, or 1,800-3,600 pounds. There are legitimate 
safety concerns relating to residue quantities even though the target 
attractiveness from a security standpoint is diminished. PHMSA explains 
those safety concerns in its rule. With respect to security, the 
potential consequences of the release of a residue quantity of al PIH 
material would be significantly less than the consequences of an 
incident involving a loaded tank car. Therefore, in this final rule, 
TSA is requiring enhanced security measures for the classes and 
quantities of PIH materials as proposed in the NPRM (i.e., not tank 
cars containing residual PIH materials). TSA has determined that 
residue quantities of PIH materials in bulk packaging shipments do not 
carry sufficient amounts of security-sensitive materials to warrant the 
enhanced security measures required by this rulemaking.
    Comments: Some commenters were confused as to whether TSA intended 
anhydrous ammonia to be included as a PIH material for which enhanced 
security measures are required.
    TSA Response: The answer is yes. To ensure that this confusion does 
not persist, we are specifically adding anhydrous ammonia as an example 
in Sec.  1580.100(b) of a material covered by the security requirements 
in this final rule. Commenters are correct that, under the HMR, 
anhydrous ammonia is classed as a Division 2.2 compressed gas for 
domestic transportation. However, anhydrous ammonia meets the 
definition of a material that is poisonous by inhalation under 49 CFR 
171.8 of the HMR. That definition includes any material identified as 
an inhalation hazard by a special provision in column 7 of the 49 CFR 
172.10 Hazardous Materials Table. The entry for anhydrous ammonia in 
the Hazardous Materials Table includes Special Provision 13, which 
requires the words ``Inhalation Hazard'' to be entered on shipping 
papers and marked on packages.
    Comments: Some commenters believed that the hazardous materials 
listed in 49 CFR 1580.100(b) should include other flammable gases and 
liquids, since those materials could be weaponized, as well as include 
other materials that could cause serious damage if released into rivers 
and lakes. One commenter recommended that TSA extend the applicability 
of this final rule to cover commodities that convert to poisonous gases 
when they come into contact with water, fire, or acids; this commenter 
referenced a train derailment that occurred near Superior,

[[Page 72138]]

Wisconsin on June 30, 1992 in which 73 persons were injured when the 
contents of one rail car reacted with water and formed a vast vapor 
cloud.
    TSA Response: While TSA agrees that other types of hazardous 
materials pose certain security risks in rail transportation, the risks 
are not as great as those posed by the explosive, radioactive, and PIH 
materials specified in this final rule, and at this time we are not 
persuaded that they warrant the additional precautions required by this 
final rule. TSA, in consultation with PHMSA and FRA, will continue to 
evaluate the rail transportation security risks posed by all types of 
hazardous materials and the effectiveness of existing Federal 
regulations in addressing those risks and will consider specific 
requirements as necessary.
    Comments: One commenter requested that TSA revise the applicability 
language in 49 CFR 1580.100(b)(3) by replacing the threshold limit of 
``a highway route-controlled quantity of a Class 7 (radioactive) 
material'' with the NRC's published list of Import and Export Threshold 
Limits for Category 1 and 2 Radioactive Materials. See Appendix P to 20 
CFR part 110.
    TSA Response: TSA has retained the threshold limits for radioactive 
materials as proposed in the NPRM. From a security perspective, it 
appears that the consequences from a release of a radioactive material 
subject to the lower threshold limits set forth by the NRC would be 
significantly less than the consequences of an incident using a highway 
route-controlled quantity of a Class 7 radioactive material.

C. Rail Security Coordinators

    Section 1580.101 of the NPRM proposed that freight railroad 
carriers, rail hazardous materials shippers, and rail hazardous 
materials receivers within a High Threat Urban Area (HTUA) appoint an 
RSC, designated at the corporate level, to serve as the primary contact 
for intelligence information and security-related activities and 
communications with TSA, and coordinate security practices and 
procedures with law enforcement and emergency response agencies. 
Section 1580.201 of the NPRM proposed that passenger railroad carriers 
and rail transit systems appoint RSCs who would perform the same 
functions. TSA received numerous comments on the RSC provisions of the 
NPRM. TSA summarizes those comments and its responses below.
1. The RSC Role Must Be Performed by a Designated Individual
    Comments: Several commenters, representing railroad carriers and 
explosives manufacturers, remarked that many companies already have 
emergency response and communications systems in place, with some of 
them following PHMSA's emergency response information requirements.\24\ 
Some of these commenters urged TSA to allow the use of an emergency 
contact center number or a 24-hour corporate security number, instead 
of appointing an RSC.\25\ The commenters stressed that an emergency 
call center could connect the TSA caller to the appropriate security or 
response personnel as needed. Further, other commenters thought that 
having TSA maintain telephone lists of specific individuals named as 
RSCs does not appear to add value to the regulation.
---------------------------------------------------------------------------

    \24\ PHMSA requires any person offering a hazardous material for 
transportation to provide an emergency response telephone number for 
use in the event of an emergency involving the hazardous material. 
See 49 CFR 172.604(a). The regulation requires that the telephone 
number be monitored at all times by ``a person who is either 
knowledgeable of the hazardous material being shipped and has 
comprehensive emergency response and incident mitigation information 
for that material, or has immediate access to a person who possesses 
such knowledge and information,'' but permits the offeror to meet 
this requirement by providing the telephone number of an agency or 
organization. See 49 CFR 172.604(a) and (b).
    \25\ In 1971, the chemical industry established CHEMTREC as a 
public service hotline for fire fighters, law enforcement, and other 
emergency responders to obtain information and assistance for 
emergency incidents involving chemicals and hazardous materials. 
Additionally, for a fee, CHEMTREC helps shippers of hazardous 
materials comply with the PHMSA regulatory requirement to provide an 
emergency telephone number on shipping documents that can be called 
in the event of an emergency involving the hazardous material that 
is being shipped. CHEMTREC also provides emergency responders with 
the information they need in the event of an incident.
---------------------------------------------------------------------------

    TSA Response: TSA believes that there is great security value in 
requiring the appointment of RSCs and in requiring regulated entities 
to provide contact information for these individuals. The RSC or 
alternate must serve as the security liaison between the regulated 
party and TSA. The RSC or alternate provides a primary single point of 
contact at the corporate level for receiving communications and 
inquiries from TSA concerning threat information or security procedures 
and coordinating responses with appropriate law enforcement and 
emergency response agencies. If TSA needs to convey extremely time-
sensitive security information to a regulated party, particularly in 
situations requiring frequent information updates, it is important for 
the sake of continuity that TSA be able to interact with a specific 
individual. The RSC must be in a position to understand security 
problems, raise issues with corporate leadership, and recognize when 
emergency response action is appropriate.
    TSA has decided not to allow the use of emergency call centers or 
24-hour generic contact numbers to substitute for the requirement to 
designate named individuals to serve as RSCs and alternate RSCs. 
However, using call centers, in conjunction with appointed RSCs, may be 
an appropriate way to satisfy the requirements of 49 CFR 1580.101(e)(2) 
and 1580.201(e)(2). To meet these requirements, the call center or 
emergency hotline would need to be staffed 24-hours a day, 7 days a 
week, and must be able to immediately locate and communicate with the 
RSC.
2. Scope of Section 1580.101
    Comments: Several commenters suggested that certain operations do 
not need RSCs or that individuals performing similar functions for 
other purposes, such as individuals responsible for security under 
DHS's CFATS rule, should be able to serve as RSCs.
    Some commenters argued that proposed Sec.  1580.101 should not 
apply to marine terminals because those facilities are regulated under 
the Coast Guard security requirements. They believed that TSA should 
exclude ``on-dock'' rail facilities from the requirement.
    Several trade associations stated that Sec.  1580.101 should not 
apply to a rail hazardous material shipper or receiver that only ships 
or receives the specified hazardous materials on an occasional basis. 
One of these commenters noted that many of its members are relatively 
small operations that may ship or receive tank cars of anhydrous 
ammonia only once or twice a year. Another association recommended 
exempting entities that ship or receive less than three rail cars per 
month.
    Two trade associations objected to requiring occasional rail 
hazardous materials shippers or receivers to have an RSC available 24-
hours a day, 7 days a week, 365 days a year, even if the facility has 
no rail cars in its custody or in transit. Similarly, several 
commenters argued that TSA should not require the RSC to be available 
24-hours a day, 7 days a week for short line railroads that only 
operate 40 hours per week or for railroads that do not transport 
hazardous materials.
    TSA Response: TSA requires a point of contact for all carriers, 
regardless of whether they transport hazardous

[[Page 72139]]

materials, because security concerns may arise that are unrelated to 
hazardous materials. TSA must be able to communicate as soon as 
possible with the RSC for all affected freight railroad carriers and 
rail hazardous materials facilities if TSA needs to convey extremely 
time-sensitive threat information or security procedures or seek 
information relating to threats or potential threats.
    TSA has also carefully considered the comments concerning freight 
railroad carriers who rarely transport, and shippers and receivers who 
rarely ship or receive, rail cars containing the categories and 
quantities of hazardous materials covered by part 1580. However, TSA 
has decided not to exempt these entities from the RSC requirements. 
With respect to infrequent shipments of hazardous materials, the 
consequences can be significant even if a railroad carrier only 
transports a single carload or a rail hazardous materials facility only 
ships or receives a single carload. The January 6, 2005 rail accident 
in Graniteville, South Carolina resulted in the puncture of a single 
tank car of chlorine, but the consequences of that accident were 
substantial.
    In the case of rail hazardous materials facilities that are also 
subject to the maritime security regime required by MTSA, the 
individual who serves as the FSO may also fulfill the duties of the 
RSC, provided that the person understands the responsibilities of an 
RSC as provided in 49 CFR 1580.101. See 33 CFR parts 101-106. However, 
compliance with MTSA does not itself satisfy the TSA requirement
3. Scope of Section 1580.201
    Comments: Some commenters representing passenger railroads 
suggested that proposed Sec.  1580.201 should not apply to tourist, 
scenic, historic, and excursion railroad operations. One commenter 
recommended that TSA exempt the systems unless they operate in an HTUA, 
while another commenter believed that the requirements would pose an 
undue burden.
    TSA Response: TSA is promulgating the final RSC requirement as 
proposed. TSA only requires a tourist, scenic, historic, or excursion 
passenger rail operation, whether on or off the general railroad system 
of transportation, to designate and use an RSC if TSA informs it in 
writing that it must do so because of a general or specific threat 
concerning that operation. An exemption is not appropriate because many 
tourist, scenic, historic, and excursion operations, though not 
necessarily operating in areas of high risk, do carry large numbers of 
people and may become potential terrorist targets.
    If the need arises, TSA will inform the carrier of the need for an 
RSC. In determining whether one or more of these passenger railroad 
carriers must designate and use an RSC, TSA will consider all available 
information, including location, populations served, and any 
intelligence, law enforcement, and reported suspicious activity.
4. Responsibilities of the RSC
    Comments: A few commenters asked whether a corporate RSC could 
serve multiple regulated facilities or operations and whether the 
individual serving as the RSC may perform other functions. One State 
agency commenter recommended that the primary and alternate RSCs 
appointed by passenger railroad operators or mass transit operators 
should be identified within the existing State Safety Oversight Agency 
(OA), formed under 49 CFR part 659.
    TSA Response: A single RSC or alternate may have responsibility for 
multiple covered rail facilities that are owned and operated by one 
corporation, provided that the individual has the information necessary 
to perform the RSC's duties.
    This final rule allows different people to be on call at different 
times throughout the day, provided that at least one RSC or alternate 
is available to TSA on a 24-hour, 7 days a week basis. This final rule 
allows a passenger rail operator to select a qualified individual who 
also performs job duties for the OA to serve as the RSC.
5. Rail Security Coordinators Identified Previously
    Comments: One mass transit agency asked whether a list of security 
coordinators previously sent to TSA to comply with the rail SDs would 
satisfy Sec.  1580.201's requirement to appoint an RSC.\26\
---------------------------------------------------------------------------

    \26\ On May 24, 2004, TSA issued SD-RAILPAX-04-01 and SD-
RAILPAX-04-02, which require passenger rail systems to implement 
certain security measures to address the terrorist threat and 
establish a consistent baseline of protective measures applicable to 
all passenger rail operators. One of the protective measures 
required each regulated party to designate a primary and alternate 
Security Coordinator and provide these names to TSA.
---------------------------------------------------------------------------

    TSA Response: Yes, passenger railroad carriers and rail transit 
systems that have already provided the required information on their 
primary and alternate RSCs to TSA have complied with the requirements 
of Sec.  1580.201. They do not have to take further action unless any 
of the contact information changes. However, all covered parties, 
including those passenger railroad carriers and rail transit systems 
that have already provided the required information, must report all 
changes to the names, titles, telephone numbers, and e-mail addresses 
of the RSCs and alternate RSCs to TSA within seven calendar days.
6. Rail Security Coordinator Coordination With State and Local 
Governments
    Comments: Several commenters representing State and local agencies 
stated that contact information for RSCs should be made available to 
local governments where hazardous material rail cars may be staged. 
Another commenter requested that TSA make RSC information available to 
local emergency planning committees and/or the sheriff's department at 
all locations where the railroad maintains a switching yard where rail 
cars containing hazardous materials subject to this final rule may be 
staged for more than four hours.
    TSA Response: When it is necessary and appropriate, TSA will make 
RSC information available to State and local government agencies for 
official business purposes, including emergency responders.
7. Rail Security Coordinator Training
    In the NPRM, TSA noted that the RSC proposal was crafted as a 
performance standard, and TSA anticipated that each of the regulated 
parties would provide its RSC with the information necessary to perform 
his or her job duties. 71 FR at 76863. However, TSA sought comment on 
whether to add a training requirement for RSCs in the final rule or via 
another rulemaking, and requested information on potential training 
methods.
    Comments: TSA received comments both supporting and opposing the 
inclusion of training standards. Commenters supporting training 
requirements recommended TSA include standards that were consistent 
with those that the Coast Guard requires for FSOs under 33 CFR 105.205. 
Other commenters believed training programs were necessary to ensure a 
common knowledge base across the industry. For example, The Tri-State 
Oversight Committee for Maryland, Virginia, and the District of 
Columbia encouraged TSA to create a national level training program for 
RSCs and suggested that TSA establish a single training academy where 
RSCs could network and share best practices, similar to the Federal 
Transit Administration's (FTA's) workshops for State Safety Oversight

[[Page 72140]]

personnel. Other commenters stated that training was unnecessary, 
because railroad personnel already perform similar functions and have 
been trained to perform them.
    TSA Response: TSA has determined not to provide RSC training at 
this time or to provide specific training standards. To comply with the 
RSC requirement, the regulated party must ensure that individuals 
performing RSC duties are available to TSA on a 24-hours a day basis, 
capable of serving as the primary point of contact with TSA on security 
matters, and able to coordinate security practices and procedures with 
appropriate law enforcement and emergency response agencies. To meet 
the performance standard established for RSCs, TSA expects entities 
subject to this requirement to provide any necessary training, which 
may be specific to each entity.

D. Inspection Authority

    TSA received numerous comments on many aspects of the inspection 
provisions of the NPRM. TSA considered all the comments and has decided 
to make only one minor change to the inspection provisions. 
Specifically, TSA has added a new paragraph (d) to 49 CFR 1580.5 to 
state that upon request, TSA inspectors and DHS officials working with 
TSA will present their credentials for examination, but with the 
proviso that the credentials may not be photocopied or otherwise 
reproduced (so as to mitigate the possibility that an inspector's 
credentials will be duplicated for fraudulent purposes). TSA added this 
paragraph in response to commenter requests for an authentication 
process to verify the identity of an individual purporting to represent 
TSA.
1. Unannounced Inspections
    Comments: Section 1580.5(c) of the NPRM codified TSA's authority to 
``enter, without advance notice * * * any area or within any conveyance 
* * * in order to inspect or test compliance, or perform other such 
duties as TSA may direct.'' Many commenters objected to this provision, 
raising the following comments and concerns:
     Unannounced inspections will disrupt ongoing business 
activities.
     TSA should pre-arrange inspections when practical.
     Employees of railroads and facilities who find TSA 
inspectors on their premises might view them as a threat and respond by 
calling law enforcement or security guards.
     The presence of TSA inspectors on rail lines and in 
operating facilities would be dangerous to TSA employees, rail system 
or facility employees, and customers. Inspectors should be escorted, 
qualified, and/or trained to ensure safety. Some commenters recommended 
specific types of safety training.
     Railroad operators and facility owner/operators may incur 
liability if TSA inspectors or others are injured.
     TSA inspectors should be required to obtain facility 
identification media and/or TSA should provide a mechanism through 
which they can verify the identity of TSA inspectors.
     The rule language is inconsistent with Security Directive 
RAILPAX-04-01.
     TSA should limit the scope of potential unannounced visits 
to hazardous materials shipper, railroad carrier, and hazardous 
materials receiver locations where rail cars containing PIH, explosive, 
and radioactive materials. are handled
    TSA Response:
    a. Need to Conduct Unannounced Inspections
    TSA has retained the language that it used in the NPRM with respect 
to conducting inspections within any area or conveyance of a regulated 
party without providing advance notice. TSA anticipates that in most 
cases it will notify railroad carriers, rail transit systems, and rail 
hazardous materials facilities of scheduled inspections. This notice 
gives the parties to be inspected the opportunity to gather evidence of 
compliance and to arrange to have the appropriate personnel available 
to assist TSA. However, inspections related to a particular incident, 
and inspections that are made without notice, are necessary. Some 
inspections can only be effective if they are unannounced, so as to 
determine whether the regulated party is in compliance when it is 
unaware that TSA may be inspecting. TSA must have the flexibility to 
respond to information, operations, and specific circumstances whenever 
they exist or develop. TSA must be able to assess the security of 
covered parties during all times of the day or night and under all 
operational situations. Consequently, TSA may have to conduct 
inspections in the evenings, at night, on weekends, or on holidays. 
Security concerns are different at different times of the day and on 
different days of the week, and terrorists may seek to take advantage 
of vulnerabilities whenever they occur. TSA must be able to assess 
potential threats and an entity's security measures at any time.
    The nature of any given TSA inspection will depend on the specific 
circumstances surrounding a particular railroad carrier, rail transit 
system, or rail hazardous materials shipper or receiver's operations at 
a given point in time and will be considered in conjunction with 
available threat information. While TSA may choose to notify regulated 
entities, local emergency responders, or other agencies on a case-by-
case basis, TSA is not including a mandatory requirement to notify the 
regulated party.
    We note, too, that many of the locations that TSA may inspect do 
not have access controls, such as fences or gates. Indeed, in some 
locations, the general public has easy access to the property. 
Unannounced TSA inspections of these areas will not require access to 
controlled areas. Further, TSA's inspection may test the regulated 
party's ability to detect and respond to the presence of unauthorized 
individuals.
    b. Contacts with Law Enforcement Officials
    In response to the commenters who believe that unannounced TSA 
inspections would create new safety and security risks for TSA 
inspectors and to other individuals on rail property, TSA recognizes 
that the presence of a seemingly unauthorized individual on the 
property of a railroad carrier, rail transit system, or rail hazardous 
materials facility may result in law enforcement officials being 
contacted. In the case of announced or planned inspections, TSA has 
trained its inspectors to identify themselves when they reach the 
facility to be inspected in order to avoid unnecessary notification of 
local law enforcement officials. In the case of unannounced inspections 
where the inspector has not notified any representative of the 
inspected facility, TSA has trained its inspectors to provide 
identification upon demand to a representative of the facility.
    c. Danger
    In response to commenter concerns about their liability in 
connection with TSA personnel who may be injured on rail property while 
performing unannounced inspections, we note that we have trained our 
inspectors on specific safety and security protocols to follow while 
inspecting the equipment and facilities of a regulated party. In the 
event that a TSA inspector is either injured or alleged to have caused 
an injury while on a regulated party's property, we will address the 
situation in accordance with applicable laws and regulations. By way of 
example, as a general rule, a TSA employee who sustains injuries while 
performing official duties is compensated by the Federal Employees 
Compensation Act

[[Page 72141]]

(FECA), 5 U.S.C. 8101-8193.\27\ Persons who believe they have a tort 
claim against the United States may pursue their rights under the 
Federal Torts Claim Act (FTCA).\28\ See 26 U.S.C. 2671-2680.
---------------------------------------------------------------------------

    \27\ FECA is a law administered by the Office of Workers' 
Compensation Programs (OWCP) of the U.S. Department of Labor. It 
provides compensation benefits to civilian employees of the United 
States for disability due to personal injury sustained while in the 
performance of duty or to employment-related disease. These benefits 
include payment of medical expenses and compensation for wage loss. 
FECA also provides for the payment of benefits to dependents of 
employees if the injury or disease causes the employee's death.
    \28\ The FTCA specifies how the Federal government can be sued 
in tort, and for what torts it can be sued.
---------------------------------------------------------------------------

    d. Relationship to Inspection Authority Pursuant to Security 
Directives
    The American Public Transportation Association (APTA) commented 
that conducting unannounced inspections is inconsistent with the 
requirement in SD RAILPAX-04-01 that TSA coordinate inspections with 
the rail property's designated security coordinator. In response, TSA 
acknowledges that it is expanding the requirements in the rail SDs. In 
most cases, TSA inspectors will notify the rail property in advance to 
schedule an inspection and, to the extent practicable, work in close 
partnership during the visit with the RSC designated under Sec.  
1580.201 or other appropriate official(s) designated by the railroad 
carrier or rail transit system. However, TSA must be able to make 
unannounced inspections to check for compliance. To the extent there is 
ambiguity as to whether TSA inspections, evaluations, and tests to 
ensure compliance with the rail SDs can only be performed if they are 
announced and coordinated in advance with the regulated party, TSA 
notes that the inspection authority set forth in 49 CFR 1580.5 
supersedes the provisions in TSA's rail SDs that compliance visits will 
be coordinated with the Security Coordinator.
    e. Training of TSA Inspectors
    TSA appreciates that inspectors must be properly trained to avoid 
danger to themselves, to workers on the inspected property, to 
travelers, and to the inspected property. TSA intends to use only 
properly trained personnel to conduct inspections. TSA puts its 
inspectors through a rigorous training program, incorporating classroom 
and field training, so that inspectors are knowledgeable on all aspects 
related to this regulatory program as well as on safety issues. TSA 
inspectors receive training on specific safety procedures to use while 
inspecting the equipment and facilities of freight and passenger 
railroad carriers, transit system owners and operators, and rail 
hazardous materials facilities, including the Transportation Safety 
Institute's Transportation of Hazardous Materials course covering 49 
CFR parts 100-185. Many of TSA's inspectors have backgrounds in law 
enforcement and physical security and are subject matter experts in the 
field of railroad transportation, including the transportation of 
hazardous materials. In addition, all DHS officials conducting 
inspections with TSA will receive training, including training on 
applicable FRA requirements and the safety procedures to follow while 
aboard a conveyance or inside a terminal or facility. If a rail 
hazardous materials facility requests that an inspector receive 
facility-specific safety briefings or training, TSA will work with the 
facility to accommodate those requests, provided that the timing is 
acceptable and that additional safety training is reasonable given the 
nature of the expected inspection.
2. Use of Identification Media and Verification of Identity of TSA 
Inspectors
    Comments: Section 1580.5(c) provides that TSA is authorized to 
``enter, without advance notice * * * any area or within any conveyance 
without access media or identification media * * * in order to inspect 
or test compliance, or perform other such duties as TSA may direct.'' 
Many commenters expressed concerns and comments about verifying the 
identity and credentials of inspectors. For example, APTA expressed the 
view that allowing TSA personnel to conduct inspections without 
identification media issued by the rail property would create 
unnecessary delays and disruption until their identities can be 
properly verified. APTA recommended that TSA inspectors use local 
identification media in addition to their TSA credentials to reduce the 
possibility that an individual posing as a TSA inspector could gain 
access to a property and compromise security.
    Several commenters asked TSA to include a clearly stated 
authentication process, including a 24/7 telephone number, in the text 
of this final rule. Other commenters recommended that TSA officials be 
required to present government credentials and other identification 
(including photo identification) before being allowed on site, be 
badged at the facility to be inspected, or be escorted by a company 
representative.
    One commenter stated that TSA inspections at NRC-licensed 
facilities without presentation of access or identification media 
issued or approved by the NRC licensees would place the licensees in 
direct violation of NRC regulations and security orders concerning 
access authorization.
    TSA Response: TSA inspectors will carry Federal government 
credentials identifying themselves as having official authority to 
inspect. In addition, any railroad carrier, rail transit system, or 
rail hazardous materials facility wishing to authenticate the identity 
of an individual purporting to represent TSA may contact the Freedom 
Center at 703-563-3240 or 1-877-456-8722. In addition, TSA has provided 
some additional regulatory text on the issue of inspector credentials. 
Upon the request of an entity being inspected by TSA (and, as 
applicable, DHS officials working with TSA) the TSA or DHS official 
will present their credentials for examination, provided that the 
credentials may not be photocopied or otherwise reproduced. See 49 CFR 
1580.5(d).
    TSA notes that Homeland Security Presidential Directive 12 (HSPD-
12) requires Federal agencies to improve secure identification 
processes for Federal employees and contractors.\29\ The U.S. 
Department of Commerce has published guidance on the standards and 
methods by which Agencies could reach compliance with HSPD-12.\30\
---------------------------------------------------------------------------

    \29\ The objectives of HSPD-12 are to ensure that the 
credentialing processes are administered by accredited providers; 
are based on sound criteria for verifying an individual's identity; 
include a credential that is resistant to fraud, tampering, 
counterfeiting and terrorist exploitation, and can be authenticated 
quickly and electronically.
    \30\ On February 25, 2005, the Department of Commerce issued the 
Federal Information Processing Standards Publication 201 (FIPS 201), 
Personal Identification Verification of Federal Employees and 
Contractors in response to HSPD-12.
---------------------------------------------------------------------------

    As the capability becomes available and implementation of HSPD-12 
continues, all Federal employees will have Federally-issued HSPD-12 
compliant cards. TSA will establish procedures for regulated parties 
that elect to electronically validate Federal officials' credentials 
using FIPS 201 real-time credential authentication capability. In 
compliance with Sec.  1512 of the 9/11 Commission Act, TSA is 
developing requirements for security programs in the rail sector. As 
TSA develops these requirements, TSA will consider procedures and 
protocols pertaining to verification of Federal HSPD-12 cards.
    TSA has decided that it will not require an official of the 
inspected

[[Page 72142]]

entity to accompany a TSA inspector during inspections. Although, in 
many cases, such an escort may very well be helpful, in other cases, it 
may hinder an inspection's timing or scope. TSA's inspectors often will 
request an escort, but they must be able to perform unescorted 
inspections at times to check compliance. With the exception of NRC-
licensed facilities (as discussed below), TSA also is not requiring 
that inspectors receive identification media from the facility to be 
inspected. These media will not be necessary once the inspectors show 
their TSA or DHS credentials.
    In the case of inspections conducted at NRC-licensed facilities, 
TSA inspectors who have not been granted unescorted access to the 
facility in accordance with NRC regulations will perform their 
unannounced inspections while escorted by an NRC or licensee employee 
who has been granted unescorted access. NRC inspectors inspecting for 
compliance with NRC requirements will notify TSA about any rail 
security concerns. As noted earlier, TSA intends that the specifics of 
these arrangements be outlined in an agreement between TSA and the NRC.
3. Warrantless Inspections
a. Legal Authority To Conduct Warrantless Inspections
    Comments: One commenter questioned the legal grounds for the 
seizure of copies of documents without a warrant.
    TSA Response: TSA is mandated by ATSA to develop policies, 
strategies, and plans for dealing with threats to all modes of 
transportation,\31\ including rail, and has authority to conduct 
inspections to ensure compliance with those policies and plans.\32\ The 
inspection authority provision in Sec.  1580.5 of this final rule 
requires that freight and passenger railroad carriers, rail transit 
systems, and rail hazardous materials facilities allow TSA officials 
and DHS officials working with TSA to enter and be present within any 
area or within any conveyance to conduct inspections, tests, or to 
perform such other duties at any time or place to carry out TSA's 
statutory duties.
---------------------------------------------------------------------------

    \31\ 49 U.S.C. 114(f)(3).
    \32\ 49 U.S.C. 114(f)(9).
---------------------------------------------------------------------------

    These inspections may be conducted without a warrant. By 
publication of this final regulation, owners and operators of rail 
operations and hazardous materials facilities are on notice as to the 
statutory and regulatory authority for the inspections. The regulation 
also identifies that TSA and other authorized DHS officials are the 
persons authorized to conduct the inspections. In addition, TSA has 
explained that the inspections may occur at any time, but will occur in 
a reasonable manner. Finally, the regulation identifies the locations 
subject to inspection and delineates the scope of the inspection, in 
that the inspection will encompass the property, facilities, equipment, 
operations, conveyances, and records that are necessary to carry out 
TSA's security-related responsibilities.
    The entities covered by this final rule are part of a closely 
regulated industry due to existing oversight and the heightened 
government interests in regulating these businesses. Most rail carriers 
and facilities identified in the regulation are already subject to 
regulation from other Federal entities such as DOT and EPA. There is 
also no doubt that TSA has a substantial interest in regulating the 
railroad carriers, rail transit systems, and rail hazardous materials 
facilities covered by this final rule. The preamble to the NPRM set 
forth several examples of the devastating consequences of an attack on 
rail transportation and clearly explained TSA's interest in regulating 
rail transportation to protect persons and property. 71 FR at 76854. 
The NPRM also described what measures must be taken by rail interests 
to detect and deter these threats.
    The warrantless administrative inspections contemplated by the rule 
are also necessary to further the regulatory scheme. TSA's rail 
inspection program is directed at a mobile industry that transports 
persons and potentially dangerous materials, and if inspection is to be 
effective and serve as a credible deterrent, unannounced inspections 
are essential.
b. Criminal Evidence Found During an Inspection
    Comments: A State DOT stated that TSA may not use its regulatory 
oversight powers as a means to gather and seize criminal evidence 
against a rail carrier without a search warrant. The commenter said 
while there are allowable exceptions to warrant searches (such as the 
exigent circumstances surrounding the hot pursuit of a criminal 
suspect), none of those circumstances would typically exist during an 
oversight inspection.
    TSA Response: TSA is aware of the legal requirements for conducting 
a criminal investigation, including requirements for obtaining a search 
warrant in certain circumstances. Transportation Security Inspectors 
(Surface) are not criminal investigators, and they will be trained 
accordingly. As appropriate, the inspectors will refer matters to the 
appropriate law enforcement authorities.
4. Enforcement Guidance for Inspectors
    Comments: One chemical manufacturer stated that TSA must ensure the 
fairness of guidance documents that TSA may issue to inspectors, that 
TSA must issue any guidance in accordance with Executive Order (E.O.) 
13422, amending E.O. 12866, which addresses Regulatory Planning and 
Review and the Office of Management & Budget's (OMB's) Bulletin for 
Agency Good Guidance Practices, and that TSA should give the regulated 
community the opportunity to submit comments regarding any draft 
guidance.
    TSA Response: TSA will evaluate any guidance materials issued to 
our inspectors to determine the appropriate procedure for issuing them.
5. Review Process for Enforcement Decisions
    Comments: National Railroad Passenger Corporation (Amtrak) asked if 
there would be a review process if the rail carrier does not agree with 
the decision of the rail inspector.
    TSA Response: If any covered party disagrees with a rail 
inspector's decision with respect to compliance or possible corrective 
action, the party may request that the decision be reviewed at a higher 
level at TSA. The regulated entity may request that the issue be 
resolved by TSA management. Management will raise unresolved issues to 
TSA's Office of Chief Counsel and senior management for final 
resolution.
6. Use of Third-Party Contractors for Inspections
    Comments: One commenter raised a number of questions about the use 
of contractors or officials of other agencies to conduct inspections 
under this rule.
    TSA Response: TSA does not intend to employ contractors to carry 
out TSA's inspection responsibilities. DHS officials may inspect rail 
operations and rail hazardous materials facilities in coordination with 
TSA.\33\
---------------------------------------------------------------------------

    \33\ TSA also works closely with DOT by consulting and 
coordinating on security-related transportation requirements to 
ensure they are consistent with the overall security policy goals 
and objectives established by DHS so that the regulated industry is 
not confronted with inconsistent security guidance or requirements 
promulgated by multiple agencies. While inspectors from both 
departments may sometimes perform joint inspections and share 
compliance information, each agency enforces its own regulatory 
requirements.

---------------------------------------------------------------------------

[[Page 72143]]

7. Other Comments on TSA Inspection Authority
    Comments: A passenger railroad operator asked if TSA would provide 
any guidelines to rail inspectors regarding their actions while on a 
conveyance. For example, the commenter asked if the inspectors would 
occupy revenue seats of rail cars and transit vehicles and if they 
would be able to use their credentials to travel to and from their 
residence or place of work.
    TSA Response: As stated above in the discussion of inspector 
training, TSA intends to use only properly trained personnel to conduct 
inspections. TSA inspectors will display credentials upon request and 
occupy revenue seats on passenger railroad cars and rail transit system 
conveyances only while performing official duties. If a TSA inspector 
is commuting to or from his or her residence or place of work, he or 
she will pay the same full fare as a member of the traveling public. 
Also, an on-duty TSA inspector may travel as a paying passenger when 
conducting unannounced inspections to evaluate the regulated party's 
security measures.
    Comments: Proposed 49 CFR 1580.5(b)(7) states that TSA's inspection 
authority includes the right to ``carry out such other duties, and 
exercise such other powers, relating to transportation security as the 
Assistant Secretary of Homeland Security for the TSA considers 
appropriate, to the extent authorized by law.'' One chemical 
manufacturer commented that this proposed language is vague and 
undefined, and subjects the regulated community to unknown inspection 
criteria.
    TSA Response: TSA has retained the language that it used in the 
NPRM. TSA has the primary Federal role in enhancing security for all 
modes of transportation. Under ATSA, TSA's authority with respect to 
transportation security is comprehensive and supported with specific 
powers related to the development and enforcement of security-related 
regulations, SDs, security plans, and other requirements, including 
ensuring the adequacy of security measures for the transportation of 
cargo \34\ and overseeing the implementation of and ensuring the 
adequacy of security measures at transportation facilities.\35\ In 
addition to its other responsibilities under ATSA, TSA is charged with 
carrying out other appropriate duties relating to transportation 
security.\36\ The regulatory language in 49 CFR 1580.5(b)(7) notifies 
the regulated community of TSA's broad statutory authority to inspect 
and codifies the scope of TSA's existing inspection program as it 
relates to rail security.
---------------------------------------------------------------------------

    \34\ 49 U.S.C. 114(f)(10).
    \35\ 49 U.S.C. 114(f)(11).
    \36\ 49 U.S.C. 114(f)(15).
---------------------------------------------------------------------------

    As explained in the NPRM, TSA is authorized to conduct general 
security assessments in addition to inspecting for compliance with 
specific regulations. TSA has specific powers to assess threats to 
transportation security; monitor the state of awareness and readiness 
throughout the rail sector; determine the adequacy of an owner or 
operator's transportation-related security measures; and identify 
security gaps.
    Comments: Two associations expressed concern that the proposed rule 
extends beyond just the rail operations and shipping and receiving 
areas of a regulated facility and, therefore, exceeds TSA's authority. 
These commenters requested that TSA revise the inspection provision in 
the rule to limit its scope to those operations directly related to or 
impacting a facility's rail operations.
    TSA Response: TSA's authority to inspect under this rule does not 
extend to areas of the facility that are unrelated to transportation 
security, which may include (for example) areas dedicated exclusively 
to manufacturing or engineering. However, TSA notes that its inspection 
authority is broad. TSA has the discretion to inspect those areas of a 
rail hazardous materials shipper or receiver facility that are related 
to the security of the transportation system, such as the rail secure 
area and control rooms or offices where security activities are 
initiated or monitored. Under the authority of ATSA, TSA is directed to 
ensure the adequacy of security measures for the transportation of 
cargo,\37\ which includes ensuring the adequacy of security measures at 
the transportation-related areas of rail hazardous materials shipper 
and receiver facilities. The rail cars offered, prepared, loaded, 
received, or unloaded from or at these facilities may travel anywhere 
in the general railroad system of transportation, including in and near 
high population areas, critical infrastructure, and other vital areas. 
Sometimes loaded rail cars will remain for some time at the shipper's 
facility awaiting pickup from the freight railroad carrier. Whether 
being loaded at facilities or awaiting pickup at facilities, these rail 
cars could endanger surrounding areas. Accordingly, TSA's broad 
authority under ATSA includes authority to inspect those areas of the 
facilities used for transportation security activities.
---------------------------------------------------------------------------

    \37\ 49 U.S.C. 114(f)(10).
---------------------------------------------------------------------------

E. Reporting Significant Security Concerns

1. General Comments
a. Value of Proposed Requirement To Report Significant Security 
Concerns
    TSA received a number of comments supporting the proposed 
requirement to report significant security concerns. Two chemical 
companies and a major trade association supported the reporting of 
significant security concerns to TSA as proposed in Sec.  1580.105. 
Other commenters expressed concerns about the requirements.
    Comments: The Chairman and four members of the U.S. House Committee 
on Homeland Security expressed the view that the proposed reporting 
requirements would not improve rail security. They commented that the 
reporting requirements would not make the industry proactive in 
deterring terrorists and that, instead of collecting data for study 
after incidents have occurred, TSA should provide the industry with 
mandatory, standardized security practices and mandated training 
programs.
    TSA Response: TSA believes that the requirements to report 
significant security concerns have great value in the overall approach 
to enhancing rail security. That approach includes other mandatory 
requirements, such as the chain of custody measures, location and 
shipping information, and the designation of RSCs, that will enhance 
security. TSA agrees with the House Committee members that it is 
important to focus on deterring activities that might compromise 
transportation security. TSA believes that reports of significant 
security concerns from rail transit operations, freight and passenger 
railroad carriers, and rail hazardous materials shippers and receivers 
enhance security, because they help TSA to evaluate if there are 
geographic or other patterns to the activities that are reported. If 
so, TSA may be able to interrupt similar events at other locations. In 
addition, TSA can determine if it should intensify inspections that 
focus on particular areas or activities.
b. Scope of the Reporting Requirements
    Comments: The National Industrial Transportation League questioned 
the extent to which the reporting requirements would apply to a rail 
hazardous material shipper or receiver with a very large facility. The 
League asked if TSA intends to require a

[[Page 72144]]

regulated entity to report any of the enumerated incidents anywhere in 
its facility, even if the incident has no relationship to or impact on 
the facility's rail operations.
    TSA Response: TSA does not expect shipping or receiving facilities 
in an HTUA to report incidents that bear no relationship to areas of 
the facility that are related to the designated rail secure area, rail 
shipments, or receipt of the hazardous materials covered by this 
regulation. However, TSA expects that facility owners will report 
suspicious incidents outside the scope of this rule to other Federal, 
State, or local authorities, as appropriate or required by those other 
authorities.
2. Time and Method of Reporting
a. When must reports be made?
    Comments: TSA received many comments about the proposed requirement 
to report significant security concerns ``immediately,'' particularly 
in the context of 911 notifications. Commenters asked TSA to define 
``immediately.'' Several commenters requested that TSA clarify that the 
new reporting requirement does not take precedence over ``first calls'' 
to local authorities (that is, 911) for events requiring police, fire, 
or emergency medical support. A chemical company said that, for 
practical purposes, ``immediate'' notification of TSA would follow 
notification of local first responders via 911. A trade association 
said that the rule should emphasize that local authorities are to be 
notified simultaneously because local authorities near the plant site 
are in the best position to act quickly to mitigate and reduce the 
consequences of a real threat.
    Similarly, one transit authority said that the requirement for 
``immediate'' reporting would burden the RSC and other supervisory 
security personnel during the resolution of incidents. At such a 
crucial time, the RSC and other security personnel should focus on safe 
and secure resolution of the incident. A transit authority suggested 
that TSA change the reporting timeframe from ``immediately'' to monthly 
or bi-weekly reporting.
    Two State DOTs said that the proposed rule fails to establish a 
timeframe for reporting potential threats and significant security 
concerns or specifically identify the role of the State oversight 
agency in the reporting process.
    Several commenters offered suggested definitions of the term 
``immediately.'' A trade association requested that TSA allow enough 
time to determine whether a notification is warranted. The association 
pointed out that the current DOT/PHMSA regulation (49 CFR 171.15) 
defines immediate notice to mean as soon as practical, but no later 
than 12 hours, and suggested that TSA incorporate similar language into 
the final rule. Another trade association noted that PHMSA's incident 
reporting requirements use the phrase ``at the earliest practicable 
moment'' to describe ``immediate'' and recommended that TSA use the 
same terminology. See 49 CFR 171.15 (which requires notice ``as soon as 
practical but no later than 12 hours after the occurrence of [the] 
incident.'').
    TSA Response: TSA plays a crucial role in coordinating the Federal 
response to threats to transportation security. The immediate reporting 
of a potential threat, a security incident, or a significant security 
concern is integral to TSA's ability to carry out this function 
successfully. Prompt notification enables TSA to help coordinate the 
Federal response, including actions to be taken at the State and local 
levels, and provides TSA with the situational awareness needed to make 
the appropriate assessments on the National and local levels.
    TSA recognizes that, in some cases, notifying the local first 
responders to address a threat or consequences in the immediate 
aftermath of an incident takes precedence over notifying TSA because of 
the need to protect lives or property. In these cases, regulated 
entities should notify TSA simultaneously or as soon as possible after 
notifying 911 or other first responders.
    TSA decided not to provide a definition of ``immediately'' in this 
final rule. TSA considered the DOT/PHMSA definition but decided that 
allowing up to twelve hours to report an incident may not allow 
sufficient time for TSA or other agencies to take necessary action to 
address a security concern. As noted above, TSA recognizes that, in 
some cases, reporting to TSA may take place after the reporting entity 
alerts law enforcement and first responders to ensure public safety and 
mitigate damage to property.
b. Content and Method of Reporting
    Comments: Many commenters asked questions with respect to what 
information they should include in the reports and how and to whom they 
should report the information. A technology vendor said that its ``off-
the-shelf'' product could be configured with sensors to detect and 
report tampering with rail cars and assist in reporting significant 
safety concerns.
    TSA Response: With respect to content, the reports should include 
all the information required in Sec.  1580.105(d) and Sec.  
1580.203(d). Passenger railroad carriers and rail transit systems 
should refer to Sec.  1580.203, and freight railroad carriers and 
facilities that ship or receive hazardous materials covered by the rule 
should refer to Sec.  1580.105. With respect to the method of 
identifying the information to report, the rule does not require the 
use of specific products or methodologies. To help identify significant 
security concerns in a manner that meets this rule's performance 
standards, the covered entities may elect to use any variety of 
technological products.
3. Coordination With Other Reporting Requirements
    Comments: TSA received numerous comments about the 
interrelationship between the reporting requirements of this rule and 
the reporting that occurs in response to other regulatory programs or 
other procedures. Commenters urged TSA to increase coordination and 
eliminate unnecessary duplication. For example, one trade association 
said that certain facilities are currently reporting significant 
security concerns to the FBI, local authorities, and the Coast Guard. 
The association said that TSA should use these existing reports to 
gather information rather than to create an additional reporting 
requirement. The association suggested that if TSA maintains this 
reporting requirement in the final rule, it should only apply to the 
certain hazardous materials determined to pose a higher security risk 
(such as PIH, explosives, and radioactive materials).
    Several commenters wrote about the relationship between the 
proposed reporting requirement and FTA's reporting requirement in 49 
CFR 659.33, asking TSA to clarify the role of State oversight agencies 
in the reporting process. Some State DOTs said that the proposed 
reporting would partially duplicate the reporting requirements of the 
State oversight program, which would force rail systems to develop 
multiple sets of procedures and processes.
    Commenters suggested the following options for coordinating or 
merging the proposed reporting requirement with similar existing 
requirements:
     Create a centralized or ``one stop'' reporting process for 
stakeholders.
     Avoid any ``excessive'' duplication between the safety 
oversight and rail security programs.

[[Page 72145]]

     Minimize redundant reporting and ensure there is 
coordination of FRA, NTSB, and TSA reporting requirements.
     Make the proposed reporting requirement parallel to the 
existing requirements (or vice versa).
     Allow the reporting to other jurisdictional law 
enforcement agencies to meet the requirement of reporting to TSA.
     Allow reporting to the State oversight agency to fulfill 
TSA's requirement.
     Make the proposed reporting requirement more consistent 
with posting to the public transportation portion of the Homeland 
Security Information Network (HSIN).
     Modify the reporting requirements for the National Transit 
Database to support TSA's needs.
     Require that covered entities send reports to the National 
Response Center as the primary and sole reporting center for the 
purposes of this section and develop a mechanism for TSA to receive 
reports of significant security concerns from the National Response 
Center.
     Include language in the final rule to help regulated 
entities prioritize all of the notifications that they are required to 
make.
    TSA Response: TSA needs information immediately on potential 
threats, suspicious activities, and security incidents for the purposes 
of comprehensive intelligence analysis, threat assessment, and 
allocation of security resources. Covered entities must report security 
concerns to the Freedom Center. The Freedom Center maintains 
communications networks with other Federal operations centers, such as 
DOT's Crisis Management Center, to convey reported security concerns to 
interested entities throughout the Federal government.
    The reports submitted to State oversight agencies under 49 CFR 
659.33 will not satisfy the requirements of this rule. Reports to the 
oversight agencies meet a more general need for situational awareness, 
particularly pertaining to safety conditions. The required reporting 
under this final rule and the reporting under 49 CFR 659.33 do not 
overlap extensively. Where they do overlap, TSA would expect that 
passenger railroad carriers and rail transit systems would follow 
procedures for reporting to TSA as well as to the State agencies.
    TSA recognizes that entities regulated by both the Coast Guard and 
TSA may be required to report the same security concern to the National 
Response Center and the Freedom Center. However, in this final rule, 
TSA is requiring reporting to the Freedom Center for all rail-related 
security issues to facilitate the continued development of a 
centralized surface transportation security operations center and the 
development of rail specific intelligence. Moreover, obtaining reports 
indirectly from the National Response Center, the States, or other 
third parties might delay a needed response or may not contain adequate 
information for TSA's purposes.
4. Reportable Events
    Comments: Many commenters said that TSA's definition of reportable 
events is too broad and should be more narrowly focused. Several 
comments from transit authorities said that the proposed reporting 
requirements would impose a substantial burden on transit systems and 
even on TSA itself and that the scope of the requirement should be 
narrowed. They also asserted that the proposed requirements would 
result in an overload of information that would divert attention from 
truly significant threats and dilute the effectiveness of the reporting 
system. Other commenters asked for a more specific description of 
``suspicious'' activities or a list of examples that would, or would 
not, be considered ``suspicious.'' A commenter identified ``youth 
vandalism'' as an incident that should not be reportable.
    Several commenters offered specific suggestions for which 
activities or incidents should be considered reportable. Some 
commenters suggested that the requirement focus on activities that pose 
a security threat to rail cars carrying covered hazardous materials or 
the materials covered by this regulation.
    An industry association noted that the events that must be reported 
to DOT are very specific (such as a person being killed or requiring 
hospitalization) and suggested that TSA's reportable events be more 
specific and similar to DOT's. One commenter suggested that TSA only 
require reporting of certain specific crimes. Another commenter made 
specific suggestions regarding the categories of events that should be 
reported to TSA.
    TSA Response: TSA is aware that the proposed reporting requirements 
are broad and, in some respects--such as the requirement to report 
``suspicious'' activities--are not as specific as the regulated 
community would like. However, TSA has not changed the reporting 
requirements in this final rule for the reasons described below.
    The reporting requirements are intended to mitigate the risk to 
rail transportation systems. These requirements will provide 
information to the appropriate authorities, allowing their timely 
intervention to an attack or its preparation. Detecting activities that 
may compromise transportation security entails piecing together 
seemingly unrelated incidents or observations and conducting analysis 
in context with information from other sources. However, as the threat 
environment is dynamic and indicators of incident planning and 
preparation can change, TSA cannot provide a threshold for reportable 
events or a specific definition.
    TSA has decided not to accept commenters' suggestions to limit the 
scope of the reporting requirement. Limiting the scope to the DOT 
reporting requirements, which are intended to identify safety concerns, 
would reduce the data that TSA could use for trend analysis to 
anticipate and prevent an attack. Limiting incident reporting to only 
PIH materials, explosives in Classes 1.1, 1.2, and 1.3, or highway 
route-controlled quantities of radioactive materials would also limit 
TSA's domain awareness.
    Comments: A State DOT expressed the concern that transit agencies 
may respond to the proposed requirement by understating or omitting the 
annual crime statistics they provide to the State DOT to avoid the 
proposed reporting requirement. Two State DOTs asked what would happen 
to a rail transit agency that failed to notice or report a potential 
threat.
    TSA Response: TSA does not believe that transit agencies or others 
within the scope of TSA's reporting requirements would fail to report 
crimes in order to avoid the reporting requirements of this final rule. 
If a covered entity failed to report a potential threat in accordance 
with this rule, TSA would consider taking enforcement action. TSA would 
exercise enforcement discretion and would consider factors such as the 
type of threat and its significance, the procedures the covered party 
had in place to identify and report such threats, and other factors as 
appropriate.
5. Training
    Comments: Several commenters requested that TSA develop training 
programs to assist employees in recognizing events that could raise 
security concerns and should be reported. One State DOT commented that, 
for the reporting system to work successfully there needs to be a 
comprehensive and ongoing training program for employees of passenger 
railroad carriers and rail transit systems. The agency requested that 
TSA provide a rail-specific training package for reporting potential 
threats and significant rail security concerns. Similarly, a labor 
union asserted that

[[Page 72146]]

front-line workers will be in the best position to identify many of the 
potential threats or significant security concerns listed in the 
proposed rule. The union said that reporting will simply not be as 
robust or as complete as envisioned by TSA without mandatory security 
training for rail employees.
    A chemical company noted that the proposed rule makes several 
references to IEDs. The company said that if these devices are a 
realistic threat to U.S. facilities, then the regulated community could 
benefit from specialized training, provided by TSA or other government 
agencies, on recognizing IEDs.
    Some commenters requested that TSA provide training to RSCs on what 
constitutes a reportable event for purposes of reporting significant 
security concerns.
    TSA Response: TSA recognizes that well-trained employees will 
enhance security. In the passenger rail/rail transit context, TSA has 
undertaken an effort to elevate the level of training generally, bring 
greater consistency, and assist transit agencies in arranging and 
implementing training programs by developing and disseminating a 
voluntary Mass Transit Security Training Program; this training program 
is available on TSA's Web site.\38\ The program identifies specific 
types of training at basic and follow-on levels for particular 
categories of transit employees. Basic categories for front-line 
employees include security awareness, behavior recognition, and 
immediate emergency response. The training program presents the 
information in a readily understandable matrix, and provides effective 
guidance to passenger rail and transit agency officials on how to build 
and implement training programs for employees working in their systems. 
The Transit Security Grant Program, administered by DHS and TSA to 
advance security enhancement efforts in passenger rail and mass transit 
systems, affords the agencies the option of this pre-packaged training 
program with grant funding. Agencies taking advantage of this program 
have their grant applications expedited for review and approval. This 
initiative aims to expand significantly the volume and quality of 
training for passenger rail and mass transit employees. Information on 
this initiative is available on TSA's Web site.\39\
---------------------------------------------------------------------------

    \38\ See http://www.tsa.gov/assets/xls/FY2007_TSGP_Training_Cost_Matrix.xls.
    \39\ See http://www.tsa.gov/assets/pdf/TSGP_Training_IB243.pdf.
---------------------------------------------------------------------------

    At this time, the rule does not mandate specific training for the 
reporting of significant security concerns. It specifies the type of 
incidents that covered entities must report. TSA will work with covered 
parties to comply with this final rule. In addition, TSA notes that 
current DOT regulations will aid in providing an adequate basis to 
identify suspicious incidents. Current DOT regulations require 
employers to provide security awareness training for most hazardous 
materials employees. See 49 CFR 172.704. The security awareness 
training must provide employees with an awareness of security risks 
associated with hazardous materials transportation and methods to 
enhance transportation security. This training must also include a 
component on how to recognize and respond to possible security threats. 
TSA recognizes that not all reporting will be accomplished by hazardous 
materials employees, however, TSA also recognizes that almost all 
employers provide their operational employees with some security 
awareness training. This training will enhance the quality of the 
information that covered entities report to TSA and will improve 
reporting levels. Additionally, TSA is developing a CD that will 
instruct workers on the appearance of an IED and how to locate an IED 
on a rail car. The CD will also include a training module on security 
awareness. TSA will provide the CD to covered parties prior to the 
effective date of this final rule via a mass mailing and will also post 
a request form on TSA's Web site.
    We note that some commenters made reference to TSA providing 
training for RSCs. This final rule (49 CFR 1580.105 and 1580.203) does 
not assign the reporting task to the RSC, and TSA does not expect all 
reports of significant security concerns to come from the RSC. Reports 
may be made by individuals who are not employed at the corporate level 
of the regulated party.
6. Sharing of Information Received
    Comments: A commenter asked whether TSA intends to share incident 
and trend analysis with anyone. Several governmental authorities 
requested that TSA transmit reports of significant security concerns to 
states and localities, including first responders, in a timely manner.
    TSA Response: TSA may share reports of security concerns with 
Federal, State, or local law enforcement or other officials, for 
further analysis or for action consistent with those agencies' 
authorities.
7. Other Comments on Reporting Significant Security Concerns
    Comments: One commenter asked how TSA will respond to and 
investigate reportable events.
    TSA Response: If a determination is made that a reported event 
warrants a response or further investigation, TSA will work with the 
RSC, the local Transportation Security Inspectors (Surface), and other 
Federal, State, and local authorities, if warranted, to take 
appropriate action.
    Comment: A commenter asked whether the information reported would 
receive SSI protection.
    TSA Response: Under 49 CFR 1520.5(b)(7) (threat information), 
reports of significant security concerns would be considered SSI once 
TSA receives them.

F. Sensitive Security Information

1. Extent of Protection of Information as SSI
    Comments: Several commenters suggested that the final rule should 
extend SSI protection to information that covered entities must submit 
to TSA under this rule, including location and shipping information for 
certain rail cars submitted in accordance with Sec.  1580.103 and 
reports of significant security concerns submitted in accordance with 
Sec.  1580.105 or Sec.  1580.203.
    TSA Response: The location and shipping information, which carriers 
are required to maintain and submit, would not be considered SSI. 
However, once DHS or DOT receives the location and shipping information 
from the railroad carrier and includes it as part of a broader analysis 
of the location of rail cars subject to the location reporting 
requirement, the compilation, not the raw data, will constitute SSI 
under revised Sec.  1520.5(b)(12). Such compilations require greater 
protection than the information maintained by the railroad carrier for 
its business purposes, because the release of a compilation of location 
and shipping information to the public would increase the risk that the 
compiled information could be used to identify vulnerabilities or to 
plan an attack on critical rail assets. In the NPRM, TSA proposed to 
revise Sec.  1520.5(b)(12), relating to information concerning 
infrastructure assets, to include rail transportation systems. TSA has 
included this provision in the final rule. Consistent with the 
provision, TSA considers lists of critical infrastructure assets 
prepared by DHS or DOT, including lists of rail cars containing covered 
materials, to be SSI.

[[Page 72147]]

    With respect to reports of significant security concerns submitted 
under Sec.  1580.105 or Sec.  1580.203, such reports would constitute 
SSI under existing Sec.  1520.5(b)(7) (threat information) once the 
Federal government receives them.
2. Access to Sensitive Security Information for State Oversight Agency 
or Designated Local or Tribal Officials
    Comments: Many commenters expressed concern with the proposed 
amendment to 49 CFR part 1520 to protect information related to rail 
transit systems and to require rail transit systems to restrict the 
distribution, disclosure, and availability of SSI. Some said that the 
proposed rule needs to ensure that State oversight agencies responsible 
for establishing standards for rail safety and security programs for a 
State's rail fixed-guideway systems under 49 CFR part 659 will have 
access to SSI. Some were concerned about limitations on the 
availability of information, because they felt that State and local law 
enforcement and emergency response personnel need SSI for emergency 
planning. One commenter requested that TSA specify the rights of State 
and local governments to access SSI.
    TSA Response: TSA agrees that State, local, and tribal governments, 
including State oversight agencies, should have access to SSI generated 
under this regulation for which they have a need to know. SSI may not 
be publicly disclosed pursuant to any State, local, or tribal law. This 
is consistent with DHS policy and will allow States, localities, and 
tribal employees, contractors, and grantees to have access to SSI if 
the information is needed for the performance of official duties on 
behalf of or in defense of the interests of Federal, State, local, or 
tribal government, or for performance of the contract or grant. 
Accordingly, TSA is adding State, local, and tribal agencies, which 
would include State oversight agencies, to the list of persons with a 
``need to know'' under Sec.  1520.11. This amendment does not authorize 
a State, local, or tribal agency to access SSI as a general matter. The 
agency must have a ``need to know'' specific pieces of SSI. SSI may not 
be publicly disclosed pursuant to any State, local, or tribal law.
3. Security Clearance
    Comments: One commenter noted that most program administrators at 
the State oversight agencies do not have official ``security 
clearance'' authorizations and may therefore not have access to 
information needed to carry out security-related responsibilities.
    TSA Response: TSA has revised Sec.  1520.11 to allow access to SSI 
by State oversight agency employees with a need to know without 
requiring them to have security clearances. Under the SSI regulation, 
the Federal government does not ordinarily clear covered persons for 
receipt of classified national security information in order to receive 
access to SSI. TSA notes that security clearances would be required for 
access to information that is classified pursuant to Executive Order 
(E.O.) 13292 of March 25, 2003 (68 FR 15315. March 28, 2003); however, 
SSI does not fall within the scope of the E.O.
4. Inspection Information
    Comments: One commenter requested that TSA protect information 
gathered by TSA inspectors as SSI.
    TSA Response: This final rule will protect pertinent inspection-
related security information as SSI under Sec.  1520.5(b)(6), as 
amended by this rulemaking.
5. Simplified Marking
    Comments: Another commenter suggested that TSA simplify the SSI 
marking requirements, so that documents need not be marked on every 
page.
    TSA Response: This issue is beyond the scope of the Rail 
Transportation Security NPRM. TSA will consider revising the marking 
requirements of the SSI regulation in a future rulemaking.
6. Broadening the Scope of Sensitive Security Information
    Comments: Many commenters supported the provisions protecting the 
disclosure of SSI in rail transportation. Others opposed expanding the 
scope of SSI, concerned that use of an SSI designation could withhold 
too much information from the public. They expressed concern that the 
proposed rule contained no restrictions on who may declare information 
SSI, or what information may be included in reports automatically 
accepted as SSI, and that there were no time limits on how long 
information protected as SSI remains SSI. These commenters believed 
that TSA should amend the SSI regulation to make it clear that records 
relating to the general safety of the rail and transit networks, as 
well as the terminals and other facilities, and records of their 
maintenance are not SSI. Other commenters suggested that TSA balance 
any need to protect route information against the need to disclose to 
States, cities, counties, Congress, and the public general information 
about the quantities and types of materials that are being shipped 
through an area. Other commenters urged that the definition of SSI be 
as narrow as possible.
    TSA Response: TSA is fully committed to disclosing information to 
the public where appropriate unless such disclosure is prohibited from 
disclosure under law or would compromise transportation security. TSA 
does not intend to protect information as SSI that would not be 
detrimental to transportation security if publicly disclosed. SSI 
should not be released to individuals who do not have a need to know. 
Records relating to the general safety of railroad and transit systems, 
as well as related yards, terminals and other facilities, and records 
of their maintenance, are not SSI unless they overlap with or are 
inextricably commingled with security information that falls within the 
specific categories of SSI information in the SSI regulation. This 
consists of information that terrorists or others could use to the 
detriment of transportation or national security. Section 1520.15(b) 
allows for the public release of all information that is not SSI within 
records that contain both SSI and non-SSI information.
    The SSI regulation defines what is considered SSI and imposes 
certain SSI handling requirements on a ``covered person'' with a need 
to know; only ``covered persons'' must mark information as SSI under 
the regulation.
7. Protection of SSI in Civil Litigation
    Comments: Several commenters suggested that the SSI provisions 
should include the protections afforded CVI under DHS's CFATS rule, in 
light of recent Congressional requirements on the disclosure or sharing 
of SSI in civil litigation and the protection for SSI that is over 
three years old.
    TSA Response: Last year, DHS issued the CFATS interim final rule on 
chemical facility security. Pursuant to its statutory mandate, the 
CFATS rule includes provisions for protecting CVI. Most rail SSI would 
not also qualify as CVI. Without statutory direction to do so, TSA is 
not authorized to expand the SSI regulation to include the protections 
afforded CVI.
    The commenter is correct that Congress recently enacted legislation 
regarding SSI in civil litigation, but the new statute is narrow in 
scope. Section 525(d) of the 2007 DHS Appropriations Act grants civil 
litigants or their counsel who do not have a need to know under 49 CFR 
part 1520 access to specific SSI in Federal civil district court 
proceedings if certain requirements are met. This provision requires 
the controlled sharing in civil litigation in

[[Page 72148]]

Federal district courts of relevant SSI for which a litigant 
demonstrates a substantial need after successful completion of a 
security threat assessment, and under a protective order entered by the 
court that protects the SSI from unauthorized or unnecessary disclosure 
and specifies the terms and conditions of access.
8. Coordination With Other Information Protection Programs
    Comments: Several commenters were concerned that the recent DHS 
rule governing CVI means that regulated entities may soon manage three 
categories of protected homeland security information: SSI, Protected 
Critical Infrastructure Information (PCII) in 6 CFR part 29, and CVI in 
6 CFR part 27. Each has unique elements and regulatory requirements. 
Commenters suggested that TSA consider adopting regulations that would 
harmonize and clarify information protection procedures for government 
and the private sector.
    Similarly, the NRC has pointed out that some information that would 
be SSI under this rule would also fall within the scope of their 
Safeguards Information (SGI) program under Sec.  147 of the Atomic 
Energy Act of 1954, as amended. SGI must be protected in accordance 
with the requirements in 10 CFR part 73.
    TSA Response: The requirements of each of these information-
management programs are specific to each respective program and relate 
to particular statutory and regulatory provisions. It is beyond the 
scope of this rulemaking and of TSA's authorities to amend the 
regulations governing Federal programs other than SSI or to make 
changes to the SSI regulation that exceed the scope of the Rail 
Transportation Security NPRM. With respect to information that is both 
SSI and CVI, PCII, or SGI, such information must be marked and 
protected in accordance with all applicable regulations. TSA will work 
closely with DHS and other government agencies to make sure that the 
requirements of the CVI, PCII, SGI, and SSI programs are complementary, 
not inconsistent, with each other.
9. Protection for Personal Information
    Comments: One commenter recommended that TSA extend SSI protection 
to the personal information of rail transportation workers and 
employees of rail hazardous materials shippers and receivers, including 
RSCs appointed pursuant to this rule.
    TSA Response: TSA will not normally share the personal information 
of RSCs provided to TSA under this rule with organizations external to 
DHS. However, if appropriate, TSA may share the information with other 
Federal, State, local, or tribal government agencies, including DOT, in 
accordance with applicable requirements, such as the Privacy Act and 
the Freedom of Information Act. To the extent that TSA shares the 
information with non-Federal entities, such as State, local, or tribal 
agencies, TSA expects that information will be safeguarded in 
accordance with procedures designed to protect such information. 
Accordingly, TSA has decided that it is not necessary to expand the 
protections afforded to personal information by further amending the 
SSI regulation at this time. TSA notes that lists of individuals with 
unescorted access to rail secure areas, if maintained, will be 
considered SSI under Sec.  1520.5(b)(11)(i)(A). This final rule adopts 
the proposed amendment of that provision to include lists of 
individuals with unescorted access to rail secure areas.
10. Expansion of Sensitive Security Information to Other Modes of 
Transportation Besides Rail
    Comments: One commenter believed that the paragraphs in Sec.  
1520.5(b) should include motor carriers, motor carrier freight 
terminals, and motor carrier infrastructure assets.
    TSA Response: The changes to the SSI regulation in this final rule 
are focused on rail transportation rather than on other modes of 
transportation. Any changes concerning other modes of transportation 
would be outside the scope of this rulemaking. In the future, TSA may 
consider changes in the SSI regulation relating to motor carriers.

G. Chain of Custody and Control

1. Applicability
    Comments: A municipality supported the chain of custody provision 
and recommended that TSA extend it to the carriage of all hazardous 
materials. Another commenter suggested that the rule is vague and does 
not address certain kinds of terrorist attacks (such as placing an 
explosive device under rail tracks or under elevated rail in a major 
city) and does not mandate any protective distances.
    TSA Response: TSA is not expanding the proposed list of hazardous 
materials to which the requirements of part 1580 apply. While we 
recognize that all substances defined by DOT as ``hazardous materials'' 
are ``capable of posing an unreasonable risk to health, safety, and 
property when transported in commerce'' (see 49 CFR 171.8), not all 
hazardous materials are subject to the same potential for terrorists to 
exploit them to cause significant loss of life, transportation system 
disruption, or economic disruption. At this time, TSA has decided not 
to expand the list of materials to which this rule applies.
    Comments: A commenter asked why TSA did not propose to apply the 
chain of custody requirements to transfers occurring between train 
crews employed by the same carrier.
    TSA Response: TSA applied a risk-based approach in crafting the 
requirements of this final rule, and the greatest risk to rail cars 
today is when they are standing still unattended in an HTUA or prior to 
entering an HTUA. While TSA acknowledges that there is a security 
vulnerability any time a railroad carrier leaves rail cars (and 
sometimes entire trains) unattended, cars and trains are much more 
frequently left unattended when awaiting interchange to another carrier 
or at the point of initial shipment and delivery. TSA may consider 
applying the chain of custody requirements to intra-carrier transfers 
in a later rulemaking.
    Comments: Two commenters opposed the exclusion of facilities owned 
or operated by the Federal government from the definitions for 
receivers and shippers, due to possible dangers of explosives and 
nuclear materials.
    TSA Response: Although facilities owned or operated by the Federal 
government, such as any facility owned or operated by the Department of 
Defense (DOD) or the Department of Energy, are not subject to the 
requirements of this final rule, these facilities are the 
responsibility of other Federal agencies. In general, a Federal agency 
that ships or receives the materials described in Sec.  1580.100 would 
be a secure facility operating under policies or regulations that 
provide a level of security comparable to the requirements of this 
final rule. For example, DOD shipments of explosives are frequently 
contracted as ``rail surveillance'' shipments, meaning that railroad 
police or their agents attend, inspect, and monitor these shipments 
while they are in transportation. Similarly, Federal agents track and 
monitor shipments of high-level nuclear materials while in 
transportation.
    Comments: If operations of two or more companies are co-located, 
would only companies that ship designated materials be subject to Sec.  
1580.107?
    TSA Response: If a company is co-located at the same facility as 
shippers or receivers covered by the chain of custody requirements but 
does not engage in the transportation by rail of the materials 
described in Sec.  1580.100,

[[Page 72149]]

that company does not have to comply with the chain of custody and 
control procedures in Sec.  1580.107.
2. Attendance Requirement
    Comments: Several commenters raised questions about compliance with 
the attendance requirement. Some commenters asked for clarification on 
the number of rail cars that one individual can attend. One commenter 
asked if a representative of the first railroad carrier must fully 
observe the transfer of physical custody of the rail car before turning 
it over to the second carrier, or if unmanned secure enclosures may be 
used.
    TSA Response: Although the preamble to the NPRM stated that ``not 
left unattended'' meant that the employee or authorized representative 
must have ``an unobstructed view of the rail car prior to the 
delivering carrier leaving the interchange point'' (71 FR at 76873), 
TSA has reconsidered this interpretation. For purposes of paragraphs 
(c) and (d) of 49 CFR 1580.107, the requirement ``to ensure that the 
rail car is not left unattended at any time during the physical 
transfer of custody'' means that the regulated party has an employee or 
authorized representative physically located on site, in reasonable 
proximity to the rail car, who can reasonably detect unauthorized 
access or unlawful activity near the rail car and is capable of 
promptly responding to such unauthorized access or unlawful activity 
(such as by immediately contacting law enforcement or other authorities 
to investigate), and immediately responds to unauthorized access or 
activity at or near the rail car either personally or by contacting law 
enforcement or other authorities. See 49 CFR 1580.107(k)(1).
    In the case of rail cars that have been decoupled from locomotive 
power and are therefore not in a train, reasonable proximity is best 
understood to mean that an employee or designee of the responsible 
party has either the rail car or the area surrounding the rail car, 
including paths of access to the rail car, within his or her field of 
vision. For rail cars that are in a train, the concept of reasonable 
proximity means that the train crewmembers are located on or near the 
train; although the train crewmembers may be located at the front of 
the train and physically unable to visually observe every rail car, the 
security risk is mitigated by the fact that the train is subject to 
unpredictable movement at any time. Determining what is a reasonable 
proximity is not calculated by measuring a precise distance or 
designating a particular location, but rather by achieving a reasonable 
expectation that any unlawful interference with the rail car will be 
promptly detected. As long as the individual performing the monitoring, 
whether on the ground or located in an on-site control room watching 
via a surveillance system, can satisfy this performance standard, there 
is no limit on the number of cars that he or she can attend. 
Accordingly, TSA does not expect the first railroad carrier to assign 
someone to literally observe each car 100 percent of the time during 
the physical transfer of custody.
    TSA also does not want an employee or authorized representative of 
the regulated party to place his or her safety or life in jeopardy. TSA 
recognizes that a reasonable response to unauthorized access or 
unlawful activity may be to immediately contact law enforcement rather 
than approach an individual directly.
    Comments: A municipality commented that TSA should provide 
clarification on whether rail switching yards must be converted into 
secure areas. As an example, it referenced a yard where trains are 
broken up into cars or blocks of cars and built into new trains.
    TSA Response: Although the commenter uses the words ``secure 
areas'' in the context of asking whether rail yards fall under the 
``secure location'' requirement in the definition of ``rail secure 
area,'' the commenter's question appears to concern the carrier to 
carrier transfer requirements in 49 CFR 1580.107(c) and (d).\40\ Under 
49 CFR 1580.107, TSA requires attendance of the rail car during carrier 
to carrier physical transfers of custody. The attendance requirement 
only applies in a rail switching yard when one carrier interchanges a 
covered rail car with another carrier in such a yard. TSA anticipates 
this happening most often when cars enter and leave the yard, not while 
they are within the yard being switched. Movements within a yard 
(including many classification yards) that are transfers solely between 
the same railroad carrier are not covered by 49 CFR 1580.107.
---------------------------------------------------------------------------

    \40\ As defined in 49 CFR 1580.3, a ``rail secure area'' is a 
secure location designated by a rail hazardous materials shipper or 
rail hazardous materials receiver where security-related pre-
transportation or transportation functions are performed or rail 
cars containing the covered hazardous materials are prepared, 
loaded, stored, and/or unloaded.
---------------------------------------------------------------------------

    Comments: An association representing short line and regional 
railroads commented that TSA should provide clarification on when the 
transfer is complete under the chain of custody and control 
requirements and recommended that TSA consider the transfer complete 
once the rail car is uncoupled from the delivering railroad carrier.
    TSA Response: TSA agrees that the transfer is complete when the car 
is uncoupled from the train, and all documentation requirements are met 
either in writing or electronically.
    Comments: Some commenters suggested that TSA amend paragraph (f)(1) 
of 49 CFR 1580.107 to prohibit unattended pick up and delivery rather 
than using the term ``positive control.''
    TSA Response: The language in this final rule remains unchanged 
from the NPRM. However, TSA has added a new paragraph (k)(2) to 49 CFR 
1580.107 to explain the term ``maintains positive control.''
    By requiring that either the rail hazardous materials receiver in 
an HTUA or railroad carrier ``maintains positive control'' of the rail 
car during the physical transfer of custody of the rail car, TSA 
intends that the receiver communicate with the railroad carrier and 
work in close cooperation to ensure the security of the rail car during 
the transfer process. Since ``attending the car'' is only one component 
of the overall process of ``controlling the car'' during the transfer, 
the regulatory text requires one or both parties to be responsible for 
positive control.
    Comments: A railroad carrier commenter indicated that a rail car is 
attended if a train crewmember is present. Several rail labor unions 
urged TSA to specify that a railroad carrier may not assign a train 
crewmember for purposes of compliance with the attendance requirements 
because of the high risk of injury or death in the event of a terrorist 
incident. One commenter stressed that train conductors already have 
numerous safety and other responsibilities, and are not trained as 
security personnel. Another commenter noted that 49 CFR 1580.107 does 
not have a training requirement, and requested that TSA add a provision 
to specifically address the skill set and qualifications necessary for 
conducting inspections required under 49 CFR 1580.107(a)(1), (b), (c), 
and (d).
    TSA Response: As noted in the NPRM (71 FR at 76873), TSA intends 
that railroad carriers have maximum flexibility in adopting and 
implementing procedures to meet the car attendance performance 
standard. Accordingly, a railroad carrier's option to use any category 
of individuals, including train crewmembers, to carry out the job 
function of attending rail cars remains unchanged from the proposed 
rule. In crafting its

[[Page 72150]]

procedures, TSA expects a railroad carrier to consider personal safety 
and security issues and competing job responsibilities of the potential 
individuals who will serve as attendants, as well as compliance with 
all other applicable laws, regulations, and contracts.
    TSA is not prescribing a specific training requirement for 
attendant functions in this final rule, nor is it establishing minimum 
qualification standards for the employees who must attend the rail 
cars. However, in order to comply, the railroad carrier must ensure 
that persons who carry out this rule know what they must do. TSA will 
soon issue a DVD training video to freight railroad carriers and rail 
hazardous materials facilities on identifying IEDs and signs of rail 
car tampering and on security awareness.
    TSA is mindful of employee concerns about personal safety. We do 
not expect that railroad employees will necessarily confront suspicious 
persons directly. For instance, an employee may summon law enforcement 
personnel to confront a suspicious individual or respond to a report of 
a possible IED.
    Comments: Some commenters were concerned that the chain of custody 
provisions would be burdensome on small hazardous materials shippers 
and receivers in high threat urban areas that did not operate 24 hours 
a day, 7 days a week. Consequently, these facilities might not have 
staff to comply with the chain of custody provisions of this final rule 
when a carrier arrived to transfer a rail car.
    TSA Response: TSA recognizes that a rail hazardous materials 
receiver located in an HTUA that is not open for business 24-hours a 
day, seven days a week, may incur some additional cost to meet the 
requirements in this final rule. TSA has accounted for this cost in the 
Regulatory Impact Assessment (RIA). Some regulated parties may satisfy 
the attendance requirement by employing someone only as long as 
necessary to transfer the car from the delivering railroad carrier, to 
document the transfer of custody, and to ensure that it is moved into a 
rail secure area. Once the rail car is placed in a rail secure area at 
the receiving facility, the rail car no longer needs to be attended.
3. Electronic Monitoring of Rail Cars
    Comments: One group of commenters asked how technology can be used 
to comply with 49 CFR 1580.107. Several comments supported the use of 
technology to satisfy the chain of custody and control requirements, 
noting that electronic devices may offer better security benefits 
through their enhanced methods to track and control products while in 
transit. A trade association representing chlor-alkali producers 
worldwide (as well as packagers, distributors, users, and suppliers) 
asked TSA to clarify that ``positive control'' can be achieved through 
electronic communication.
    TSA Response: TSA supports the use of technology to the extent that 
covered entities can use it to achieve the security standards of 49 CFR 
1580.107. TSA recognizes that as existing and future technologies 
become commercially available, they could provide equal, or possibly 
superior, monitoring capability of rail cars. As noted, the attendance 
standard is that of a regulated party's reasonable expectation that it 
has the ability to detect unlawful interference with the rail car and 
properly respond to a security situation. See 49 CFR 1580.107(k)(1). As 
part of ``maintaining positive control'' of the rail car, attendance 
must occur until the receiving party has accepted physical custody. In 
this final rule, covered entities may use visual monitoring technology 
to comply with the attendance and transfer of physical custody 
requirements, but only if the person attending the car(s) or train is 
physically present on-site at the facility where the attendance is 
required.\41\
---------------------------------------------------------------------------

    \41\ Accordingly, a regulated party that has an on-site employee 
(or authorized representative) who can use electronic monitoring to 
(for example) promptly notify law enforcement personnel to 
investigate the presence of a trespasser near a rail car would be in 
full compliance with the attendance requirement.
---------------------------------------------------------------------------

    The technology selected may include, but is not limited to, 
intelligent video, passive intrusion detection, perimeter alarms, or 
advanced video surveillance systems.\42\ Whatever system or method is 
selected, the regulated party is responsible for ensuring that the 
process employed provides an operationally effective means to meet the 
regulatory requirement. Automatic Equipment Identification (AEI) 
readers cannot be used to meet the provisions of 49 CFR 1580.107, 
because they cannot be used to monitor or control access to a car.
---------------------------------------------------------------------------

    \42\ TSA recognizes that the development of systems and 
technologies to enhance the physical security of assets and 
infrastructure is an evolving process. TSA does not wish to preclude 
the use of advanced technologies that would provide the regulated 
parties with additional options for meeting the requirements of 49 
CFR 1580.107.
---------------------------------------------------------------------------

4. Rail Hazardous Materials Receivers
    Comments: Some commenters requested that TSA assist facilities in 
determining whether they are within an HTUA and therefore subject to 
certain chain of custody and control provisions.
    TSA Response: Before the effective date of this final rule, TSA 
will provide on its website maps of each of the 46 HTUAs that TSA will 
use to inspect for compliance with the applicable sections of this 
regulation. It is important to note that TSA will provide these maps 
for general guidance purposes only. TSA encourages any regulated party 
with questions concerning the applicability of this final rule to its 
operations to contact TSA directly.
    Comments: A trade association commented that TSA should grant an 
exception to the chain of custody and control provisions for receivers 
located in an HTUA that receive less than one tank car per month.
    TSA Response: This final rule does not contain an automatic 
exemption from the chain of custody requirements for rail hazardous 
materials receivers located within an HTUA, regardless of whether they 
receive very few cars in a given timeframe. The security risk posed by 
receipt of shipments of Division 1.1, 1.2, and 1.3 explosives, non-
residue quantities of PIH materials, and highway route controlled 
quantities of radioactive materials is significant even if a rail 
hazardous materials facility only receives a single carload each month. 
While it is true that the security risks for the rail transportation 
system as a whole increases as the total number of shipments increase, 
it is also true that there is a risk associated with each carload 
received. An exemption from 49 CFR 1580.107 for the specified hazardous 
materials in amounts below a given threshold is not warranted given the 
security risks posed by these materials. However, any receiver located 
in an HTUA may request an exemption \43\ from some or all of the chain 
of custody requirements of this final rule if it believes, based upon 
the operational characteristics and geographical location of its 
facility, that the potential security risk of its facility is 
insufficient to warrant application of the chain of custody 
requirements in 49 CFR 1580.107.
---------------------------------------------------------------------------

    \43\ For information on the exemption, see 49 CFR 1580.107(j).
---------------------------------------------------------------------------

    Comments: One commenter asked TSA to clarify that receivers located 
outside an HTUA are not required to satisfy the chain of custody and 
control provisions, including attending the physical hand-off from a 
railroad carrier.
    TSA Response: Rail hazardous materials receivers not located within 
an HTUA are not subject to any of the requirements in this final rule.
    Comments: A municipality stated that it is opposed to allowing 
shippers to request an exemption under 49 CFR 1580.107(j) if they 
determine that a

[[Page 72151]]

terrorist attack is unlikely at the area where they forward or receive 
hazardous materials. The commenter stated that such requests for 
exemption are likely to be based on cost considerations, and not 
necessarily on objective and knowing assessments that an area is less 
vulnerable to terrorist activity. In addition, once these locations 
become and remain unguarded, they are likely to attract persons who 
could take advantage of the fact that the area is unsecured.
    TSA Response: In the case of shippers of the covered hazardous 
materials, TSA agrees with the commenter. As the first link in the 
supply chain, and the first opportunity for unlawful interference with 
a rail car, shippers are not allowed to request an exemption from this 
regulation. However, under 49 CFR 1580.107(j), a rail hazardous 
materials receiver located within an HTUA can receive an exemption from 
the chain of custody and control requirements if it shows TSA that the 
potential risk from its activities is insufficient to warrant 
compliance. TSA will only grant such an exemption if, after analyzing 
the factors relevant to the potential security risk, it concludes that 
doing so is in the public interest and consistent with transportation 
security. The factors include: (1) The quantities and types of all 
hazardous materials that the rail hazardous materials receiver 
typically receives or unloads; (2) the receiver's geographical location 
in relationship to populated areas, which includes both daytime office 
building populations and populations in residential neighborhoods; (3) 
the receiver facility's immediate proximity to sensitive populated 
areas, such as other businesses (including other hazardous materials 
facilities), residential homes and apartment buildings, elementary 
schools, and hospitals; (4) any information regarding threats to the 
facility; and (5) any other circumstances relevant to that receiver's 
activities that would demonstrate that these activities present a low 
security risk.
5. Document Requirement
    Comments: Several commenters requested that TSA clarify whether 
electronic data interchange (EDI) may be used to satisfy the 
documentation requirements of this final rule. One trade association 
asked whether an AEI system with readers at agreed interchange points 
would satisfy the documentation requirements. An association 
representing Class I railroads requested clarification on whether 
notification on a ``switch list'' (date and time of delivery), which is 
then entered into the carrier's electronic database, meets the 
documentation requirement.\44\
---------------------------------------------------------------------------

    \44\ For purposes of accounting and reporting, the Surface 
Transportation Board (STB) groups freight railroad carriers into the 
following three classes:
    Class I: Carriers having annual carrier operating revenues of 
$250 million or more after applying the railroad revenue deflator 
formula.
    Class II: Carriers having annual carrier operating revenues of 
less than $250 million but in excess of $20 million after applying 
the railroad revenue deflator formula.
    Class III: Carriers having annual carrier operating revenues of 
$20 million or less after applying the railroad revenue deflator 
formula.
    See 49 CFR 1201; General Instructions 1-1. The railroad revenue 
deflator formula is based on the Railroad Freight Price Index 
developed by the Bureau of Labor Statistics. The formula is as 
follows:
    Current Year's Revenues x (1991 Average Index/Current Year's 
Average Index)
    The STB is an economic regulatory agency that Congress charged 
with the fundamental missions of resolving railroad rate and service 
disputes and reviewing proposed railroad mergers. See ICC 
Termination Act of 1995, Pub. L. 104-88, 109 Stat. 803 (December 31, 
1995).
---------------------------------------------------------------------------

    TSA Response: The requirement to document the transfer of custody 
ensures that all parties involved in the transfer know who is 
responsible at any given time; this allows TSA to verify that freight 
railroad carriers and rail hazardous materials facilities are not 
engaged in practices that leave certain hazardous materials rail cars 
unattended, and therefore vulnerable to someone attaching an IED or 
otherwise sabotaging the car. The documentation requirement also 
assists in locating rail cars, especially after delivery to the 
receiving facility in an HTUA. This final rule does not specify that a 
carrier or facility must use a particular document to meet this 
requirement, but does prescribe certain mandatory information that 
carriers and facilities must include. In this regard, TSA recognizes 
the unique operating practices and considerations of each regulated 
party, and anticipates that each party will meet the performance 
standard by adapting existing documents and/or technology. Regardless 
of which method the regulated party uses to comply, TSA requires that 
the documentation must contain information that uniquely identifies 
that the rail car was attended during the transfer of custody. This 
information must include the car's initial (reporting mark) and number, 
identifying data that allows TSA to determine who in fact attended the 
rail car (such as the names or uniquely identifying employee numbers of 
the train crewmembers or rail hazardous materials facility employees), 
location of the transfer (such as the milepost number, name of the rail 
yard, or siding designation), and the date and time when the transfer 
was completed. See new 49 CFR 1580.107(k)(3).
    EDI and switch lists may be used to satisfy the requirement and 
serve as a technical representation of a business conversation between 
two regulated parties if they are adapted to sufficiently document the 
transfer of physical custody from one regulated party to the other and 
allow TSA to determine who participated in the transfer and when and 
where the transfer took place. TSA is retaining in the final rule the 
language from the proposed rule requiring that both participants in the 
transfer create documentation. Passive AEI readers do not meet the 
documentation requirements of this final rule because while the passage 
of a rail car past an AEI reader would establish the car's geographical 
location at the time of the reading, it would not generate the required 
documentation.
6. Other Issues Concerning Chain of Custody and Control
    Comments: Several members of Congress questioned the effectiveness 
of the proposed rule given the fact that so few TSA inspectors are 
available.
    TSA Response: TSA has deployed the 100 inspectors provided for by 
Congress in the Department of Homeland Security Appropriations Act for 
fiscal year 2005 (Pub. L. 108-90). Assigned to 19 field offices 
throughout the United States, the inspectors cover the key rail and 
mass transit facilities in their regions. The program has focused on 
nationwide outreach and liaison activities with the rail industry and 
initiatives aimed at enhancing security in rail and mass transit 
systems. Inspections for compliance with this regulation, such as the 
chain of custody and control provision targeting of high risk 
interchanges, will focus our inspection priorities. Other provisions in 
this final rule, such as the appointment of a RSC and the requirement 
to provide certain location and shipping information, may be primarily 
monitored by headquarters staff. TSA is confident that this rule will 
be effectively implemented.
    Comments: One municipality believed that re-routing of hazardous 
materials was a better strategy.
    TSA Response: TSA's NPRM did not address this issue. DOT/PHMSA has 
addressed routing issues in its rule. As noted earlier in this 
preamble, DOT/PHMSA published an interim final rule in the Federal 
Register on April 16, 2008. The PHMSA rule revises the current 
requirements in the HMR applicable to the safe and secure 
transportation of hazardous materials transported in commerce by rail. 
In pertinent part, PHMSA is requiring

[[Page 72152]]

freight railroad carriers to compile annual data on certain shipments 
of explosive, toxic inhalation, and radioactive materials, use the data 
to analyze safety and security risks along rail transportation routes 
where those materials are transported, assess alternative routing 
options, and make routing decisions based on those assessments.
    Comments: Two commenters recommended that TSA adopt the DOT 
definition of offeror instead of ``shipper'' and that all requirements 
placed on the shipper should be assigned to the ``offeror.'' \45\
---------------------------------------------------------------------------

    \45\ In pertinent part, in 49 CFR 171.8, DOT defines a ``person 
who offers'' or ``offeror'' as:
    (1) Any person who does either or both of the following:
    (i) Performs, or is responsible for performing, any pre-
transportation function required under [Subchapter C] for 
transportation of the hazardous material in commerce.
    (ii) Tenders or makes the hazardous material available to a 
carrier for transportation in commerce. * * * * *
---------------------------------------------------------------------------

    One of the commenters stated that the definition in the proposed 
rule of ``rail hazardous materials shipper'' is more restrictive than 
the DOT definition of ``person who offers'' or ``offeror'' in 49 CFR 
171.8. The commenter noted that the proposed rule appears to assume 
that all hazardous materials shipment origination activities occur at 
the physical facility where a covered hazardous material shipment 
originates, and indicated that this is not necessarily the case. The 
commenter recommended that TSA revise the proposed rule to distinguish 
between requirements applicable to the originating facility and 
requirements applicable to the person or organization performing the 
functions of ``offeror,'' as described in 49 CFR 171.8.
    Another commenter stated that since rail hazardous materials 
shippers and receivers are fixed-site facilities, not persons, they 
cannot be tasked to perform ``offeror'' functions. The commenter also 
recommended that TSA adjust the definition of ``receiver'' to make it 
consistent with 49 CFR 171.8.
    TSA Response: TSA is revising the definitions of ``rail hazardous 
materials shipper'' and ``rail hazardous materials receiver'' in 49 CFR 
1580.3 to clarify that this rule applies to the operator of the fixed-
site facility. TSA is retaining the term ``rail hazardous materials 
shipper'' to establish that responsibility for compliance with the 
requirements in parts 1520 and 1580 rests with the operator of the 
fixed-site facility that has a physical connection to the general 
railroad system of transportation and offers, prepares, or loads any of 
the covered hazardous materials for transportation by rail. Although 
the facility operator may elect to assign responsibility for performing 
pre-transportation functions to an agent or contractor, the facility 
operator remains responsible under the rule for compliance with all 
applicable provisions of this final rule. In the event of 
noncompliance, TSA may hold the shipper/facility's operator responsible 
for the violation and subject to enforcement action. Further, TSA notes 
that a fixed-site facility operator is a ``person'' for purposes of 
being able to ship/offer or receive hazardous materials covered by the 
rule. See 49 CFR 1580.3.
    TSA is also retaining the term ``rail hazardous materials 
receiver'' in this final rule rather than using the DOT term 
``consignee.'' \46\ A fixed-site receiving facility is not merely a 
delivery location, but also the legal entity responsible for compliance 
with this final rule in its role as a receiver or unloader of the 
covered hazardous materials. While DOT regulations no longer apply 
after the delivering railroad carrier departs a rail hazardous 
materials receiver facility (see 49 CFR 171.1(c)(3) and 171.8), TSA's 
final rule extends beyond that time and covers the transportation-
related areas of these facilities that receive or unload covered rail 
cars.
---------------------------------------------------------------------------

    \46\ In 49 CFR 171.8, DOT defines a ``consignee'' as ``the 
person or place shown on a shipping document, package marking, or 
other media as the location to which a carrier is directed to 
transport a hazardous material.''
---------------------------------------------------------------------------

    Comments: A chemical manufacturer observed that TSA's definition of 
``offeror'' includes the words ``Any person who * * * [t]enders or 
makes the hazardous material available * * *'' (49 CFR 1580.3). That 
manufacturer noted that the term ``tenders'' has a precise legal 
meaning, often used in satisfaction of a debt or obligation. The 
commenter recommended that TSA revise the definition of ``offeror'' by 
replacing the word ``tenders'' with ``provides.''
    TSA Response: For the sake of consistency with DOT's HMR, TSA based 
its definition of ``offers'' or ``offeror'' (49 CFR 1580.3) on the DOT 
definition of ``person who offers'' or ``offeror'' (49 CFR 171.8). In 
pertinent part, DOT defines a ``person who offers or offeror'' as ``any 
person who * * * [t]enders or makes the hazardous material available * 
* *'' In the context of TSA's definition of ``offers'' or ``offeror,'' 
the legal meaning of ``tenders'' is clear.
    Comments: A chemical manufacturer commented that TSA should align 
the applicability of its rail transportation security rule with DHS's 
CFATS regulation and clearly define jurisdictions and authority so that 
entities covered by both regulations have a clear understanding of 
their obligations under the law.
    TSA Response: It is not practicable for TSA to align the 
applicability section of the two rulemakings. Section 1580.107 of the 
freight rail provisions of TSA's regulation focuses on the pickup, 
delivery, and interchange of rail cars containing certain hazardous 
materials, whereas DHS's CFATS rule establishes requirements for the 
security of entire high-risk chemical facilities. Given the disparity 
in focus and the differences in addressing risk between the 
transportation and chemical sectors, it is neither practicable nor 
necessary to completely align the applicability sections of the two 
rules. Due to the nature of the supply chain, there is some inherent 
overlap between transportation and chemical facilities. This is 
reflected in the TSA regulation. In order to secure the transportation 
system, in Sec.  1580.107 we are regulating facilities that are 
connected to the general railroad system of transportation and ship, or 
receive in an HTUA, one or more of the specified categories and 
quantities of the hazardous materials listed in Sec.  1580.100(b). 
However, we believe that the responsibilities of those facilities that 
are potentially subject, to some degree, to both this rule and to CFATS 
are sufficiently clear and that those responsibilities will not 
conflict with each other.\47\
---------------------------------------------------------------------------

    \47\ Note that the preamble to the CFATS IFR stated that DHS may 
re-evaluate the coverage of railroads under that regulation, and if 
so would conduct a new rulemaking for that purpose. See 72 FR 17699 
(April 9, 2007).
---------------------------------------------------------------------------

    Comments: A commenter expressed concern that the attendance 
requirements of 49 CFR 1580.107 might lead to non-compliance with the 
hours of service laws,\48\ cause worker fatigue issues, and have an 
impact on transit times and delivery schedules.
---------------------------------------------------------------------------

    \48\ TSA presumes that the commenter is referring to the Federal 
hours of service laws (49 U.S.C. 21101-21108), which includes 
requirements concerning maximum on-duty and minimum off-duty periods 
for individuals engaged in or connected with the movement of a 
train. See 49 U.S.C. 21101 and 21103.
---------------------------------------------------------------------------

    TSA Response: TSA recognizes that the attendance requirement may 
require certain operational changes by the freight railroad carriers 
required ``to ensure that the rail car is not left unattended during 
the physical transfer of custody.'' This final rule allows freight 
railroad carriers the maximum degree of flexibility to adopt and 
implement procedures to meet the car

[[Page 72153]]

attendance performance standard. In this regard, 49 CFR 1580.107 does 
not specify a maximum number of rail cars that a carrier employee or 
authorized representative may attend, nor does it require the attendant 
to be within a certain designated distance from the rail car. TSA 
expects the affected freight railroad carriers to adopt and carry out 
implementing procedures that meet the performance standard of this rule 
without compromising railroad safety or violating any other Federal 
requirements.
    Comments: Several commenters asked whether the chain of custody 
provisions apply to imports and exports from Mexico and Canada.
    TSA Response: The chain of custody requirements do not apply at any 
shipper facilities located outside the United States, but begin at the 
first carrier interchange point inside the United States that triggers 
the provisions of Sec.  1580.107, and apply to all subsequent covered 
carrier interchanges. The requirements also apply to a rail hazardous 
materials receiver located in an HTUA, regardless of whether the rail 
car originated at a domestic or foreign location. Accordingly, for 
shipments originating in Canada or Mexico, there will be no evidence of 
a secure shipment from the initial rail hazardous materials shipper, 
and for shipments destined for Canada or Mexico, there is no 
requirement for a secure hand off to the receiver.
    Comments: One commenter requested clarification of responsibilities 
where a passenger railroad has contractual agreements regarding the use 
of their respective rail tracks for the transportation of hazardous 
materials by private freight railroad carriers.
    TSA Response: The requirements in Sec.  1580.107 do not apply to 
passenger railroad carriers that lease or have contractual agreements 
regarding the use of their track by freight railroad carriers to haul 
hazardous materials. Only the railroad carrier transporting the covered 
hazardous materials, not the owner of the track, is covered by Sec.  
1580.107.
    Comments: The Small Railroad Business Owners of America commented 
on the potential danger of grouping hazardous materials rail cars 
together in secure areas rather then leaving them individually on 
tracks in various rail yards. The commenter stated that the best 
solution is to employ security systems that are monitored, such as 
television cameras and employees who work in the area who are told to 
immediately report any unauthorized persons.
    TSA Response: TSA recognizes that rail hazardous materials 
facilities may have to comply with 49 CFR 1580.107 by storing covered 
rail cars in close proximity to each other. However, this final rule 
does not outline any specific requirements for the storage of covered 
cars, other than that the cars must be kept in a rail secure area with 
physical security measures while awaiting pickup at a rail hazardous 
material shipper by a railroad carrier or awaiting unloading at a rail 
hazardous materials receiver in an HTUA. The rule also does not specify 
the size of the secure area; a facility may establish multiple secure 
areas. TSA believes that placing covered cars only in secure areas with 
physical security measures in place provides an added security benefit, 
since it is easier for the facility to monitor the cars in concentrated 
locations rather than stored individually on multiple tracks.

H. Location and Shipping Information for Certain Rail Cars

1. Applicability
    Comments: An association suggested that TSA exempt Class III 
railroads from providing routing information for cars on other 
carriers' portions of a rail car trip (i.e., the time that the rail car 
spends in transportation being hauled by another railroad carrier). The 
commenter stated that the shipping documents that small railroad 
carriers receive from connecting carriers typically do not indicate the 
routing that the larger railroads will use. They asserted that, in 
practice, this information is available from Class I railroad carriers 
who have multiple routing options and will know which route other 
carriers will use to the final delivery destination point.
    TSA Response: When TSA needs to know the location of a specific 
rail car, the agency may query a number of carriers about the routing 
and shipping information; however, TSA recognizes that the entity in 
possession of the rail car generally has the best available 
information. In the context of TSA requesting the information, since 
this final rule only requires railroad carriers to report information 
for cars under their physical custody and control, TSA will not ask a 
carrier to submit information that is beyond its range of knowledge and 
that would require it to make inquiries of other carriers. See 49 CFR 
1580.103(b).
    Concerning routing information, TSA understands the differing 
capabilities between Class I railroads and short line and regional 
railroads, and has taken this into consideration in this final rule by 
allowing freight railroads, other than Class I carriers, more time to 
provide the required information. See 49 CFR 1580.103(e). TSA 
understands that routes sometimes change and expects that all regulated 
parties will provide the best available current routing information. 
TSA anticipates that in cases of heightened threat or during a security 
incident, all regulated parties would go beyond the minimum regulatory 
requirements and provide TSA with as much information as possible, 
including available information on rail cars that a railroad carrier 
had on its system before transferring it to another carrier or to a 
rail hazardous materials receiver.
    Comments: One association commented that the only location and 
shipping information that rail hazardous materials shippers and 
receivers should have to provide to TSA, when requested, is the fact 
that the facility is in possession of the car.
    TSA Response: This final rule provides that all covered freight 
railroad carriers and rail hazardous materials facilities must develop 
procedures to determine the location and shipping information specified 
by 49 CFR 1580.103 for rail cars under their physical custody and 
control containing the specified hazardous materials. A rail hazardous 
materials facility meets the requirements of 49 CFR 1580.103 if it 
informs TSA that it currently has a specific car(s) in its possession, 
identifies which rail cars contain a specified hazardous material, and 
provides TSA with the name and address of the facility where the car(s) 
or train is located. TSA is aware that some rail shipper and receiver 
facilities are very large, but there may be times when it is imperative 
that DHS know an exact car location inside a facility. In these cases, 
DHS and TSA will work with the affected facility to locate the precise 
position of the car to ensure appropriate intervention.
    Comments: One commenter recommended that TSA extend applicability 
of the car location and shipping information reporting requirement to 
covered entities handling all DOT-classified hazardous materials.
    TSA Response: As discussed in Section V.G.1 of this preamble, TSA 
is not revising the list of hazardous materials to which the 
requirements of 49 CFR 1580.103 apply. While TSA acknowledges that all 
hazardous materials present certain security risks in transportation, 
we selected the explosive, PIH, and radioactive materials as an initial 
step, because of the significant risk posed by these materials. In the 
case of an emergency

[[Page 72154]]

involving explosives, PIH, or radioactive materials, such as a specific 
threat against a particular train or a general threat involving the 
metropolitan area through which the train is operating, it may be 
critical for TSA to have location and shipping information rapidly to 
address threats to persons and property.
2. Timeframe for Reporting Information
    Comments: Many commenters supported the requirement to provide 
location and shipping information to TSA upon request within one hour, 
as proposed in the NPRM. TSA also requested comment on whether TSA 
could and should shorten the response time to five minutes for 
providing information on a specific car and 30 minutes for providing 
information on more than one car under the regulated party's physical 
custody and control.
    Several commenters opposed shortening the response time. These 
commenters varied in their reasons for opposing the change, including 
arguments that it would pose an unreasonable cost, was too difficult, 
or was impossible to implement with current technology. A few 
commenters supported the shortened five minute/30 minute reporting 
timeframe. One commenter suggested that commercial off-the-shelf 
technology existed that could meet TSA's proposed requirement. Two 
others suggested that the threat was severe enough that TSA must be 
able to obtain location and shipping information on cars carrying 
security-sensitive materials in the shortest possible timeframe, 
regardless of whether the private sector funds the technology or the 
government establishes a national system.
    TSA Response: TSA requires all Class I freight railroad carriers 
subject to 49 CFR 1580.103 to provide the location and shipping 
information to TSA within five minutes if the request concerns only one 
rail car and within thirty minutes if the request concerns two or more 
rail cars. See 49 CFR 1580.103(d). All other regulated parties subject 
to 49 CFR 1580.103 must provide the information to TSA within thirty 
minutes, regardless of how many rail cars the request concerns. See 49 
CFR 1580.103(e). TSA has concluded that regulated parties can comply 
with these timeframes. The technological capability to locate the rail 
cars currently exists. While compliance with this final rule may 
require procedural changes to the carrier or facility's operations, it 
will not entail significant or costly technological changes.
    Freight railroad carriers, both small and large, maintain systems 
to track and locate rail cars for both operational and revenue 
accounting purposes. Depending on the size and operational needs of the 
railroad, the sophistication of these systems will vary, but all 
perform the same basic functions. Railroad carriers trace the location 
of rail cars from the time that they are accepted for transportation at 
the point of origin until they are placed at the receiver's designated 
location. While in transit between the points of origin and 
destination, the progress of a rail car is tracked using a variety of 
methods including AEI, global positioning systems (GPSs), train 
dispatching systems, and train crew reporting. Railroad carriers then 
use computer-based systems to capture data on the location and progress 
of their rail cars. Carriers can use these types of systems to meet the 
reporting requirements of 49 CFR 1580.103.
    TSA notes that railroad carriers transporting rail cars containing 
explosives, radioactive, or PIH materials have programs or procedures 
in place to quickly locate a single tank car on their property if they 
are provided with the car's reporting marks (initial & number). For 
purposes of complying with 49 CFR 1580.103, TSA anticipates that the 
vast majority of railroad carriers will determine the number and types 
of rail cars on their property containing PIH or other specified 
materials by utilizing car trace and yard management software that 
sorts car contents according to Standard Commodity Codes (STCC). In 
addition, TSA recognizes that railroad carriers can, and tend to, send 
car location messages to a central databank (Railinc \49\), which 
allows the shipper, carrier(s), and receiver of the rail car to track 
the approximate location and trip progress of a particular rail car.
---------------------------------------------------------------------------

    \49\ Railinc is a leading provider of information technology and 
related business services to the North American railroad industry. 
The company hosts a variety of rail industry revenue, equipment, and 
operations management applications.
---------------------------------------------------------------------------

    In 2006, TSA conducted audits of freight railroad carriers and 
their employees to determine the level of implementation of certain 
voluntary guidance.\50\ One of these standards concerned the ability of 
railroad carrier employees to locate cars containing PIH materials in a 
specific yard. TSA determined that all of the Class I railroads and 
over 80 percent of the Short Line and Terminal railroads had systems in 
place to locate cars containing PIH or other specified materials. In 
this regard, the majority of the railroad carriers have developed car 
tracing programs that allow them to identify those trains operating on 
their systems that have PIH or other specified material cars in the 
train.
---------------------------------------------------------------------------

    \50\ On June 23, 2006, DHS and DOT issued 24 recommended 
security action items for the rail transportation of materials 
poisonous by inhalation, commonly referred to as TIH materials. The 
security action items are divided into three categories: (1) System 
security; (2) access control; and (3) en-route security. On November 
21, 2006, the two Departments issued three additional recommended 
security action items. The security action items are available on 
TSA's public Web site.
---------------------------------------------------------------------------

    As part of the process of analyzing the security threat to the 
freight railroad system, TSA has reviewed the ability of Class I, II, 
and III railroad carriers to respond to car location and shipping 
information requests. In all instances, when asked about rail cars 
containing the covered materials that were under their physical custody 
and control, Class I carriers were able to respond in five minutes or 
less when the request concerned one rail car and in 30 minutes or less 
when the request involved multiple rail cars. The Class I carriers used 
their existing programs and/or procedures to locate a single rail car 
on their property once TSA provided the car's reporting mark and serial 
number (car initial and number). These carriers also used car tracing 
programs to identify those trains operating on their systems that had 
hazardous material cars in the train.
    In the case of Class II and III carriers, TSA is aware of at least 
one program that the industry developed for the purpose of locating 
hazardous materials rail cars being hauled on Short Line and Terminal 
railroads. TSA and FRA have funded a program known as FreightScope.\51\ 
The Federal government in conjunction with the American Short Line & 
Regional Railroad Association (ASLRRA), has tested the functional 
capability of this program. Representatives of the ASLRRA, acting as 
agents for their member railroads, maintained a means of accessing the 
information in the FreightScope program, as well as a means of 
transmitting the information to the Federal government upon request. In 
the tests performed, the ASLRRA representatives were able to provide 
the requested car location and reporting information in approximately 
20 minutes. In one instance, the ASLRRA representative provided a 
verbal accounting of the information in less than five minutes.
---------------------------------------------------------------------------

    \51\ Railinc, a subsidiary of the AAR, developed FreightScope 
from ASLRRA specifications and with sponsorship and funding from 
FRA. It provides a Web-based interactive dashboard of near-real-time 
rail shipment location information for North America. Users can 
quickly determine the last reported location of hazardous materials 
shipments that are in the control of Short Line railroads.
---------------------------------------------------------------------------

    Larger and medium size rail hazardous materials shippers and rail

[[Page 72155]]

hazardous materials receivers of rail cars covered by this regulation 
have existing systems in place to record cars that enter or leave their 
facilities by rail. Railroad carriers notify shippers prior to dropping 
off residue cars and picking up loaded cars, and notify receivers when 
delivering a loaded car or picking up a residue car. Shippers are aware 
of the location and status of rail cars covered by this final rule as 
the cars pass through the facility, both while going through the 
loading process and while in temporary storage waiting to be shipped. 
Shippers also follow very specific company and DOT-required procedures 
for pre- and post-load inspections and necessary rail car maintenance 
and repair. While there is a constant movement of rail cars into, 
through, and out of a facility between these processes, plant personnel 
monitor the tank cars at each stage of the process, including loading 
and unloading operations and railroad carrier drop offs and pickups. 
Large and medium size receivers in HTUAs also follow very specific 
procedures and processes from the time a covered rail car enters the 
facility until the covered hazardous material is unloaded, including 
inspections prior to unloading. In addition, they perform pre-release 
checks before the residue cars are picked up by the railroad carrier.
    Smaller rail hazardous materials shippers and smaller rail 
hazardous materials receivers in an HTUA have smaller inventories of 
rail cars and consequently a smaller turnover of cars. TSA anticipates 
that the facilities will comply with this final rule by maintaining a 
written list of rail cars with the relevant information, and perform a 
visual check for the requested cars. The location and shipping 
information requirement will not result in operational changes to the 
systems at these smaller facilities.
    As noted in the preamble to the NPRM, TSA sought comment on an 
alternative to the proposed one-hour reporting timeframe, because in an 
emergency, ``information concerning the location of certain hazardous 
materials * * * [is] critical to decisions concerning possible 
rerouting, stopping, or otherwise protecting shipments and populations 
to address specific security threats or incidents.'' 71 FR at 65864 and 
76871. TSA specifically asked for comment on how a shorter timeframe 
could be accomplished and at what financial cost. Based upon comments 
received and our understanding of the technological capabilities of 
freight railroad carriers and rail hazardous materials facilities, in 
this final rule, TSA has revised the timeframe for a regulated party to 
report location and shipping information. Each Class I railroad carrier 
must provide the requested information to TSA no later than five 
minutes after receiving the request if the request involves only one 
rail car and no later than 30 minutes if the request concerns two or 
more rail cars. All freight railroad carriers not otherwise identified 
as Class I carriers by the STB are permitted up to 30 minutes to 
provide the requested information, regardless of the number of rail 
cars involved. All rail hazardous materials shippers and all rail 
hazardous materials receivers in an HTUA are permitted up to 30 minutes 
to provide the requested information, regardless of the number of rail 
cars involved.
    TSA has also added a new paragraph (g) to 49 CFR 1580.103, 
requiring each regulated party to provide a telephone number for TSA to 
use when requesting location and shipping information. In contrast to 
the RSC provision, which requires the regulated party to designate a 
named individual as TSA's contact person because of the potential need 
to convey extremely time-sensitive threat information or security 
procedures at any time of the day or night, paragraph (f) merely 
requires that the designated telephone number be monitored at all times 
by a live person. As long as the individual who answers TSA's telephone 
call can provide accurate information within the specified timeframe, 
paragraph (f) permits the regulated party to use a designated third 
party or agent to meet this performance standard, rather than 
exclusively a company employee. Since this provision allows the 
regulated party flexibility to determine how best to meet the reporting 
requirement, smaller railroad carriers and rail hazardous materials 
facilities that do not operate around the clock or maintain 24/7 
operations centers can comply with minimal operational changes.
    TSA is also deleting the words ``in writing'' from paragraph (f)(6) 
in this final rule (which was designated as paragraph (e)(6) in the 
NPRM), to allow regulated entities, on a case-by-case basis, to request 
an alternate reporting format and for TSA to immediately approve that 
request by telephone, without the need for a written response. TSA 
anticipates that a railroad carrier or rail hazardous materials 
facility may use this provision when they receive a request for 
information on only one rail car and can provide the answer easily by 
telephone. However, TSA does not anticipate approving the use of verbal 
communication if the requested information concerns numerous rail cars 
located at many different locations.
3. Technology for Reporting Information
    Comments: Several commenters stressed that TSA should allow them to 
use existing resources to comply with the location and shipping 
information requirement. A commenter indicated that existing AEI 
readers and supporting two-way communications systems are fully capable 
of producing the location and shipping information requested by TSA. 
The commenter stated that GPS by itself does not add substantial 
benefits and has significant limitations, such as requiring a direct 
line of sight to the satellite and an independent power source, which 
will need replacement. Additionally, the frequency of transmission 
causes immediacy of location reports to vary.
    TSA Response: TSA believes that the technology currently employed 
by freight railroad carriers and rail hazardous materials facilities is 
sufficient to comply with 49 CFR 1580.103. This final rule establishes 
a performance standard that requires the regulated entities to be able 
to provide the requested information in the timeframe specified, 
without mandating a particular technology or system protocol for 
obtaining it. Accordingly, while certain larger freight railroad 
carriers will meet the requirement by using AEI tags, smaller carriers 
that rarely haul rail cars containing the specified hazardous materials 
may elect to obtain the requested location and shipping information 
merely by calling the train crew on a two-way radio or cellular 
telephone. Depending on the number of rail cars present that contain 
one or more of the listed hazardous materials, rail hazardous materials 
facilities may choose to employ a sophisticated computer program (as 
appropriate) or simply assign an employee to physically count the rail 
cars containing the product and gather the requested information for 
each rail car. If the carrier, shipper, or receiver provides the 
location and shipping information to TSA within the specified timeframe 
and does so using one of the approved methods, the carrier or facility 
would be in full compliance with this final rule.
    Comments: A few commenters supported enhancing the current AEI 
system with GPS-based tracking and monitoring systems. These commenters 
noted that GPS-based technologies can provide timely and accurate 
tracking information. They suggested that the current AEI-based system 
cannot meet the requirements of this rulemaking or provide the 
efficiency benefits. One

[[Page 72156]]

commenter noted that in addition to location data, GPS-based systems 
can provide security information such as a notification if certain 
equipment becomes compromised in transit.
    Other commenters opposed the use of a GPS-based system and 
supported the continued use of the current AEI system to meet the 
proposed requirements.
    TSA Response: TSA appreciates the comments on AEI systems and GPS 
technology. TSA is not mandating any specific technology to meet the 
requirements of this final rule at this time. In order to better 
understand the security costs, benefits, and drawbacks of GPS, TSA has 
commissioned a comparative study between GPS and the current AEI-based 
system. Additionally, the study will provide the Federal government 
with an assessment of the AEI system and additional technologies that 
could be used to enhance the current system's fidelity.
4. TSA's Use of the Information
    Comments: Several members of Congress requested information on how 
TSA intends to use the information gathered pursuant to the location 
and shipping information provisions of the regulation.
    TSA Response: TSA intends to use the information obtained under 
Sec.  1580.103 to prevent or mitigate a terrorist attack. TSA 
anticipates requesting information in cases of heightened threat or 
prior to or during an attack. In cases where TSA/DHS has threat 
information about a specific rail car, commodity, or area, or other 
relevant fact relating to the transportation of covered materials being 
shipped by rail, it is imperative that TSA be able to focus upon the 
affected entity or population as quickly as possible. Currently, the 
Federal government does not have in place a permanent system to locate 
rail cars or target hazardous materials in transportation and must 
partner with the private sector. By finalizing this provision of the 
rule and including a new requirement that each covered party must 
supply TSA with a 24-hour contact telephone number, TSA/DHS has a new 
tool to enable the Federal government to focus on potential or actual 
targets and take appropriate action when time is of the essence.

I. Whistleblower Protection for Employees

    Comments: Two labor unions requested that the rule include 
whistleblower protection for employees of covered entities who report 
significant security concerns. The commenters indicated that absent 
such whistleblower protection, rail employees will remain subject to 
discipline and dismissal for reporting security concerns. One commenter 
provided regulatory language that would establish an appropriate level 
of whistleblower protection for employees who report security lapses to 
the relevant Federal entities. A third labor union asserted that the 
final rule must include mechanisms to ensure that employees are 
permitted to participate fully in reporting security concerns without 
harassment by employers. The union said that TSA inspectors and other 
agency officials should have the ability to talk directly with front-
line workers about security concerns and any employer harassment they 
face. In addition, the union urged TSA to adopt regulations 
specifically prohibiting any type of employee harassment or 
intimidation with fines and penalties sufficient to discourage this 
conduct.
    TSA Response: The topic of whistleblower protection is outside the 
scope of the NPRM, and therefore TSA has not addressed it in this final 
rule. TSA notes, however, that two provisions of the 9/11 Commission 
Act provide protections from retaliation for public transportation 
employees and railroad employees who, in good faith, provide 
information, or otherwise directly assist an investigation, about 
conduct that the employees reasonably believe is a violation of a 
Federal law, rule, or regulation related to railroad safety or security 
or gross fraud, waste, or abuse of Federal grants or other public 
funds.\52\ See Sec. Sec.  1413 (Public Transportation Employee 
Protections) and 1521 (Railroad Employee Protections) of the 9/11 
Commission Act; see also 49 U.S.C. 20109. Each provision includes 
protections for employees who refuse to violate or help in the 
violation of any Federal law, rule, or regulation relating to safety or 
security; file a complaint, or directly cause to be brought a 
proceeding related to the enforcement of certain laws and regulations; 
or furnish information to DOT, DHS, NTSB, or any Federal, State, or 
local regulatory or law enforcement agency as to the facts relating to 
any accident or incident resulting in injury or death to an individual 
or damage to property occurring in connection with (as applicable) 
public transportation or railroad transportation. The whistleblower 
protections are enforced through the filing of a complaint with the 
Department of Labor. See Sec.  1413(c) of the 9/11 Commission Act and 
49 U.S.C. 20109(c) (as amended by Sec.  1521 of the 9/11 Commission 
Act).
---------------------------------------------------------------------------

    \52\ The investigation stemming from the information must be 
conducted by: A Federal, State, or local regulatory or law 
enforcement agency; a Member or committee of Congress or the General 
Accounting Office; or a person with supervisory authority over the 
employee or such other person who has the authority to investigate, 
discover, or terminate the misconduct.
---------------------------------------------------------------------------

J. Preemption

    Comments: Section 1580.109 of the NPRM proposed to preempt any 
State laws, rules, regulations, orders or common law requirements 
covering the same subject matter as Sec.  1580.107. TSA sought comment 
on the scope of the subject matter that the final rule should or should 
not preempt under 49 U.S.C. 20106. Commenters were sharply divided on 
the issue of the proposed rule's preemptive effect, with industry 
commenters in favor of preemption and State and local governments 
opposed.
    Several chemical manufacturers expressed support for the proposed 
rule's preemption provision, because it would implement national 
uniformity and increase the effectiveness of compliance efforts. 
Several trade associations urged TSA to expand to provisions beyond 
those for chain of custody and control requirements.
    One commenter asserted that TSA's statement in the preamble of the 
NPRM that it ``does not intend to preempt inspection activities 
conducted in furtherance of State and local laws or preempt 
requirements to appoint an RSC, or report significant security 
concerns'' (71 FR 76875) is inconsistent with the language in 49 U.S.C. 
20106. In this regard, the commenter stated that Sec.  20106 provides 
that the States cannot regulate a subject when DOT or DHS has regulated 
that subject. The commenter asserted, therefore, that TSA lacks 
discretion to allow States to enforce their own requirements relating 
to RSCs or the reporting of security concerns. Further, the commenter 
stated that State requirements could result in railroads being 
subjected to differing requirements for security coordinators and a 
duty to report different types of occurrences in every State, leading 
to compliance difficulties without enhancing security.
    Other industry representatives also emphasized the importance of 
uniform national standards and supported broad preemption.
    State commenters raised objections to preemption and urged TSA to 
explain its plans for coordination and information sharing with States. 
A State requested assurance that a State's right to inspect and 
regulate will not be abrogated. A municipality, citing 49 U.S.C. 20106, 
urged TSA to include language in the final rule text recognizing the 
right of a political subdivision to enact more stringent law

[[Page 72157]]

when ``necessary to eliminate or reduce an essentially local safety or 
security hazard'' if it ``is not incompatible'' with a Federal 
regulation and ``does not unreasonably burden interstate commerce.''
    Another State objected to TSA's proposed ``subject matter'' 
preemption of chain of custody and control requirements, stating that 
it would prevent a necessary partnership among Federal, State, local, 
and tribal governments. The commenter preferred use of the 
``substantially the same'' form of Federal preemption language 
contained in the Federal hazardous materials transportation laws, which 
would preserve State laws that do not act as an ``obstacle'' to 
compliance or accomplishment of the Federal requirements. See 49 U.S.C. 
5125. Another commenter urged TSA to adopt a ``conflict'' preemption 
standard in lieu of its proposed ``field'' or ``subject matter'' 
standard.
    An individual commenter opposed preemption of State and local 
requirements, and gave the example of cities that want to place 
restrictions on where rail cars storing Toxic Inhalation Hazard (TIH) 
materials can be located. The commenter supported State and local 
efforts to mandate what the commenter characterized as the most basic 
terrorism prevention measures: Routing and storing the most dangerous 
cargoes away from vulnerable target areas. Other commenters objected to 
preemption, because they believed that Federal regulations alone cannot 
effectively ensure that the public is protected from dangers associated 
with the shipment of potentially hazardous materials via rail.
    TSA Response: TSA has fully considered the sharply divided comments 
on the issue of this final rule's preemptive effect. TSA has decided to 
retain the same language it proposed in the NPRM. In addition, after 
further consideration of the governing statutory provision, TSA has 
added a sentence to Sec.  1580.109 that tracks the language of that 
governing statutory provision--i.e., 49 U.S.C. 20106. The new sentence 
conveys Congress' intent as to the standard for preemption in the area 
of rail security (and safety).
    While in the past TSA's regulations have not included regulatory 
text about preemptive effect, the absence of such text does not 
necessarily indicate that TSA's regulations do not have preemptive 
effect. TSA has included such a provision here to make clear its 
finding about one aspect of this rulemaking.
    Congress has clearly legislated the standard for preemption in rail 
security (and safety) legislation. 49 U.S.C. 20106 provides that all 
regulations prescribed by the Secretary of Homeland Security relating 
to railroad security preempt any State law, regulation, or order 
covering the same subject matter, except a provision that: (1) is 
necessary to eliminate or reduce an essentially local security hazard, 
(2) is not incompatible with a Federal law, regulation, or order, and 
(3) does not unreasonably burden interstate commerce. Unless a state 
law, regulation, or order meets all three of these conditions, Sec.  
20106 expresses Congress's intent that it will be preempted. With the 
exception of a provision directed at an essentially local security 
hazard that is not inconsistent with a Federal law, regulation, or 
order, and that does not unreasonably burden interstate commerce, Sec.  
20106 will preempt any State or local law or regulatory agency rule 
covering the same subject matter as Sec.  1580.107.\53\
---------------------------------------------------------------------------

    \53\ Although Sec.  1528 of the 9/11 Commission Act restructured 
the preemption provision in 49 U.S.C. 20106, Congress did so for 
``for clarification purposes'' without intending ``any substantive 
change in the meaning of the provision.'' See 9/11 Commission Act, 
Conference Report to accompany H.R. 1, page 351 (July 25, 2007).
---------------------------------------------------------------------------

    In the context of railroad safety, the Supreme Court has 
consistently interpreted Sec.  20106 to confer on the Secretary of 
Transportation the power to issue regulations that would preempt not 
only State statutes, but common law as well. See CSX Transp. v. 
Easterwood, 507 U.S. 658, 664 (1993) (``[L]egal duties imposed on 
railroads by the common law fall within the scope of [the] broad 
phrases'' of Sec.  20106). See also Norfolk Southern Ry. Co. v. 
Shanklin, 529 U.S. 344 (2000). The Court has further held that Federal 
regulations under the Federal railroad safety laws will preempt common 
law where the regulations ``substantially subsume'' the subject matter 
of the relevant State law. Easterwood, 507 U.S. at 664.
    As provided in the regulatory text at Sec.  1580.109, the 
preemptive effect of this rule extends to the rule's provisions 
regarding chain of custody and control, both within and outside of 
HTUAs, of rail cars containing hazardous materials. TSA finds that, 
consistent with Sec.  20106, these provisions preempt State, local, and 
tribal requirements covering the same subject matter, including any 
such requirements prescribing or restricting security measures during 
the physical transfer of custody and control of rail cars containing 
the categories and quantities of hazardous materials set forth in Sec.  
1580.100(b), as well as any requirements that might attempt to impose a 
duty on freight railroad carriers or rail hazardous materials shippers, 
or rail hazardous materials receivers pertaining to the physical 
transfer of custody and control chain of rail cars containing hazardous 
materials that is not specifically set forth in Sec.  1580.107. For 
example, TSA's rule would preempt any State law or common law theory of 
liability that would require a freight railroad carrier to hire armed 
security guards to attend the rail car during the physical transfer of 
custody; a rail hazardous materials shipper or receiver to use 
specifically-designated physical security measures to ensure that no 
unauthorized person gains access to the rail secure area; or additional 
physical inspections of the rail car by the carrier or facility than 
that specified in Sec.  1580.107.
    It would be impractical and burdensome to the secure chain of 
physical custody and control process to require regulated parties to 
develop multiple sets of procedures to comply with varying State and 
local requirements. TSA is aware that, if this final rule did not 
preempt State or local regulations regarding the chain of custody 
requirements in Sec.  1580.107, a freight railroad carrier or rail 
hazardous materials facility may need to comply with different 
requirements in different jurisdictions. Clearly, Sec.  20106 was 
intended to prevent this outcome. Any other result would require a 
substantial resource commitment, because it would require carriers and 
facilities to instruct individuals who carry out chain of custody 
requirements to do so according to a multitude of different operating 
rules and practices. This, in turn, could raise significant safety and 
security concerns. This also might require carriers to vary the size 
and training qualifications of the train crew based upon the varying 
laws in each jurisdiction. Because rail transportation of hazardous 
materials frequently involves transportation across jurisdictions and 
because of the resources necessary to comply with potentially varying 
chain of custody requirements, TSA believes that subjecting carriers to 
additional State regulations in this area would likely place an 
unreasonable burden on interstate commerce. TSA seeks to avoid this 
result. For these reasons, the chain of custody and control security 
measures must be subject to uniform national standards.
    Whether the other provisions of this final rule preempt any such 
State, local, or tribal law, or types of laws, depends on an analysis 
of the specific State, local, or tribal law, or types of law, in the 
context of 49 U.S.C. 20106. At this

[[Page 72158]]

time, TSA makes no finding as to whether those other provisions of this 
final rule preempt State, local, or tribal law.
    Finally, TSA is not including language delegating inspection 
authority to the States, as requested by the New Jersey Office of 
Homeland Security & Preparedness. TSA does note, however, that if, in 
the course of performing an inspection, TSA identifies evidence of 
noncompliance with a State requirement, TSA will (as appropriate) 
provide the information to the appropriate State agency for action. In 
this regard, TSA would not directly enforce State security rules and 
would initiate a Federal inspection only when a security nexus exists. 
If TSA were to reconsider its position in the future, it would do so 
through the issuance of notice to the public.

K. Comments on the Regulatory Impact Assessment

    To evaluate the impact of the proposed rule, TSA prepared a 
Regulatory Impact Assessment (RIA) and posted it to the public docket 
in December of 2006. We received a number of public comments that 
addressed many aspects of the assessment. The majority of commenters 
discussed what they perceive to be deficiencies or inaccuracies in our 
assessment. Several commenters, including individuals, businesses, and 
trade associations, questioned some of the analytical assumptions used 
to estimate the costs of the NPRM. Others pointed out instances where 
they believe that we failed to account for a compliance cost. TSA 
considered all comments on the original RIA and has summarized and 
responded to them below.
1. Whether the Benefits of the Rule Justify the Costs
    Comments: Although we received multiple comments that supported the 
security objectives of the proposed rule, one commenter, a large Class 
I railroad, stated that the costs of the proposed regulatory action far 
outweigh the benefits. In its comprehensive public comments, the 
railroad implied that the costs of the proposed rule--both direct and 
indirect--could not be justified by the increase in security afforded 
by the regulation, and that the rule would only negligibly reduce risk 
in the rail transportation mode. The commenter asserted that it is 
impossible to completely secure the U.S. rail network. The commenter 
also asserted that the rule fails to strike the proper balance between 
compliance costs (both direct and indirect) and the probability of the 
occurrence of a transportation security incident in the rail mode.
    The same commenter stated that the rule would not substantially 
increase the level of security in the rail transportation mode. The 
railroad noted that the U.S. rail network is an inherently open system, 
making it difficult to secure. Further, the railroad stated that while 
the proposed rule attempts to address the risk posed by hazardous 
materials, the very nature of the U.S. rail network would prevent a 
shipment of hazardous materials from ever being fully secured. It 
observed that the rail system will always be susceptible to attack and 
other incidents.
    The commenter stated that the proposed rule would inflict 
significant direct and indirect costs on the rail transportation mode. 
In particular, the railroad singled out the chain of custody and 
control requirements as being potentially costly for freight railroad 
operators. The railroad noted that the requirement would force 
companies to make investments in security in lieu of investments aimed 
at increasing rail system capacity, an acute need in light of the 
continuing growth in freight rail shipments. The railroad implied that 
the rule, by curtailing the expansion of the rail network and slowing 
the movement of freight, would exact large costs on railroads, 
shippers, and ultimately the U.S. economy.
    The commenter stated that TSA did not adequately estimate the costs 
in the RIA and that TSA did not satisfactorily weigh them against the 
benefits of the proposed regulation. The commenter also criticized TSA 
for failing to calculate the probability of the occurrence of a 
transportation security incident in the rail transportation mode, a 
step it believes is necessary in justifying the costs of the proposed 
rule. In the commenter's view, the agency examined the potential 
consequences of a security incident, without acknowledging the low 
probability of such an event. Consequently, the railroad did not agree 
with TSA's assessment that the costs of the proposed rule--and in 
particular that the financial impact of the chain of custody and 
control requirement--could be justified by security improvements.
    TSA Response: TSA recognizes that the rule will have an economic 
impact on railroads, and we appreciate that the compliance costs of the 
regulation represent an investment in security for many in the 
industry. As part of the economic analysis required by E.O. 12866, we 
have made every attempt to include all known and quantifiable costs in 
the RIA.
    The agency disagrees, however, with the assertion that the rule 
will impose costs on industry disproportionate to its benefits. 
Although the agency concurs with the portrayal of the U.S. rail system 
as an open, difficult-to-secure network, TSA believes that the 
provisions of the rule, including those not addressed by the comment, 
will improve security in the rail mode.
    First, this final rule will protect the dissemination of sensitive 
rail security information by designating it as SSI. This provision of 
this final rule will impose no costs on covered individuals and 
businesses but will provide an additional measure of protection against 
possible threats. Information that could potentially be detrimental to 
security if publicly disclosed will be less likely to be distributed 
and misused under the SSI designation.
    Second, this final rule will codify the authority of TSA, or DHS 
officials working with TSA, to enter and inspect covered entities at 
any time, including inspecting and testing property, facilities, 
equipment, and operations, and viewing, inspecting, and copying 
records. These inspections will assist TSA in carrying out its 
statutory authority, which includes the assessment of threats to 
transportation; enforcement of security-related regulations and 
requirements; inspection, maintenance, and testing of security 
facilities, equipment, and systems; and ensuring the adequacy of 
security measures for the transportation of freight and cargo. See 49 
U.S.C. 114.
    Third, this final rule will require freight and passenger railroad 
carriers, rail transit systems, and rail hazardous materials facilities 
to designate and use RSCs. This provision will prove beneficial, 
because it will result in more efficient communication between TSA and 
companies operating in the rail mode, particularly in the event of an 
emergency.
    Fourth, this final rule will require freight and passenger railroad 
carriers, rail transit systems, and rail hazardous materials facilities 
to immediately report potential threats and significant security 
concerns to TSA. This requirement will help TSA ``connect the dots,'' 
pulling together seemingly disconnected or disparate reports of 
suspicious or unusual activities. These reports may provide the insight 
necessary to prevent a transportation security incident, if they can be 
analyzed quickly in the context of broader information derived from the 
intelligence community.
    Fifth, this rulemaking will require freight railroad carriers 
transporting certain categories and quantities of

[[Page 72159]]

hazardous materials, and rail hazardous materials facilities subject to 
the rule, to provide information to TSA on the location of certain rail 
cars. This requirement will increase security by providing information 
critical to re-routing or stopping shipments to address specific 
security threats or incidents. This information could amplify the 
ability of TSA, law enforcement, and emergency response agencies to 
respond to any potential threats or attacks involving rail cars 
transporting hazardous materials and to protect the populations that 
might otherwise be harmed.
    Sixth, this final rule will require freight railroad carriers and 
rail hazardous materials facilities to eliminate practices that leave 
certain hazardous materials unattended before or during shipment, and 
after shipment until unloading of the rail car occurs. This requirement 
will apply: (1) To the rail hazardous materials shipper and freight 
railroad carrier until the freight railroad carrier takes physical 
custody of the rail car, (2) when two freight railroad carriers 
interchange a rail car within an HTUA, (3) when two freight railroad 
carriers interchange a rail car that may enter an HTUA after the 
interchange, (4) to the freight railroad carrier delivering a rail car 
to a rail hazardous materials receiver within an HTUA, and (5) to the 
rail hazardous materials receiver within an HTUA until the rail car is 
unloaded. Although these requirements will impose costs to industry, as 
highlighted by the commenter, TSA believes these provisions will 
significantly increase security in the rail mode. The agency believes 
strongly that the requirement will appreciably reduce the risk of a 
rail car being used in a transportation security incident inside a 
major U.S. metropolitan area.
    Finally, while the commenter may view risk in the rail mode as low, 
risk is in fact dynamic, constantly evolving and shifting over time. 
Transportation modes once considered at low risk for a security 
incident may experience an increase in risk due to changes in the 
underlying threat, vulnerability, and consequence calculus--the three 
factors of which risk is a function.
    For example, risk to the rail mode may rise due to the threat 
shifting behavior on the part of adversaries. Or, changes in standard 
industry practices may increase the vulnerability of the mode, causing 
an increase in overall risk. Conversely, natural developments, such as 
population growth in certain rail-centric locations across the country, 
may cause the consequences from a particular incident in the industry 
to rise, yielding an increase in the risk profile of the mode. For 
these reasons, the agency did not attempt to quantify benefits or risk 
reduction to the mode.
    TSA's authority under ATSA with respect to transportation security 
is comprehensive and supported with specific powers related to the 
development and enforcement of security-related regulations and 
requirements. With its broad authority, the agency may assess a 
security risk for any mode of transportation, develop security measures 
for dealing with that risk, and enforce compliance with those measures. 
TSA strongly believes that the benefits enumerated above more than 
justify the potential compliance costs of this final rule. In fact, the 
agency is confident that the regulation will appreciably increase 
security in the rail mode.
2. Overestimated Compliance Costs
    Comments: One information technology firm specializing in GPSs 
opined that TSA's estimate in the NPRM for the economic impact of the 
rule was too high. In its comment, the company estimated that there are 
approximately 50,000 affected rail tank cars in service, and that the 
affected firms could outfit all of them with GPS technology for less 
than $42 million, which represents a fraction of the economic impact 
TSA estimated in the RIA.
    TSA Response: The rule does not require railroads or other covered 
entities to purchase and maintain GPS technologies. To comply with 
related provisions of the rulemaking, namely the location and shipping 
information requirement, a firm may choose to utilize GPS; however, 
that is the prerogative of the firm and not mandated by the regulation. 
The location and shipping information requirement is a performance 
standard, and TSA has not dictated the use of any specific technology 
to meet this standard.
    Additionally, there are several other provisions of the rulemaking 
that the technology firm failed to account for when it estimated that 
the regulation would cost industry less than $42 million. For example, 
the company did not comment on the cost of RSCs, the reporting of 
significant security concerns, or the chain of custody and control 
requirements--all major provision of the rule. For these reasons, TSA 
did not adjust its analysis of the economic impact of the rule based on 
the information submitted by the commenter.
3. Underestimated Compliance Costs
    A number of commenters indicated that some of the compliance costs 
estimated in the RIA for the NPRM were understated. Many companies, 
individuals, and trade associations that commented on compliance cost 
estimates focused on the chain of custody and control requirement, but 
others raised different concerns. TSA has summarized those comments by 
topic and responded to them below.
i. General
    Comments: One individual commenter stated that the cost of this 
final rule will be twice as high as TSA estimated in the RIA. Without 
providing any details, this individual opined that the average annual 
cost of the rule, estimated by TSA at $15 million to the railroad 
industry and its shippers and receivers, was simply too low.
    TSA Response: Without more detailed information on why the rule 
will cost industry twice the amount estimated by TSA in the RIA, we did 
not adjust the estimates.
ii. Chain of Custody and Control
    Comments: Other commenters asserted that the proposed chain of 
custody provision might lead to economic issues resulting from the 
possible disruption of the continuous supply to chemical companies of 
raw materials. The commenters relayed concerns that certain Class I 
railroad carriers have informed some rail hazardous materials 
facilities that their railroads will no longer store chlorine. Instead, 
under the new rule, the commenters stated that receivers will have to 
accept product shipments on delivery.
    TSA Response: TSA understands that the chain of custody and control 
requirements of the final rule will likely change the way that railroad 
carriers and rail hazardous materials facilities interact with each 
other with respect to the shipment of certain classes of hazardous 
materials. The agency agrees with the commenters that the changes 
spurred by the final rule will have real economic consequences. 
However, TSA disagrees that the chain of custody provisions will 
adversely affect the economy or result in supply chain disruptions of 
the hazardous materials to which this final rule applies.
    In attempting to estimate the economic impact of the chain of 
custody and control provision, the agency assumed that rail hazardous 
materials facilities will need to modify their existing business 
procedures to ensure that someone is able to accept a

[[Page 72160]]

hazardous materials shipment covered by the rule. As stated above, TSA 
accounted for the costs of these economic impacts in the RIA to the 
best of its abilities, estimating that the regulatory provision will 
not impose an insignificant cost on all rail hazardous materials 
facilities. TSA hopes that freight railroad carriers, rail hazardous 
materials shippers, and rail hazardous materials receivers will work 
together to minimize the costs of this regulation by working to speed 
the covered materials through the supply chain and better schedule 
deliveries to receivers. As the agency could not find any information 
to improve its RIA, the cost estimates for this provision remain 
unchanged.
    Comments: A trade association representing the explosives industry 
stated that the attendance requirement, also known as the chain of 
custody and control provisions of the rule, could be very costly. The 
association also noted, however, that it could not provide any insight 
into the scope or level of costs that regulated parties will likely 
incur for this provision of the rule.
    TSA Response: TSA acknowledges that there will be costs for 
entities in the railroad industry and others to comply with the chain 
of custody and control requirement. However, without more detailed 
information from the commenter, we decided not to change the cost 
estimates for this provision.
    Comments: A large, Class I railroad commented that the RIA for the 
NPRM underestimated the direct costs for railroads and other firms to 
comply with the chain of custody and control requirement of the 
rulemaking. It stated that TSA's methodology for calculating the 
compliance costs of this provision was inadequate.
    In particular, the railroad remarked that one of the key 
assumptions used in the calculation--that railroads and other firms 
will use a single security guard to monitor rail cars and interchanges 
affected by this requirement--was flawed. The carrier pointed out that 
a single individual supervising multiple cars in a classification yard, 
in many instances, will not be sufficient to comply with the rule. The 
company went on to state that many of its classification yards are 
large or constructed on a curve, making it difficult for a single 
person to maintain supervision of multiple cars if they are not all 
located adjacent to each other in a small area. In many situations, 
routine yard activities will also make it difficult for an individual 
to monitor affected cars. This flawed analytical assumption caused the 
agency to underestimate the cost of this requirement of the proposed 
rule.
    TSA Response: The carrier presented several logical points in 
explaining how TSA failed to calculate the costs of the chain of 
custody provision in an accurate manner. We agree with some of the 
arguments put forth by the railroad, particularly the observation that 
a single individual, in many instances, will be unable to monitor 
multiple rail cars in a large area. TSA acknowledges that operational 
realities may make it difficult for an individual to have an 
``unobstructed view of the rail car prior to the delivering railroad 
carrier leaving the interchange point,'' as we proposed in the NPRM.
    For this reason, TSA has amended the language of the proposal to 
allow railroad carriers more flexibility in complying with the chain of 
custody and control provision. The final rule will not require affected 
entities to have an ``unobstructed view of the rail car'' when 
complying with this requirement. This change should assuage some of the 
concerns expressed by the railroad. It should also make it likelier 
that railroad carriers will be able to meet the requirement using the 
method described in the RIA.
    TSA would also like to note that the chain of custody and control 
requirement is a performance standard. Different entities, using 
whatever means practicable, may meet the standard using different 
methods. So, while TSA appreciates the input from the particular 
railroad, its concerns may not be reflective of the broader industry. 
Moreover, TSA was unable to improve its estimate with the information 
given by the commenter. Furthermore, the agency could not find any 
credible data that would cause it to alter its original estimate.
    Because of the rule change, and because of the lack of new, 
detailed information, we did not adjust our cost estimate for this 
provision of the final rule.
    Comments: The same commenter also stated that TSA ignored the 
indirect costs of the chain of custody and control requirement when it 
estimated costs for the original RIA. In detailing the potentially 
significant indirect costs of the requirement, the railroad noted that 
the provision may force railroad firms to make sub-optimal changes to 
their operations, resulting in high costs to the industry.
    The commenter claimed that the chain of custody and control 
requirement would slow the movement of freight on the national rail 
network. This would have serious consequences for railroad companies 
and their customers.
    For railroad companies, constraining commodity flows could increase 
operating costs. For example, if the chain of custody and control 
requirement impedes the speed at which railroad companies currently 
deliver covered hazardous materials to locations in HTUAs, then 
companies may be forced to use multiple crews and multiple shifts for 
what presently takes only one crew and one shift. This would have 
obvious financial implications.
    Likewise, the commenter stated that if shipments are slowed due to 
the new requirement, customers of the rail mode could also experience 
adverse effects, particularly to operations that are dependent on 
timely deliveries. In concluding this portion of its comment, the 
railroad stressed that anything it would have to do above and beyond 
current operations that would consume capacity would cost the company, 
and potentially its customers, money.
    TSA Response: TSA agrees that the security improvements required by 
the final rule, particularly the chain of custody and control 
provision, will have cost impacts on the rail mode. We believe, 
however, that the provisions of the rule are essential to reducing risk 
in the industry and increasing the overall level of security and that 
the provisions need not be obstacles to efficient operations. TSA 
agrees that there will be changes but has considered both security and 
impact in finalizing the requirements.
    While the carrier asserted that the rule may impact the flow of 
freight movements over the national rail network, the carrier failed to 
provide TSA with a clear, detailed exposition of how the rule will 
increase transit times of shipments and cause the railroads to increase 
staffing levels. As previously noted, railroads may well find several 
ways to comply with this provision. In fact, TSA contends that some 
railroads will be able to comply with the provision without adversely 
affecting rail operations. Without any new, detailed information, we 
could not reliably modify our original costs estimates for the final 
rule.
    Comments: The same commenter also asserted that the RIA did not 
account for the fact that the number of HTUAs may expand in the future, 
which would increase the cost of complying with the chain of custody 
and control requirement of the rule. Chasing a potentially moving 
target, NS pointed out, would make it hard for firms to plan their 
operations and make long-term investments. This uncertainty would 
impose additional costs on the affected firms.

[[Page 72161]]

    TSA Response: In estimating costs for the RIA, TSA did not forecast 
an expansion in the number of HTUAs over time, because TSA has 
finalized the list of HTUAs through this rulemaking. If TSA decides to 
make any changes to the list of applicable HTUAs, it will do so through 
further rulemaking. Thus, railroads and other entities affected by the 
rule will not need to plan for sudden changes in the list of HTUAs. 
Consequently, we did not adjust the RIA for potential changes to the 
number of HTUAs.
iii. Opportunity Cost of Foregone Investments in Rail Capacity
    Comments: Maintaining and expanding railroad infrastructure to 
accommodate the continuing growth of freight shipments requires 
significant levels of investment, one commenter asserted. Money that is 
spent complying with Federal rules represents resources that railroad 
companies cannot use to expand rail capacity, something that is needed 
to meet the transportation needs of the nation. The commenter implied 
that investments in security improvements represent opportunity costs 
to the rail mode, and that TSA failed to account for these types of 
costs in the RIA.
    TSA Response: For any given firm, part of the cost of every 
investment decision is the value of the benefits forgone from choices 
not taken. The issue is no different for investments in security 
improvements. To adequately evaluate the claims included in the 
comment, TSA would need data reflecting current rail capacity relative 
to future demand identifying projected capacity shortfalls. TSA could 
then compare the total cost of the chain of custody and control 
requirement to the total cost of industry investments in capacity. 
Without such data, which was not provided by the commenter, TSA could 
not credibly change its analysis. The agency was also unable to obtain 
this type of data from a public source.
4. Incidence of Compliance Costs
    Comments: One commenter--a large Class I railroad--expressed 
concern that the private sector is expected to shoulder the costs of 
the final rule. It opined that shippers will pay for the cost of 
security regulations issued by TSA absent any government funding. An 
individual, echoing the comments made by the railroad, also predicted 
that the railroad companies would pass along compliance costs to 
customers in the form of rate increases.
    TSA Response: Nothing in this final rule would prevent a freight 
railroad carrier or a rail hazardous materials facility or even a rail 
transit system from attempting to pass on its costs of compliance to 
its customers. That is a decision for each regulated party to make, one 
that falls outside the scope of the final rule.
    Although TSA acknowledges that some firms might pass on their 
compliance costs, we were unable to conclusively determine if this 
would be a direct result of the final rule. Without further information 
from industry, TSA did not attempt to ascertain who would ultimately 
pay for the costs of the regulation other than the parties directly 
regulated by the rule.
5. Unintended Economic Consequence of Regulation
    Comments: The cost of complying with the regulation will ultimately 
fall on consumers in the form of shipment rate increases, one 
individual stated. Increased rates for freight shipments will cause 
consumers to move shipments of hazardous materials from railroads to 
commercial motor carriers, making them more susceptible to attacks at 
truck stops within HTUAs. The commenter noted that it is widely 
accepted in risk analysis circles that chemicals are generally safer 
when transported by rail than by highway.
    TSA Response: While some consumers may engage in intermodal 
substitution, the analysis put forth by the commenter is incomplete. To 
fully evaluate the substitution effect between rail and trucking 
services would require several additional pieces of information: How 
will the increase in railroad operating cost be reflected in the fee 
railroads charge to customers? Is there tank truck capacity to absorb 
the shifted volume such that current operating costs and fees of the 
trucking industry would be unaffected? Would delivery by tank truck 
rather than rail car require additional time in transportation? What 
additional capital costs would consumers be required to assume in order 
to accommodate a shift from rail to trucking? What additional costs 
would be incurred by consumers as a result of changes in plant 
operations to accommodate a shift from rail to trucking? How elastic or 
inelastic is the demand for rail transport of hazardous material? 
Absent these data, TSA decided it could not credibly change the cost 
estimates in the RIA in response to this comment.
6. Insufficient Calculation of Benefits
    Comments: One individual stated that TSA failed to provide 
information on the approximate percentage of total risk that would be 
eliminated by the rule. He also noted that the re-routing of certain 
freight around various metropolitan areas would likely be more 
effective in mitigating risk to the public.
    TSA Response: As previously noted, risk is dynamic--the risk of a 
transportation incident occurring in one mode of transportation may 
shift over time. In the rail mode, like all other modes, factors such 
as threat, vulnerability, and consequence are constantly evolving, 
making it difficult to quantitatively measure risk. For this reason, 
TSA did not attempt to quantify benefits or risk reduction to the rail 
industry. TSA has concluded, however, that investment in the security 
measures required by this rule remains a prudent course of action.
    While we appreciate the individual's comments regarding the re-
routing of certain types of freight around metropolitan areas, we have 
not evaluated that alternative at this time, although we suspect the 
costs of such a requirement could be significant. Further, it is 
illustrative that no railroads suggested this as a viable alternative 
to the rule. Moreover, this issue is outside the scope of this final 
rule, but PHMSA addressed it in its interim final rule published in the 
Federal Register on April 16, 2008.\54\
---------------------------------------------------------------------------

    \54\ See Section IV.G ``Chain of Custody and Control.''
---------------------------------------------------------------------------

    Comments: Echoing the comment summarized above, a railroad carrier 
remarked that TSA did not weigh the costs of the regulation against the 
probability of a transportation security incident in the rail mode. The 
railroad implied that the agency, while only examining the potential 
consequences of an event, failed to acknowledge the relatively low 
probability of an attack on a rail car, and therefore did not complete 
a comprehensive analysis of the rule.
    TSA Response: As stated several times above, risk is not a static 
concept. The ever-shifting, always evolving nature of risks to the 
transportation sector makes it very difficult for TSA to calculate the 
probability of an event in any particular mode. For this reason, we did 
not attempt to quantitatively gauge the level of risk to the rail 
transportation industry.
    Moreover, TSA does not concede that the probability of an incident 
involving a rail car is relatively low. The commenter provided no facts 
or evidence to support its claim, and the agency strongly believes that 
security improvements in the industry are merited. Even if the 
probability of an incident in the rail mode were low, the potential 
consequences of such an incident could be very significant. If

[[Page 72162]]

potential consequences are high, it is worth taking steps to deter an 
incident.
7. Impact on Small Entities
    Comments: Some commenters expressed concern that the requirement 
for rail hazardous materials facilities to attend rail car exchanges 
during a physical transfer of custody might impose an economic burden 
on the industry. These commenters were particularly concerned about the 
economic effect on small companies that may not be open for business at 
the time of transfer.
    TSA Response: TSA recognizes that a rail hazardous materials 
receiver located in an HTUA that is not open for business 24 hours a 
day, seven days a week, may incur some additional cost to meet the 
requirements of the final rule. To the best of its ability, TSA 
accounted for this economic impact in the RIA, estimating that rail 
hazardous materials facilities will collectively incur costs of over 
$70 million, discounted at 7 percent, over the 10-year period of 
analysis. To date, TSA has not received any information that would 
allow it to improve its estimate and therefore has not changed it for 
the final rule.
    Comments: An industry trade association representing short line and 
regional railroads expressed reservations about how the chain of 
custody and control requirement will affect small railroad carriers. 
Explaining how the rule may fundamentally change the way small 
railroads operate, the trade association asserted that the requirement 
may impose a severe financial impact on the industry.
    In its comment, the trade association stated that small railroad 
companies, unlike the large Class I railroads, generally operate less 
than 24 hours a day. In fact, many companies may also only operate two 
to three days a week, meaning that they are not always open for 
business when another railroad drops off a car for interchange. 
Furthermore, small railroads find it difficult to predict when a rail 
car will be dropped off for interchange, given the way many Class I 
railroads operate around the clock.
    The commenter stated that the operational realities of the industry 
will make it difficult for small railroads to comply with the chain of 
custody and control requirement without making significant changes to 
their practices. The trade association contended that small railroad 
carriers will need to evolve from scheduled, weekday businesses into 
firms operating 24 hours a day, seven days a week, in order to 
adequately follow the chain of custody and control provision, which 
will require firms to document the transfer of custody of a rail car. 
With no new source of revenues to offset the increased operating costs, 
the commenter argued that the effects of this change will be 
financially devastating for small railroads.
    TSA Response: TSA appreciates the special needs of the smaller 
railroads represented by the commenter and has no doubt that the unique 
characteristics of the industry pose special issues. The chain of 
custody and control requirement is a paramount feature of this rule and 
represents a new business process for the industry in general. We 
realize the provision will impact firms financially.
    We do not agree, however, with some of the assertions made by a 
trade association. First, the rule does not require small Class II and 
Class III railroads to change their hours of operation. While it is 
true that the chain of custody and control requirement will impact 
current industry practices, small railroads are free to meet the 
requirement, which is a performance standard, in almost any way 
practicable. Because it is also incumbent upon Class I railroads to 
meet the performance standard, TSA anticipates railroads may need to 
increase their level of coordination with respect to interchanges of 
covered hazardous materials. The agency believes that this can occur 
without substantial changes to small railroads' hours of operations or 
staffing levels.
    Furthermore, lacking detailed information on the types of costs 
likely to be incurred by smaller railroads, TSA could not credibly 
modify its cost estimates for this provision of the rule. In its 
comment, the trade association did not specifically lay out how 
affected small entities would meet the requirement, and how the small 
entities' actions would impose high financial costs. The trade 
association did not direct TSA to more information that would allow it 
to more fully understand the operational and financial impacts of the 
provision.
    Despite all the comments on this provision, TSA strongly believes 
that the security benefits of improved chains of custody and control 
are critical for securing the nation's rail network. During the public 
comment period, TSA did not receive any recommendations for less-costly 
alternatives that would attain the security goal of this provision of 
the rule. For this reason, TSA sees no reason to exclude the chain of 
custody provision that TSA proposed in the NPRM.
    Comments: With respect to rail hazardous materials facilities, an 
individual questioned whether TSA had any further information on the 
number of small facilities likely to incur costs to secure their 
property. This individual noted that, in the RIA provided with the 
NPRM, TSA estimated that between two and 14 small facilities will need 
to install security fencing to comply with the rule.
    TSA Response: We have not adjusted the original estimate of the 
number of small facilities likely to incur cost as a result of the 
rule. During the comment period, the agency did not receive any new 
information that would cause it to modify its initial estimate, nor 
could it find any new information to belie its original claim. The 
estimate, therefore, of two to 14 small facilities remains the same for 
the RIA for the final rule.
8. Impact on International Trade
    Comments: Another individual asserted that the RIA for the NPRM 
failed to adequately examine whether the rule will adversely impact 
international trade. Specifically, he stated that TSA did not 
sufficiently analyze whether the rule will interfere with international 
boundary crossing inspection procedures of tank cars.
    TSA Response: The chain of custody requirements do not apply at any 
shipper facilities located outside the United States. Rather, for 
international shipments to the United States, the requirements begin at 
the first railroad carrier interchange point and apply to all 
subsequent carrier interchanges that are otherwise subject to this 
final rule. The requirements also apply at a rail hazardous materials 
receiver located in an HTUA, regardless of whether the rail car 
originated at a foreign or domestic location. Accordingly, this final 
rule does not affect any existing requirements applicable to 
inspections of tank cars entering the United States from a foreign 
location.

L. Comments Beyond the Scope of the Rule

    Comments: Two commenters supported the rerouting of hazardous 
materials around cities. The Government of the District of Columbia 
(District) commented on the feasibility of using technologies that 
incorporate chemical sensors and open hatch detection into GPS tracking 
systems to immediately notify local officials and first responders of 
potential tank car leaks, in order to meet the proposed location and 
shipping information requirements in Sec.  1580.103. The District 
asserted that because of the unique risks that the city faces, such 
security measures could not substitute for

[[Page 72163]]

rerouting all hazardous materials around the District.
    TSA Response: The topic of rerouting of hazardous materials around 
cities is outside the scope of the NPRM, and therefore TSA is not 
addressing it in this final rule. However, TSA notes that on December 
21, 2006, PHMSA published an NPRM in the Federal Register, proposing to 
revise the current requirements in the HMR applicable to the safe and 
secure transportation of hazardous materials transported in commerce by 
rail. 71 FR 76852. Section I.B. ``Purpose of the Rule'' contains a 
discussion of PHMSA's proposed requirements. PHMSA published its 
interim final rule in the Federal Register on April 16, 2008.

V. Rulemaking Analyses and Notices

    Changes to Federal regulations must undergo several economic 
analyses. First, Executive Order 12866 (E.O. 12866), Regulatory 
Planning and Review (58 FR 51735, October 4, 1993), directs each 
Federal agency to propose or adopt a regulation only upon a reasoned 
determination that the benefits of the intended regulation justify its 
costs. Second, the Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et 
seq., as amended by the Small Business Regulatory Enforcement Fairness 
Act of 1996), requires agencies to analyze the economic impact of 
regulatory changes on small entities. Third, the Trade Agreements Act 
(19 U.S.C. 2531-2533) prohibits agencies from setting standards that 
create unnecessary obstacles to the foreign commerce of the United 
States. Fourth, the Unfunded Mandates Reform Act of 1995 (2 U.S.C. 
1531-1538) requires agencies to prepare a written assessment of the 
costs, benefits, and other effects of proposed or final rules that 
include a Federal mandate likely to result in the expenditure by State, 
local, or tribal governments, in the aggregate, or by the private 
sector, of $100 million or more annually (adjusted for inflation). The 
OMB A-4 Accounting Statement is located in the full Regulatory Impact 
Assessment, which is located in the docket.
    In conducting these analyses, TSA determined:
    (1) This rulemaking does not constitute an economically 
''significant regulatory action'' as defined in E.O. 12866.
    (2) This rulemaking is unlikely to have a significant economic 
impact on a substantial number of small entities under Sec.  605(b) of 
the Regulatory Flexibility Act (5 U.S.C. 601 et seq.). To make this 
determination, we conducted a Final Regulatory Flexibility Analysis 
(FRFA), which is available below.
    (3) This rulemaking does not constitute a barrier to international 
trade.
    (4) This rulemaking does not impose an unfunded mandate on State, 
local, or tribal governments, or on the private sector.
    TSA summarizes the E.O 12866 analysis, international trade 
analysis, and the unfunded mandates analysis, though provides the FRFA 
in its entirety.

A. Executive Order 12866 Assessment (Regulatory Planning and Review) 
Impact Summary

    The rule addresses threats and vulnerabilities in the rail 
transportation sector. This summary provides a synopsis of the costs 
and benefits of the final rule.

Benefits of the Final Rule

    The final rule enhances the security of rail transportation by: (1) 
Requiring the protection of SSI in the rail transportation sector; (2) 
clarifying TSA and DHS authority to conduct inspections in order to 
assess and mitigate threats to security; (3) providing TSA and DHS with 
a regulatory mechanism to locate rail cars containing certain hazardous 
materials; (4) mandating that rail hazardous materials facilities that 
ship or receive these materials conduct routine inspections of 
shipments; (5) creating a secure chain of custody requirement for the 
transfer of rail cars containing these materials; and (6) requiring 
certain rail hazardous materials shipper and receiver facilities to 
store rail cars containing these hazardous materials in areas with 
physical security controls.

Costs of the Final Rule

    The costs of the final rule result primarily from the requirements 
for: (1) Freight railroad carriers and rail hazardous materials 
shippers and receivers to establish secure chains of custody for 
hazardous materials covered by the rule; and (2) railroad carriers, 
rail hazardous materials shippers, and rail hazardous materials 
receivers to provide TSA and DHS with various pieces of information. 
TSA concluded that the present value total cost (7 percent discount 
rate) of the rule will range from $152.8 million to $173.9 million. See 
Figure 1 for the primary 10-year cost estimate, which equals $163.3. 
TSA has provided a detailed discussion in the docket of how TSA 
calculated this estimate and the range of estimates discussed above.
[GRAPHIC] [TIFF OMITTED] TR26NO08.000


[[Page 72164]]



B. Regulatory Flexibility Act Assessment

    In accordance with the Regulatory Flexibility Act (5 U.S.C. 601-
612), TSA prepared this Final Regulatory Flexibility Analysis (FRFA) 
that examines the impacts of the final rule on small entities. A small 
entity may be: (1) A small business, defined as any independently owned 
and operated business not dominant in its field that qualifies as a 
small business per the Small Business Act; (2) a small not-for-profit 
organization; or (3) a small governmental jurisdiction (locality with 
fewer than 50,000 people).
    This FRFA addresses the following:
    1. The objectives of and legal basis for the final rule;
    2. The reason the agency is considering this action;
    3. Significant issues raised during the public comment period;
    4. The number and types of small entities to which the rule 
applies;
    5. Projected reporting, recordkeeping, and other compliance 
requirements of the final rule, including the classes of small entities 
that will be subject to the requirements and the type of professional 
skills necessary for preparation of the reports and records; and
    6. Flexibility in the final rule.

Background and Legal Authority

    TSA has the responsibility for enhancing security in all modes of 
transportation. Under ATSA, and delegated authority from the Secretary 
of Homeland Security, TSA has broad responsibility and authority for 
``security in all modes of transportation * * * including security 
responsibilities * * * over modes of transportation that are exercised 
by the Department of Transportation.'' \55\ TSA has authorities in 
addition to those transferred from DOT. TSA is specifically empowered 
to develop policies, strategies, plans and regulations for dealing with 
threats to all modes of transportation, including mass transit.\56\ As 
part of its security mission, TSA is responsible for assessing 
intelligence and other information to identify individuals who pose a 
threat to transportation security and to coordinate countermeasures 
with other Federal agencies to address such threats.\57\ TSA also is 
empowered to enforce security-related regulations and requirements,\58\ 
ensure the adequacy of security measures for the transportation of 
cargo,\59\ oversee the implementation, and ensure the adequacy, of 
security measures at transportation facilities,\60\ and carry out other 
appropriate duties relating to transportation security.\61\ TSA has 
broad regulatory authority to achieve ATSA's objectives, and may issue, 
rescind, and revise such regulations as are necessary to carry out TSA 
functions,\62\ and may issue regulations and security directives 
without notice or comment or prior approval of the Secretary of 
DHS.\63\ TSA is also charged with serving as the primary liaison for 
transportation security to the intelligence and law enforcement 
communities.\64\
---------------------------------------------------------------------------

    \55\ See, 49 U.S.C. 114(d). The TSA Assistant Secretary's 
current authorities under ATSA have been delegated to him by the 
Secretary of Homeland Security. Under Section 403(2) of the Homeland 
Security Act (HSA) of 2002, Pub. L. 107-296, 116 Stat. 2315 (2002), 
all functions of TSA, including those of the Secretary of 
Transportation and the Undersecretary of Transportation of Security 
related to TSA, transferred to the Secretary of Homeland Security. 
Pursuant to DHS Delegation Number 7060.2, the Secretary's guidance 
and control, the authority vested in the Secretary with respect to 
TSA, including that in Section 403(2) of the HSA.
    \56\ 49 U.S.C. 114(f)(3).
    \57\ 49 U.S.C. 114(f)(1)-(5); (h)(1)-(4).
    \58\ 49 U.S.C. 114(f)(7).
    \59\ 49 U.S.C. 114(f)(10).
    \60\ 49 U.S.C. 114(f)(11).
    \61\ 49 U.S.C. 114(f)(15).
    \62\ 49 U.S.C. 114(l)(1).
    \63\ 49 U.S.C. 114(l)(2).
    \64\ 49 U.S.C. 114(f)(1) and (5).
---------------------------------------------------------------------------

    TSA's authority with respect to transportation security is 
comprehensive and supported with specific powers related to the 
development and enforcement of regulations, security directives, 
security plans, and other requirements. Accordingly, under this 
authority, TSA may assess a security risk for any mode of 
transportation, develop security measures for dealing with that risk, 
and enforce compliance with those measures.
    TSA's legal authority is supported by National policy. On December 
17, 2003, the President issued Homeland Security Presidential Directive 
7 (HSPD-7, Critical Infrastructure Identification, Prioritization, and 
Protection), which ``establishes a national policy for Federal 
departments and agencies to identify and prioritize United States 
critical infrastructure and key resources and to protect them from 
terrorist attacks.'' \65\ In recognition of the lead role assigned to 
DHS for transportation security, and consistent with the powers granted 
to TSA by ATSA, the directive provides that the roles and 
responsibilities of the Secretary of DHS include coordinating 
protection activities for ``transportation systems, including mass 
transit, aviation, maritime, ground/surface, and rail and pipeline 
systems.'' \66\ In furtherance of this coordination process, HSPD-7 
provides that DHS and DOT will ``collaborate on all matters relating to 
transportation security and transportation infrastructure protection.'' 
\67\ (HSPD-7, Paragraph 22(h).)
---------------------------------------------------------------------------

    \65\ HSPD-7, Paragraph 1.
    \66\ HSPD-7, Paragraph 15.
    \67\ HSPD-7, Paragraph 22(h).
---------------------------------------------------------------------------

    In accordance with the September 2004 Memorandum of Understanding 
(MOU) between DHS and DOT, the two departments consult and coordinate 
on security-related rail and hazardous materials transportation issues 
to ensure they are consistent with overall DHS security policy goals 
and objectives and the regulated industry is not confronted with 
inconsistent security guidance or requirements promulgated by multiple 
agencies.

Statement of Need for the Regulatory Action

    TSA developed the final rule to mitigate threats and 
vulnerabilities in the rail transportation network. In the United 
States, the freight rail transportation system transports hundreds of 
millions of dollars worth of freight and employs hundreds of thousands 
of individuals annually.\68\ Passenger systems, including passenger 
railroad carriers as well as rail mass transit systems, carry millions 
of people daily throughout the country.
---------------------------------------------------------------------------

    \68\ U.S. Department of Transportation, Research and Innovative 
Technology Administration, Bureau of Transportation Statistics, 
Pocket Guide to Transportation 2006 (Washington, D.C.: Bureau of 
Transportation Statistics, 2006).
---------------------------------------------------------------------------

    Rail transportation networks--both passenger and freight--are 
vulnerable to a variety of transportation security incidents. In the 
past, terrorists have targeted passenger and mass transit rail 
transportation systems to inflict mass casualties (e.g., Tokyo 1995; 
Moscow 2000, 2001, and 2004; Madrid 2004; London 2005; and Mumbai 
2006). Freight rail systems also represent potential terrorist targets. 
Although not the result of a deliberate attack, the incident involving 
a ruptured chlorine tank car in Graniteville, South Carolina, killed 
nine people and injured hundreds more. These incidents highlight the 
fact that hazardous materials in rail transportation and rail passenger 
systems are possible targets of terrorism intended to inflict hundreds 
or even thousands of fatalities, with direct and indirect costs from 
transportation system disruption that could total billions of dollars.
    The final rule attempts to reduce the probability that such an 
event will occur by: (1) Requiring the protection of sensitive security 
information in the rail sector; (2) clarifying TSA's authority to

[[Page 72165]]

conduct inspections of rail security operations; (3) requiring the 
designation of an RSC and an alternate; (4) requiring covered entities 
to have the ability to report on rail car locations and shipping 
information for cars under their physical custody and control; (5) 
requiring covered entities to report significant security concerns to 
TSA; and (6) requiring covered entities to establish chain of custody 
and control standards for certain hazardous shipments.

Issues Raised in Public Comments

    TSA received public comments on the Initial Regulatory Flexibility 
Analysis that was issued in support of the NPRM during the public 
comment period. All comments are available for the public to view at 
the Federal Docket Management System: http://www.regulations.gov/search/index.jsp.
    As part of this rulemaking effort, TSA has summarized and responded 
to all public comments relating to the Initial Regulatory Flexibility 
Analysis issued with the NPRM. Comment summaries and responses are 
located in the preamble to the final rule, which is also available at 
http://www.regulations.gov/search/index.jsp and in the Federal 
Register.

Description and Estimated Number of Small Entities

    The regulated entities are divided into railroad carriers, transit 
systems, and rail hazardous materials facilities. Rail hazardous 
materials facilities are primarily chemical manufacturers, although 
some wholesalers may also ship chemicals. Additionally, some ammonia 
producers classify themselves as support activities for agriculture or 
agricultural wholesalers. Figure 1 provides the North American Industry 
Classification System (NAICS) codes and SBA standards for defining 
small entities for the sectors expected to be affected by the rule.

                      Figure 1--Firm Size Standards
------------------------------------------------------------------------
                                                        Small business
            Industry                     NAICS             standard
------------------------------------------------------------------------
Line Haul railroads.............  482111............  1,500 FTEs.
Short line railroads............  482112............  500 FTEs.
Transit Systems.................  485...............  $6.5 million.
Petrochemical manufacturing.....  32511.............  1,000 FTEs.
Alkalis and chlorine              325181............  1,000 FTEs.
 manufacturing.
All other basic inorganics......  325188............  1,000 FTEs.
All other basic organics........  325199............  1,000 FTEs.
Plastic and resin manufacturing.  32511.............  750 FTEs.
Nitrogen fertilizer               325311............  1,000 FTEs.
 manufacturing.
Other chemical manufacturing....  325...............  500-1,000 FTEs.
Support activities for rail.....  48821.............  $6.5 million.
Petroleum refineries............  32411.............  1,500 FTEs.
Pulp and paper mills............  3221..............  750 FTEs.
Support activities for            1151..............  $6.5 million.
 agriculture.
Chemical wholesalers............  42469.............  100 FTEs.
Agricultural wholesalers........  42491.............  100 FTEs.
Electric utilities..............  2111..............  <4 m megawatt
                                                       hours/year.
Water and sewage systems,         2213..............  $6.5 million.
 private.
Water and sewage systems, public  92................  <50,000 people
                                                       serviced.
------------------------------------------------------------------------
Source: Small Business Administration.

    Overall, of all the regulated parties, TSA identified 651 entities 
that may meet the SBA definition of a small entity. These entities 
reflect the following makeup:

                    Figure 2--Types of Small Entities
------------------------------------------------------------------------
                             Type                                Count
------------------------------------------------------------------------
Railroads....................................................        549
Transit, Other...............................................         86
Small Rail Hazardous Materials Facilities....................         16
                                                              ----------
    Total....................................................        651
------------------------------------------------------------------------

    The number of small railroad carriers potentially affected by the 
rule is difficult to estimate accurately, because most local railroad 
carriers are privately owned. Based on the Association of American 
Railroads (AAR) data on employment and revenues, TSA assumed that all 
railroad carriers, except the seven Class I railroads, are small 
entities. This assumption may be conservative, because some private 
companies own a number of local railroads and may exceed the 500 full-
time equivalent (FTE) size limits. Figure 3 presents the AAR data on 
the number of railroads, average revenues, and average number of FTEs.

                       Figure 3--Railroad Types by Average Revenue and Number of Employees
----------------------------------------------------------------------------------------------------------------
                                                                                                  Average number
                          Type                               Number      Average freight revenue      of FTEs
----------------------------------------------------------------------------------------------------------------
Class I................................................               7           $5,590,000,000          21,100
Regional...............................................              31               45,483,871             239
Local..................................................             314                3,121,019              17
Switching and Terminal.................................             204                3,137,255             32
----------------------------------------------------------------------------------------------------------------
Source: American Association of Railroads.


[[Page 72166]]

    The Bureau of Transportation Statistics (BTS) lists 152 transit 
systems (21 commuter rail systems, 45 rail transit systems, and 86 
other rail transit systems).\69\ Of these 86 listed as ``other,'' the 
systems include cable car, inclined plane, monorail, and automated 
guideway.\70\ As shown in Figure 4, only the systems in the ``other'' 
category have average passenger revenues of less than $6.5 million, 
which is the SBA standard for small transit entities. The other transit 
systems not only have average passenger revenues that exceed the 
standard, but are also generally operated by governmental entities that 
receive financial support from the Federal and State governments. TSA 
did not identify any systems that qualified as small. It is unlikely 
that local governments that meet the SBA standard for small governments 
(50,000 people served) operate rail transit systems. Consequently, TSA 
has included only the ``other'' entities as potentially affected small 
entities.
---------------------------------------------------------------------------

    \69\ Bureau of Transportation Statistics, National 
Transportation Statistics, Modal Profile Transit Systems, Updated 
April 2005. Note, however, that four of the 152 transit systems 
listed by BTS are classified as trolley bus and would not be covered 
by this final rule. This is represented in Figure 4, which only 
shows 41 transit systems (14 heavy rail and 27 light rail).
    \70\ The estimate for ``Other Rail Transit Systems'' impacted by 
this final rule shown in Figure 4 is conservative because it 
includes conveyances such as vanpools and aerial tramways, which 
will not be affected by this rule.

              Figure 4--Transit Systems by Average Revenues
------------------------------------------------------------------------
                                                      Average annual
               Type                    Number       passenger revenue
------------------------------------------------------------------------
Heavy Rail........................           14             $189,590,000
Light Rail........................           27                8,490,000
Commuter Rail.....................           21               73,910,000
Other.............................           86                 590,000
------------------------------------------------------------------------
Source: BTS.

    Of the 241 rail hazardous materials facilities identified from the 
Risk Management Program (RMP) data, there are 29 facilities that at 
first review appeared to be small entities based upon the facility 
employee count. However, within these 29, research on corporate 
relationships revealed that, at most, 16 facilities are potentially 
small. As explained in Section 5.6.1 of the separate full evaluation, 
only facilities with less than 21 employees are expected to incur 
incremental costs related to creating secure storage areas, while all 
will incur costs for the other requirements. Based upon this threshold 
of 20 or less employees, at most eight facilities could have costs. 
Three of these facilities have revenue data that suggests a large firm. 
Additionally, descriptions of operating locations and business lines on 
the World Wide Web suggest that these three facilities have a higher 
number of employees than small entities and that they are parts of much 
larger firms. Although TSA is using eight as the number of facilities 
for purposes of the analysis below, this may overstate the number of 
firms.
    Figure 5 presents the data distribution by FTE for hazardous 
materials facilities that may be SBA-defined small entities. Of the 
total facilities assumed to be small, 14 have less than 100 employees 
while only two have 100 or more.\71\
---------------------------------------------------------------------------

    \71\ The number of facilities that actually are part of firms 
that meet the small entity definitions may be lower. TSA excluded 
only those facilities that could be clearly identified as belonging 
to corporations or municipalities that exceed the SBA standards.

      Figure 5--Affected Small Rail Hazardous Materials Facilities
------------------------------------------------------------------------
                                                                 Rail
                                                               hazardous
                       Number of FTEs                          materials
                                                              facilities
------------------------------------------------------------------------
100+........................................................           2
50-99.......................................................           3
21-49.......................................................           5
10-20.......................................................           5
1-9.........................................................           1
Potential Small Entities....................................         16
------------------------------------------------------------------------
Source: TSA Calculations.

Description of Compliance Requirements

    Railroads will have to submit the name(s) of and engage in training 
of the RSC, document chain of custody transfers, and file incident 
reports and car location reports as needed. TSA assumed that regional 
and local railroad carriers handled hazardous materials shipments in 
proportion to their percentage of total freight carried. Again, this 
assumption may be conservative because it is likely that Class I 
carriers move most chemicals. Figure 6 presents the costs for an 
average regional, local, and shortline and terminal (S&T) rail carrier 
to comply with the requirements.

                                  Figure 6--Average Costs to Railroads by Size
----------------------------------------------------------------------------------------------------------------
              Requirement                 Unit cost     Number Activities/year    Regional    Local      S & T
----------------------------------------------------------------------------------------------------------------
RSC....................................       $91.00  2........................       $182       $182       $182
Incident Report........................        63.00  2........................        126        126        126
Chain of Custody.......................    4,969,723  Weighted by % of Revenue.      5,362        368        370
Location...............................        91.00  1........................         91         91         91
----------------------------------------------------------------------------------------------------------------
    Total..............................  ...........  .........................      5,761        767       769
----------------------------------------------------------------------------------------------------------------
Source: TSA Calculations.

    As discussed above, only the 86 transit systems in the ``other'' 
category in Figure 4 are expected to be small

[[Page 72167]]

entities according to SBA standards.\72\ These small transit systems 
will only incur unit costs for submission of RSC information and 
incident reporting. Both the RSC and incident reporting costs are 
expected to be incurred on average just once per year per small transit 
system, resulting in average costs per system of just $245, as shown in 
Figure 7.
---------------------------------------------------------------------------

    \72\ Again, it is important to note that the estimate of 86 
``Other Rail Transit Systems'' impacted by the rule is in all 
likelihood conservative.

                                                    Figure 7--Average Costs for Small Transit Systems
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                                             Unit cost       Number of       Regional
                                                                                                         ----------------   activities/  ---------------
                                               Requirement                                                                     year
                                                                                                                 A       ----------------      A x B
                                                                                                                                 B
--------------------------------------------------------------------------------------------------------------------------------------------------------
RSC.....................................................................................................          $91.00               2            $182
Incident Report.........................................................................................           63.00               1              63
                                                                                                         -----------------------------------------------
    Total...............................................................................................  ..............  ..............            245
--------------------------------------------------------------------------------------------------------------------------------------------------------
Source: TSA Calculations.

    As explained above, the cost for hazardous materials facilities 
includes the cost of adding fencing, training, and inspections, plus 
the types of cost incurred by railroads. TSA assumed that each facility 
will train an average of 10 workers and the number of inspections per 
small facility is based on the assumption that the number of 
inspections is proportional to the quantity of chemical held. The 16 
small rail hazardous materials facilities represent about 2.7 percent 
of the covered hazardous materials affected chemicals; therefore 2.7 
percent of the inspections were divided among the 16 firms to estimate 
191 inspections a year. Figure 8 presents the average costs for a 
hazardous materials facility with 20 or fewer employees. Because 
fencing is a capital cost, Figure 8 and Figure 9 also present the cost 
based on amortizing the fencing cost over 10 years at 7% discount 
rate.\73\
---------------------------------------------------------------------------

    \73\ Note that calculations in Figures 8 and 9 may be off due to 
rounding.

                                  Figure 8--Average Costs for Small Rail Hazardous Materials Facilities (<21 Employees)
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                             Unit cost        Number        First-year
                                                                                         --------------------------------      cost        Annual after
                                       Requirement                                                                       ----------------    1st year
                                                                                                 A               B             A x B
--------------------------------------------------------------------------------------------------------------------------------------------------------
Secure Storage Area.....................................................................         $16,150               1         $16,150          $2,299
RSC.....................................................................................              91               1              91              91
Training................................................................................              63              10             630             630
Inspections.............................................................................              11             191           2,006           2,006
Incident Report.........................................................................              63               1              63              63
Chain of Custody........................................................................          42,481               1          42,481          42,481
Location Reporting......................................................................              91               1              91              91
                                                                                         ---------------------------------------------------------------
    Total...............................................................................  ..............  ..............          61,512         47,661
--------------------------------------------------------------------------------------------------------------------------------------------------------
Source: TSA Calculations.


                                 Figure 9--Average Costs for Small Rail Hazardous Materials Facilities (>=21 Employees)
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                             Unit cost        Number        First-year
                                                                                         --------------------------------      cost        Annual after
                                       Requirement                                                                       ----------------    1st year
                                                                                                 A               B             A x B
--------------------------------------------------------------------------------------------------------------------------------------------------------
RSC.....................................................................................             $91               1             $91             $91
Training................................................................................              63              10             630             630
Inspections.............................................................................              11             191           2,006           2,006
Incident Report.........................................................................              63               1              63              63
Location Reporting......................................................................               0               0               0               0
                                                                                         ---------------------------------------------------------------
    Total...............................................................................  ..............  ..............           2,790          2,790
--------------------------------------------------------------------------------------------------------------------------------------------------------
Source: TSA Calculations.

    To examine the overall impact on small firms, a traditional method 
is to compare costs as a percentage of revenue. TSA was unable to find 
revenue information on six of the 16 small rail hazardous materials 
facilities. One approximation method is to use known average revenues 
per employee as a proxy. For those firms in this group of small 
facilities with revenue information available, the average revenue per 
employee is approximately $685,000. There is, however, one firm with 
revenue as low as $50,000 per employee. This wide range suggests an 
alternative value must also be considered. For the compliance impacts 
in Figure 10, TSA used the smallest revenue per employee number to 
create a proxy for the missing revenue values as the ``Low End'' 
estimate. For the

[[Page 72168]]

``Average'' estimate, TSA substituted the average $685,000 as the 
revenue per employee. For each identified rail hazardous materials 
facility that may be a small entity, a letter identification label is 
used to avoid listing specific business names. For the railroads, 
averages appeared to be representative and only one estimate for each 
rail or transit type is presented. Figure 10 presents the average costs 
as a percent of average revenues with the missing data replacement 
described above. As can be seen, most instances have a relatively low 
cost/revenue relationship. However, five instances in the ``low-end'' 
case and two in the ``average'' case could have much higher impact if 
the unknown firm revenues are reflected by the estimation technique.

                     Figure 10--Average First-Year Compliance Costs as a Percent of Revenue
----------------------------------------------------------------------------------------------------------------
                                                                                         (E = D/B)    (F = D/C)
                                            (B) Revenue:    (C) Revenue:                   Cost /       Cost /
                  (A) ID                       low end         average       (D) Cost     revenue      revenue
                                              estimate        estimate        impact     (low end)    (average)
                                                                                         (percent)    (percent)
----------------------------------------------------------------------------------------------------------------
                                                Rail and Transit
----------------------------------------------------------------------------------------------------------------
Regional.................................................     $45,483,871      $16,624  ...........          0.0
Local....................................................       3,121,019        1,465  ...........          0.0
S & T....................................................       3,137,255        2,411  ...........          0.1
Small Transit............................................         590,000          154  ...........          0.0
----------------------------------------------------------------------------------------------------------------
                                    Small Rail Hazardous Materials Facilities
----------------------------------------------------------------------------------------------------------------
A........................................        $300,000       4,108,192       61,512         20.5          1.5
B........................................         600,000       8,216,383       61,512         10.3          0.7
C........................................         650,000       8,901,082       61,512          9.5          0.7
D........................................      24,400,000      24,400,000       61,512          0.3          0.3
E........................................         850,000      11,639,876       61,512          7.2          0.5
F........................................       1,000,000       1,000,000       61,512          6.2          6.2
G........................................       4,600,000       4,600,000        2,790          0.1          0.1
H........................................       1,100,000       1,100,000        2,790          0.3          0.3
I........................................      12,000,000      12,000,000        2,790          0.0          0.0
J........................................      10,000,000      10,000,000        2,790          0.0          0.0
K........................................      27,000,000      27,000,000        2,790          0.0          0.0
L........................................      24,400,000      24,400,000        2,790          0.0          0.0
M........................................       2,500,000      34,234,930        2,790          0.1          0.0
N........................................      19,600,000      19,600,000        2,790          0.0          0.0
O........................................     190,000,000     190,000,000        2,790          0.0          0.0
P........................................     130,000,000     130,000,000        2,790          0.0          0.0
----------------------------------------------------------------------------------------------------------------

Flexibility in the Final Rule

    Four parts of the final rule provide small entities with regulatory 
flexibility, helping them to minimize their compliance costs.
    First, the final rule will not require some railroad carriers, 
including certain tourist and scenic railroads, to maintain RSCs unless 
otherwise notified by TSA. This should provide some flexibility to 
certain smaller railroads not hauling freight.
    Second, the provision that requires freight railroad carriers and 
rail hazardous materials facilities to provide TSA with the location 
and shipping information of certain rail cars has been modified to 
allow smaller companies more flexibility. Upon request by TSA, each 
Class I railroad must provide information to TSA no later than five 
minutes if the request concerns only one rail car and no later than 30 
minutes if the request concerns more than one rail car. Conversely, the 
rule will require rail hazardous materials facilities and freight 
railroads other than the Class I carriers, upon request by TSA, to 
provide the agency with location and shipping information of rail cars 
within 30 minutes, regardless of the number of rail cars covered by the 
request. Moreover, the rule will also allow carriers to use a 
designated third party or agent to provide the car location and 
shipping information so long as the designated third party can provide 
accurate information within the specified timeframe. These policies 
should provide smaller railroads and rail hazardous materials 
facilities with some regulatory relief.
    Third, with respect to the chain of custody provision of the final 
rule, TSA added a new definition for what constitutes an ``attended'' 
rail car during an exchange of custody. The new definition, which TSA 
created after receiving many comments from industry, allows railroad 
carriers and rail hazardous materials facilities greater flexibility by 
stating that a representative of a railroad or rail hazardous materials 
facility does not have to maintain a line of sight with all rail cars 
during an exchange of custody. Railroads and rail hazardous materials 
facilities will now only need to ensure that an employee or 
representative is in reasonable proximity to the rail car(s), 
monitoring an exchange of custody in a manner that would allow them to 
properly detect unauthorized activity. This flexibility should allow 
firms to comply with the provisions using less costly methods than 
would have been otherwise possible.
    Fourth, the final rule will allow rail hazardous materials 
facilities that receive covered shipments located in HTUAs to request 
an exemption from the chain of custody and control section if they 
believe, based on operational and geographic characteristics, that the 
potential security threat to the facility does not warrant the 
application of the security measure.
    These measures should allow affected firms--both large and small--
some flexibility in complying with the rule.

Identification of Duplication, Overlap, and Conflict With Other Rules

    This rail transportation security rule affects entities that are 
also subject to the requirements of other DHS rules--the DHS Chemical 
Facility Anti-Terrorism Standards (CFATS) regulation

[[Page 72169]]

and the Coast Guard's Maritime Transportation Security Act (MTSA) 
regulations. TSA has provided a more detailed discussion in Section II 
of this preamble.

Conclusion

    While approximately 70% of the total affected entities were 
identified as small entities, the estimated compliance costs associated 
with this rulemaking are low on a per entity basis except for the 
identified five (``low end case'') and two (``average case'') 
facilities. Rail hazardous materials facilities are allowed great 
flexibility in selecting the physical security measures needed to 
ensure no unauthorized persons gain access to the rail secure area, and 
may select lighting, video surveillance, or other appropriate methods 
besides fencing to meet the performance standard. Certain rail 
hazardous materials facilities may receive an exemption from some or 
all of the chain of custody and control requirements. TSA notes that 
these cases with the significant impact are costed using the most 
expensive compliance method (fencing). These businesses may in fact 
have much lower impacts based upon the performance standard compliance 
alternatives or exemption. Based on this analysis, TSA believes that 
this FRFA shows that an estimated impact of the two cost scenarios with 
impact of over 6% on either five out of 651 firms (0.8 percent) or 2 
out of 651 firms (0.3 percent) is unlikely to constitute a substantial 
number under section 605(b) of the RFA (5 U.S.C. 601 et seq.).

C. Paperwork Reduction Act

    The Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.) 
requires that TSA consider the impact of paperwork and other 
information collection burdens imposed on the public and, under the 
provisions of Sec.  3507(d), obtain approval from the Office of 
Management and Budget (OMB) for each collection of information it 
conducts, sponsors, or requires through regulations.
    This final rule contains new information collection activities 
subject to the PRA. Accordingly, TSA has submitted the following 
information requirements to OMB for its review.
    This final rule will require: (1) Freight and passenger railroad 
carriers, rail transit systems, certain rail hazardous materials 
shipper and receiver facilities, tourist, scenic, historic, and 
excursion rail operations (whether operating on or off the general 
railroad system of transportation), and private rail car operations (on 
or connected to the general railroad system of transportation) to allow 
TSA and DHS officials working with TSA to enter and be present within 
any area or within any conveyance to conduct inspections, tests, or to 
perform such other duties as TSA directs, including copying of records; 
(2) freight railroad carriers, certain rail hazardous materials shipper 
and receiver facilities, passenger railroad carriers, and rail mass 
transit systems to designate and submit contact information for an RSC 
and at least one alternate RSC to be available to TSA on a 24-hours, 7 
days a week basis to serve as the primary contact for receipt of 
intelligence information and other security-related activities and 
coordinator of security practices and procedures with appropriate law 
enforcement and emergency response agencies; (3) freight and passenger 
railroad carriers, certain rail hazardous materials shippers and 
receivers, passenger railroad carriers, rail mass transit systems, 
tourist, scenic, historic, and excursion rail operations (whether 
operating on or off the general railroad system of transportation), and 
private rail car operations (on or connected to the general railroad 
system of transportation) to immediately report potential threats and 
significant security concerns to DHS; and (4) freight railroad carriers 
and certain rail hazardous materials shippers and receivers to provide 
for a secure chain of custody and control of rail cars containing a 
specified quantity and type of hazardous material.
    This proposal would support the information needs of TSA to enhance 
security in the following modes of transportation: freight rail, 
including freight railroad carriers, rail hazardous materials 
facilities which offer, load, prepare, receive and/or unload certain 
types and quantities of hazardous materials, and private cars; 
passenger rail, including passenger railroad carriers such as intercity 
and commuter passenger rail operations, rail transit systems, tourist, 
scenic, historic, and excursion rail operations (whether operating on 
or off the general railroad system of transportation), and private rail 
car operations (on or connected to the general railroad system of 
transportation).
    TSA estimates that the final rule will affect 945 respondents, 
including freight railroad carriers, passenger railroad carriers and 
rail hazardous materials facilities. TSA has revised this estimate 
slightly from 949 respondents estimated in the NPRM after further 
consideration. These different respondents will have different 
reporting responsibilities under this final rule. TSA will require all 
affected entities to submit RSC contact information to TSA. The agency 
estimates that each of the 945 freight and passenger railroad carriers, 
rail transit systems, and rail hazardous materials shippers and 
receivers will respond once to submit RSC information to TSA, resulting 
in 945 responses.
    Additionally, all affected entities will need to report significant 
security concerns to TSA. To forecast the number of responses, TSA 
adopted assumptions on the number of incidents by industry segment 
(e.g., freight rail, passenger rail, etc.). First, the agency estimates 
that each freight railroad carrier will respond anywhere from one to 36 
times per year depending on the amount of PIH materials the carrier 
transports. TSA estimates that each passenger railroad and rail transit 
entity will respond between zero and 1,460 times per year. TSA 
estimates that each rail hazardous materials shipper and receiver 
facility will respond from zero to two times per year. In total, the 
agency expects the affected entities to send the government information 
anywhere from 45,893 to 93,073 times per year for this requirement, 
down from the 49,762-99,862 annually frequency TSA estimated in the 
NPRM. As a primary estimate, TSA estimates that there will be 69,483 
incident reports per year.
    Finally, this final rule will require affected entities to provide 
TSA with information on the location and shipping information on 
certain railcars upon request. TSA estimates that it will initiate 
between 105 and 255 requests per year, with a primary estimate of 150 
requests per year.
    Thus, the annual frequency of information requirements is between 
46,943 and 94,273. Adding the three primary estimates yields a total of 
70,578 responses per year. (945 + 69,483 + 150 = 70,578).
    TSA estimates that the total annual hour burden is 288,945 hours. 
This figure was derived by adding the annual burdens for RSC reporting 
(312) + location and shipping reporting (150) + primary significant 
security concerns reporting (69,483) + chain of custody reporting 
(219,000) = 288,945. After further consideration, TSA has revised its 
annual recordkeeping and reporting cost burden from the range of 
$3,420,655 to $6,576,955 to an estimated $9,388,567. This figure was 
derived by adding the annual costs for RSC reporting ($28,378) + 
location and shipping reporting ($13,650) + primary significant 
security concerns reporting ($4,377,429) + chain of custody reporting 
($4,969,110) = $9,388,567. Larger reporting burdens are anticipated

[[Page 72170]]

for passenger rail systems due to higher estimates of suspicious 
incident reports.
    TSA received various comments related to the information collection 
generally. One mass transit agency asked whether a list of security 
coordinators previously sent to TSA to comply with the rail security 
directives would satisfy Sec.  1580.201's requirement to appoint an 
RSC. Passenger railroad carriers and rail transit systems that have 
already provided the required information on their primary and 
alternate RSCs to TSA do not have to take further action unless any of 
the contact information changes. However, all changes to the names, 
titles, telephone numbers, and e-mail addresses of the RSCs and 
alternate RSCs must be reported to TSA within seven calendar days.
    TSA received numerous comments about the interrelationship between 
the reporting requirements of this rule and the reporting that occurs 
in response to other regulatory programs or other procedures. 
Commenters urged TSA to increase coordination and eliminate unnecessary 
duplication. For example, one trade association said that certain 
facilities are currently reporting significant security concerns to the 
FBI, local authorities, and the Coast Guard. The association said that 
TSA should use these existing reports to gather information rather than 
creating an additional reporting requirement. The association suggested 
that if TSA maintains this reporting requirement in the final rule, it 
should only apply to the certain hazardous materials determined to pose 
a higher security risk (such as materials poisonous by inhalation, 
explosives, and radioactive materials).
    Several commenters wrote about the relationship between the 
proposed reporting requirement and the reporting requirement in 49 CFR 
659.33, asking TSA to clarify the role of State oversight agencies in 
the reporting process. Some State DOTs said that the proposed reporting 
would partially duplicate the reporting requirements of the State 
oversight program, which would force rail systems to develop multiple 
sets of procedures and processes.
    Commenters suggested the following options for coordinating or 
merging the proposed reporting requirement with similar existing 
requirements:
     Create a centralized or ``one stop'' reporting process for 
stakeholders.
     Avoid any ``excessive'' duplication between the safety 
oversight and rail security programs.
     Minimize redundant reporting and ensure there is 
coordination of FRA, National Transportation Safety Board (NTSB), and 
TSA reporting requirements.
     Parallel the proposed reporting requirement with existing 
requirements (or vice versa).
     Allow reporting to other jurisdictional law enforcement 
agencies to meet the requirement of reporting to TSA.
     Allow reporting to the State oversight agency to fulfill 
TSA's requirement.
     Make the proposed reporting requirement more consistent 
with posting to the public transportation portion of the Homeland 
Security Information Network.
     Modify the reporting requirements for the National Transit 
Database to support TSA's needs.
     Require that covered entities send reports to the National 
Response Center as the primary and sole reporting center for the 
purposes of this section and develop a mechanism for TSA to receive 
reports of significant security concerns from the National Response 
Center.
    A trade association asserted that many jurisdictions and 
authorities also want immediate reports. The association suggested that 
TSA consider adding language that helps regulated entities prioritize 
all of the notifications that they are required to make.
    In response to these comments, TSA has determined that it needs 
information immediately on potential threats, suspicious activities, 
and security incidents for the purposes of comprehensive intelligence 
analysis, threat assessment, and allocation of security resources. 
Reporting of security concerns must be made to the Freedom Center, 
which maintains communications networks with other Federal operations 
centers, such as DOT's Crisis Management Center, to convey reported 
security concerns to interested entities throughout the Federal 
government.
    Reports submitted to State oversight agencies under 49 CFR 659.33 
will not satisfy the requirements of this final rule. Reports to the 
oversight agencies meet a more general need for situational awareness, 
particularly pertaining to safety conditions. There is not extensive 
overlap between the required reporting under this final rule and the 
reporting under 49 CFR 659.33. Where there is overlap, TSA would expect 
that rail transit systems would follow procedures for reporting to TSA 
as well as to the State agencies.
    Reporting requirements to the National Response Center are not co-
extensive with the reporting requirements of this rule, which is 
broader in scope. For example, this rule would require reporting of 
such things as threat information and the discovery of suspicious 
items. Covered entities need not report these to the National Response 
Center, but are useful pieces of information to TSA as indicators of 
potential terrorist activities. Therefore, TSA cannot rely on obtaining 
reports from the National Response Center. Moreover, obtaining reports 
indirectly from the National Response Center, the States, or other 
third parties might delay a needed response or may not contain adequate 
information for TSA's purposes.
    The Chairman and four members of the U.S. House Committee on 
Homeland Security expressed the view that the proposed reporting 
requirements would not improve rail security. They commented that the 
reporting requirements would not make the industry proactive in 
deterring terrorists and that, instead of collecting data for study 
after incidents have occurred, TSA should provide the industry with 
mandatory, standardized security practices and mandated training 
programs. TSA believes that the requirements to report significant 
security concerns have great value in the overall approach to enhancing 
rail security, and disagrees with the commenters' view that the 
reporting requirements do not advance that objective. When TSA analyzes 
reports of significant security concerns from passenger rail carriers 
(including rail transit systems), freight railroad carriers, and rail 
hazardous materials shippers and receivers, TSA will be able to 
determine if there are geographic or other patterns to the reported 
activities. These analyses may enable TSA to prevent or interrupt 
terrorist planning or attack. In addition, these analyses assist TSA in 
determining whether inspections should be targeted at particular areas 
or activities. Finally, TSA can use the reported incidents to determine 
whether to encourage or require particular security measures either 
immediately or in the future.
    Many commenters said that TSA's definition of reportable events is 
too broad and should be more narrowly focused. Several comments from 
transit authorities said that the proposed reporting requirements would 
impose a substantial burden on transit systems and even on TSA itself. 
They also asserted that the proposed requirements would result in an 
overload of information that would divert attention from truly 
significant threats and dilute the effectiveness of the reporting 
system. Other commenters asked for a more specific description of 
``suspicious'' activities or a list of

[[Page 72171]]

examples that would, or would not, be considered ``suspicious.'' A 
commenter identified ``youth vandalism'' as an incident that should not 
be reportable.
    Several commenters offered specific suggestions for which 
activities or incidents should be considered reportable. Some 
commenters suggested that the requirement focus only on activities that 
pose a security threat to rail cars carrying the hazardous materials 
specifically covered by the regulation.
    An industry association noted that the events that must be reported 
to DOT are very specific (such as a person being killed or requiring 
hospitalization) and suggested that TSA's reportable events be more 
specific and similar to DOT's. One commenter suggested that TSA only 
require the reporting of certain specific crimes. Another commenter 
made specific suggestions regarding the categories of events that 
should be reported to TSA.
    In response to these comments, TSA is aware that the proposed 
reporting requirements are broad and, in some respects--such as the 
requirement to report ``suspicious'' activities--are not as specific as 
the regulated community would like. However, TSA has not changed the 
reporting requirements in the final rule for several reasons. The 
reporting requirements are intended to reduce risk to the rail 
transportation systems by providing TSA with information to intervene 
on a timely basis to thwart a threat or further attack. Detecting 
activities that may compromise transportation security entails piecing 
together seemingly unrelated incidents or observations and conducting 
analysis in context with information from other sources. As the threat 
environment is dynamic and indications of planning and preparation for 
an incident that may compromise transportation security are subject to 
change, a threshold for reportable events or a specific definition 
cannot be provided.
    TSA has decided not to accept commenters' suggestions to limit the 
scope of the reporting requirement. Limiting the scope to the DOT 
reporting requirements, which are intended to identify safety concerns, 
would reduce the data that TSA could use for trend analysis to 
anticipate and prevent an attack. Limiting incident reporting to only 
those materials that are determined to be sensitive security materials 
also would limit TSA's domain awareness and intelligence gathering.
    As provided by the PRA, as amended, an agency may not conduct or 
sponsor, and a person is not required to respond to, a collection of 
information unless it displays a currently valid OMB control number. 
Under the PRA, TSA is not authorized to impose a penalty on persons for 
violating information collection requirements that do not display a 
current OMB control number. TSA will publish the OMB control number for 
this information collection in the Federal Register after OMB approves 
it.

D. International Trade Impact Assessment

    The Trade Agreement Act of 1979 prohibits Federal agencies from 
establishing any standards or engaging in related activities that 
create unnecessary obstacles to the foreign commerce of the United 
States. Legitimate domestic objectives, such as safety, are not 
considered unnecessary obstacles. The statute also requires 
consideration of international standards and, where appropriate, that 
they be the basis for U.S. standards. TSA has assessed the potential 
effect of this rulemaking and has determined that it will have only a 
domestic impact and therefore no effect on any trade-sensitive 
activity.

E. Unfunded Mandates Reform Act Analysis

    The Unfunded Mandates Reform Act of 1995 is intended, among other 
things, to curb the practice of imposing unfunded Federal mandates on 
State, local, and tribal governments. Title II of the Act requires each 
Federal agency to prepare a written statement assessing the effects of 
any Federal mandate in a proposed or final agency rule that may result 
in a $100 million or more expenditure (adjusted annually for inflation) 
in any one year by State, local, and tribal governments, in the 
aggregate, or by the private sector; such a mandate is deemed to be a 
``significant regulatory action.'' This rulemaking does not contain 
such a mandate. The requirements of Title II of the Act, therefore, do 
not apply, and TSA has not prepared a statement under the Act.

F. Executive Order 13132, Federalism

    TSA has analyzed this final rule under the principles and criteria 
of E.O. 13132, entitled ``Federalism,'' issued August 4, 1999. 
Executive Order 13132 requires TSA to develop an accountable process to 
ensure ``meaningful and timely input by State and local officials in 
the development of regulatory policies that have federalism 
implications.'' According to the E.O.,``[p]olicies that have federalism 
implications'' include regulations that have ``substantial direct 
effect on the States, on the relationship between the national 
government and the States, or on the distribution of power and 
responsibilities among the various levels of government.''
    In this final rule, TSA is preempting certain State, local, and 
tribal requirements, including any such requirements prescribing or 
restricting security measures during the physical transfer of custody 
and control of a rail car containing hazardous materials. This is 
consistent with applicable statutes and with sound policy. Congress has 
enacted comprehensive Federal railroad laws (49 U.S.C. 20101 et seq.), 
which mandate that ``[l]aws, regulations and orders related to railroad 
safety and laws, regulations, and orders related to railroad security 
[] be nationally uniform to the extent practicable.'' See 49 U.S.C. 
20106. To achieve national uniformity, the Federal railroad laws 
``expressly preempt[] state authority to adopt safety rules, save for 
two exceptions.'' See Union Pacific Railroad Co. v. California Public 
Utilities Comm'n, 346 F.3d 851, 858 (9th Cir. 2003); see also 49 U.S.C. 
20106. A state may enact or continue in force a law related to railroad 
safety or security ``until the Secretary of Transportation (with 
respect to railroad safety matters), or the Secretary of Homeland 
Security (with respect to railroad security matters), prescribes a 
regulation or issues an order covering the subject matter of the State 
requirement.'' 49 U.S.C. 20106. ``Even after such a federal regulation 
issues, a State may adopt a more stringent law when `necessary to 
eliminate or reduce an essentially local safety or security hazard' if 
it `is not incompatible' with the federal regulation and `does not 
unreasonably burden interstate commerce.' '' CSX Transportation, Inc. 
v. Williams, 406 F.3d at 670-71; 49 U.S.C. 20106.
    A primary security concern related to the rail transportation of 
hazardous materials is the prevention of a catastrophic release or 
explosion in proximity to densely populated areas, including urban 
areas and events or venues with large numbers of people in attendance. 
Also of major concern is the release or explosion of a rail car in 
proximity to iconic buildings, landmarks, or environmentally 
significant areas. These are national concerns that require a uniform 
national regulatory approach that does not require regulated parties to 
implement different measures in different jurisdictions across the 
nation. TSA is therefore proposing a nationally-uniform regulatory 
provision requiring chain of custody procedures. This would avoid the 
burden on interstate commerce that would result if multiple

[[Page 72172]]

States, localities, and tribes established their own chain of custody 
requirements.
    Although Sec.  1580.107 preempts State and local requirements 
addressing the same matters, TSA does not believe that the custody and 
control requirements of this rulemaking will have an immediate 
substantial direct effect on the States, the relationship between the 
national government and the States, or the distribution of power and 
responsibilities among the various levels of government. The final rule 
will not require any actions by States, localities, or tribes. In 
addition, only one State has enacted a measure addressing chain of 
custody and control requirements for the rail transportation of 
hazardous materials.\74\ Thus, the final rule does not have sufficient 
federalism implications to warrant the preparation of a Federalism 
Assessment.
---------------------------------------------------------------------------

    \74\ California adopted the ``Local Community Rail Security Act 
of 2006'' on October 1, 2006.
---------------------------------------------------------------------------

G. Environmental Analysis

    TSA reviewed this action under DHS Management Directive 5100.1, 
Environmental Planning Program (effective April 19, 2006), which guides 
TSA compliance with the National Environmental Policy Act of 1969 
(NEPA) (42 U.S.C. 4321-4370f). We determined that this final rule is 
categorically excluded under number A3(a) (administrative and 
regulatory activities involving the promulgation of rules and the 
development of policies), number A4 (information gathering and data 
analysis), number A7(d) (conducting audits, surveys and data collection 
of a minimally intrusive nature, to include vulnerability, risk and 
structural integrity assessments of infrastructures), number B3 
(proposed activities and operations to be conducted in existing 
structures that are compatible with ongoing functions), and number B11 
(routine monitoring and surveillance activities that support homeland 
security, such as patrols, investigations and intelligence gathering).

H. Energy Impact Analysis

    TSA has assessed the energy impact of the final rule in accordance 
with the Energy Policy and Conservation Act (EPCA), Public Law 94-163, 
as amended (42 U.S.C. 6362). We have determined that this rulemaking is 
not a major regulatory action under the provisions of the EPCA. We also 
have analyzed this final rule under E.O. 13211, ``Actions Concerning 
Regulations That Significantly Affect Energy Supply, Distribution, or 
Use,'' 66 FR 28355 (May 18, 2001). We have determined that it is not a 
``significant energy action'' under that order. While it is a 
``significant regulatory action'' under E.O. 12866, it is not likely to 
have a significant adverse effect on the supply, distribution, or use 
of energy. The Administrator of the Office of Information and 
Regulatory Affairs has not designated it as a significant energy 
action. Therefore, a Statement of Energy Effects is not required for 
this rule under E.O. 13211.

List of Subjects

49 CFR Part 1520

    Air carriers, Aircraft, Airports, Maritime carriers, Rail hazardous 
materials receivers, Rail hazardous materials shippers, Rail transit 
systems, Railroad carriers, Railroad safety, Railroads, Reporting and 
recordkeeping requirements, Security measures, Vessels.

49 CFR Part 1580

    Hazardous materials transportation, Mass transportation, Rail 
hazardous materials receivers, Rail hazardous materials shippers, Rail 
transit systems, Railroad carriers, Railroad safety, Railroads, 
Reporting and recordkeeping requirements, Security measures.

The Final Rule

0
For the reasons set forth in the preamble, the Transportation Security 
Administration amends Chapter XII, of Title 49, Code of Federal 
Regulations, as follows:

PART 1520--PROTECTION OF SENSITIVE SECURITY INFORMATION

0
1. The authority citation for part 1520 continues to read as follows:

    Authority: 46 U.S.C. 70102-70106, 70117; 49 U.S.C. 114, 40113, 
44901-44907, 44913-44914, 44916-44918, 44935-44936, 44942, 46105.


0
2. In Sec.  1520.3, add definitions of ``Rail facility,'' ``Rail 
hazardous materials receiver,'' ``Rail hazardous materials shipper,'' 
``Rail secure area,'' ``Rail transit facility,'' ``Rail transit 
system,'' ``Railroad,'' and ``Railroad carrier'' in alphabetical order, 
and revise the definition of ``Vulnerability assessment'' to read as 
follows:


Sec.  1520.3  Terms used in this part.

* * * * *
    Rail facility means ``rail facility'' as defined in 49 CFR 1580.3.
    Rail hazardous materials receiver means ``rail hazardous materials 
receiver'' as defined in 49 CFR 1580.3.
    Rail hazardous materials shipper means ``rail hazardous materials 
shipper'' as defined in 49 CFR 1580.3.
    Rail secure area means ``rail secure area'' as defined in 49 CFR 
1580.3.
    Rail transit facility means ``rail transit facility'' as defined in 
49 CFR 1580.3.
    Rail transit system or Rail Fixed Guideway System means ``rail 
transit system'' or ``Rail Fixed Guideway System'' as defined in 49 CFR 
1580.3.
    Railroad means ``railroad'' as defined in 49 U.S.C. 20102(1).
    Railroad carrier means ``railroad carrier'' as defined in 49 U.S.C. 
20102(2).
* * * * *
    Vulnerability assessment means any review, audit, or other 
examination of the security of a transportation infrastructure asset; 
airport; maritime facility, port area, or vessel; aircraft; railroad; 
railroad carrier, rail facility; train; rail hazardous materials 
shipper or receiver facility; rail transit system; rail transit 
facility; commercial motor vehicle; or pipeline; or a transportation-
related automated system or network to determine its vulnerability to 
unlawful interference, whether during the conception, planning, design, 
construction, operation, or decommissioning phase. A vulnerability 
assessment may include proposed, recommended, or directed actions or 
countermeasures to address security concerns.
* * * * *

0
3. In Sec.  1520.5, revise paragraphs (b)(6)(i), (b)(8) introductory 
text, (b)(10), (b)(11)(i)(A), (b)(12) introductory text, and (b)(15) to 
read as follows:


Sec.  1520.5  Sensitive security information.

* * * * *
    (b) * * *
    (6) Security inspection or investigative information. (i) Details 
of any security inspection or investigation of an alleged violation of 
aviation, maritime, or rail transportation security requirements of 
Federal law that could reveal a security vulnerability, including the 
identity of the Federal special agent or other Federal employee who 
conducted the inspection or audit.
* * * * *
    (8) Security measures. Specific details of aviation, maritime, or 
rail transportation security measures, both operational and technical, 
whether applied directly by the Federal government or another person, 
including--
* * * * *
    (10) Security training materials. Records created or obtained for 
the purpose of training persons employed

[[Page 72173]]

by, contracted with, or acting for the Federal government or another 
person to carry out aviation, maritime, or rail transportation security 
measures required or recommended by DHS or DOT.
    (11) * * *
    (i) * * *
    (A) Having unescorted access to a secure area of an airport, a rail 
secure area, or a secure or restricted area of a maritime facility, 
port area, or vessel;
* * * * *
    (12) Critical aviation, maritime, or rail infrastructure asset 
information. Any list identifying systems or assets, whether physical 
or virtual, so vital to the aviation, maritime, or rail transportation 
system (including rail hazardous materials shippers and rail hazardous 
materials receivers) that the incapacity or destruction of such assets 
would have a debilitating impact on transportation security, if the 
list is--
* * * * *
    (15) Research and development. Information obtained or developed in 
the conduct of research related to aviation, maritime, or rail 
transportation security activities, where such research is approved, 
accepted, funded, recommended, or directed by DHS or DOT, including 
research results.
* * * * *

0
4. In Sec.  1520.7, add new paragraph (n) to read as follows:


Sec.  1520.7  Covered persons.

* * * * *
    (n) Each railroad carrier, rail hazardous materials shipper, rail 
hazardous materials receiver, and rail transit system subject to the 
requirements of part 1580 of this chapter.

0
5. In Sec.  1520.11, revise paragraph (b) to read as follows:
* * * * *
    (b) Federal, State, local, or tribal government employees, 
contractors, and grantees. (1) A Federal, State, local, or tribal 
government employee has a need to know SSI if access to the information 
is necessary for performance of the employee's official duties, on 
behalf or in defense of the interests of the Federal, State, local, or 
tribal government.
    (2) A person acting in the performance of a contract with or grant 
from a Federal, State, local, or tribal government agency has a need to 
know SSI if access to the information is necessary to performance of 
the contract or grant.
* * * * *

0
6. Add part 1580 to read as follows:

PART 1580--RAIL TRANSPORTATION SECURITY

Subpart A--General
Sec.
1580.1 Scope.
1580.3 Terms used in this part.
1580.5 Inspection authority.
Subpart B--Freight Rail Including Freight Railroad Carriers, Rail 
Hazardous Materials Shippers, Rail Hazardous Materials Receivers, and 
Private Cars
1580.100 Applicability.
1580.101 Rail security coordinator.
1580.103 Location and shipping information for certain rail cars.
1580.105 Reporting significant security concerns.
1580.107 Chain of custody and control requirements.
1580.109 Preemptive effect.
1580.111 Harmonization of federal regulation of nuclear facilities.
Subpart C--Passenger Rail Including Passenger Railroad Carriers, Rail 
Transit Systems, Tourist, Scenic, Historic and Excursion Operators, and 
Private Cars
1580.200 Applicability.
1580.201 Rail security coordinator.
1580.203 Reporting significant security concerns.
Appendix A to Part 1580--High Threat Urban Areas.
Appendix B to Part 1580--Summary of the Applicability of Part 1580.

    Authority: 49 U.S.C. 114.

Subpart A--General


Sec.  1580.1  Scope.

    (a) Except as provided in paragraph (b) of this section, this part 
includes requirements for the following persons. Appendix B of this 
part summarizes the general requirements for each person, and the 
specific sections in this part provide detailed requirements.
    (1) Each freight railroad carrier that operates rolling equipment 
on track that is part of the general railroad system of transportation;
    (2) Each rail hazardous materials shipper that offers, prepares, or 
loads for transportation in commerce by rail one or more of the 
categories and quantities of rail security-sensitive materials set 
forth in Sec.  1580.100(b) of this part;
    (3) Each rail hazardous materials receiver, located within a High 
Threat Urban Area (HTUA) that receives in commerce by rail or unloads 
one or more of the categories and quantities of rail security-sensitive 
materials set forth in Sec.  1580.100(b) of this part;
    (4) Each passenger railroad carrier, including each carrier 
operating light rail or heavy rail transit service on track that is 
part of the general railroad system of transportation, each carrier 
operating or providing intercity passenger train service or commuter or 
other short-haul railroad passenger service in a metropolitan or 
suburban area (as described by 49 U.S.C. 20102), and each public 
authority operating passenger train service;
    (5) Each passenger or freight railroad carrier hosting an operation 
described in paragraph (a)(4) of this section;
    (6) Each tourist, scenic, historic, and excursion rail operator, 
whether operating on or off the general railroad system of 
transportation;
    (7) Each operator of private cars, including business/office cars 
and circus trains, on or connected to the general railroad system of 
transportation; and
    (8) Each operator of a rail transit system that is not operating on 
track that is part of the general railroad system of transportation, 
including heavy rail transit, light rail transit, automated guideway, 
cable car, inclined plane, funicular, and monorail systems.
    (b) This part does not apply to a freight railroad carrier that 
operates rolling equipment only on track inside an installation that is 
not part of the general railroad system of transportation.


Sec.  1580.3  Terms used in this part.

    For purposes of this part:
    Commuter passenger train service means ``train, commuter'' as 
defined in 49 CFR 238.5, and includes a railroad operation that 
ordinarily uses diesel or electric powered locomotives and railroad 
passenger cars to serve an urban area, its suburbs, and more distant 
outlying communities in the greater metropolitan area. A commuter 
operation is part of the general railroad system of transportation 
regardless of whether it is physically connected to other railroads.
    General railroad system of transportation means the network of 
standard gage track over which goods may be transported throughout the 
Nation and passengers may travel between cities and within metropolitan 
and suburban areas. See 49 CFR part 209, Appendix A.
    Hazardous material means ``hazardous material'' as defined in 49 
CFR 171.8.
    Heavy rail transit means service provided by self-propelled 
electric railcars, typically drawing power from a third rail, operating 
in separate rights-of-way in multiple cars; also referred to as 
subways, metros, or regional rail.
    High Threat Urban Area (HTUA) means an area comprising one or more 
cities and surrounding areas including a 10-mile buffer zone, as listed 
in Appendix A to this part.

[[Page 72174]]

    Improvised explosive device means a device fabricated in an 
improvised manner that incorporates explosives or destructive, lethal, 
noxious, pyrotechnic, or incendiary chemicals in its design, and 
generally includes a power supply, a switch or timer, and a detonator 
or initiator.
    Intercity passenger train service means both ``train, long-distance 
intercity passenger'' and ``train, short-distance intercity passenger'' 
as defined in 49 CFR 238.5.
    Light rail transit means service provided by self-propelled 
electric railcars, typically drawing power from an overhead wire, 
operating in either exclusive or non-exclusive rights-of-way in single 
or multiple cars and with shorter distance trips and frequent stops; 
also referred to as streetcars, trolleys, and trams.
    Offers or offeror means:
    (1) Any person who does either or both of the following:
    (i) Performs, or is responsible for performing, any pre-
transportation function for transportation of the hazardous material in 
commerce.
    (ii) Tenders or makes the hazardous material available to a carrier 
for transportation in commerce.
    (2) A carrier is not an offeror when it performs a function 
required as a condition of acceptance of a hazardous material for 
transportation in commerce (such as reviewing shipping papers, 
examining packages to ensure that they are in conformance with the HMR, 
or preparing shipping documentation for its own use) or when it 
transfers a hazardous material to another carrier for continued 
transportation in commerce without performing a pre-transportation 
function. See 49 CFR 171.8.
    Passenger car means rail rolling equipment intended to provide 
transportation for members of the general public and includes a self-
propelled car designed to carry passengers, baggage, mail, or express. 
This term includes a passenger coach, cab car, and a Multiple Unit (MU) 
locomotive. In the context of articulated equipment, ``passenger car'' 
means that segment of the rail rolling equipment located between two 
trucks. This term does not include a private car. See 49 CFR 238.5.
    Passenger train means a train that transports or is available to 
transport members of the general public. See 49 CFR 238.5.
    Private car means rail rolling equipment that is used only for 
excursion, recreational, or private transportation purposes. A private 
car is not a passenger car. See 49 CFR 238.5.
    Rail facility means a location at which rail cargo or 
infrastructure assets are stored, cargo is transferred between 
conveyances and/or modes of transportation, where transportation 
command and control operations are performed, or maintenance operations 
are performed. The term also includes, but is not limited to, passenger 
stations and terminals, rail yards, crew management centers, 
dispatching centers, transportation terminals and stations, fueling 
centers, and telecommunication centers.
    Rail hazardous materials receiver means any operator of a fixed-
site facility that has a physical connection to the general railroad 
system of transportation and receives or unloads from transportation in 
commerce by rail one or more of the categories and quantities of rail 
security-sensitive materials set forth in Sec.  1580.100(b) of this 
part, but does not include the operator of a facility owned or operated 
by a department, agency, or instrumentality of the Federal government.
    Rail hazardous materials shipper means the operator of any fixed-
site facility that has a physical connection to the general railroad 
system of transportation and offers, prepares, or loads for 
transportation by rail one or more of the categories and quantities of 
rail security-sensitive materials set forth in Sec.  1580.100(b) of 
this part, but does not include the operator of a facility owned or 
operated by a department, agency, or instrumentality of the Federal 
government.
    Rail secure area means a secure location(s) identified by a rail 
hazardous materials shipper or rail hazardous materials receiver where 
security-related pre-transportation or transportation functions are 
performed or rail cars containing the categories and quantities of rail 
security-sensitive materials are prepared, loaded, stored, and/or 
unloaded.
    Rail security-sensitive material means one or more of the 
categories and quantities of hazardous materials set forth in Sec.  
1580.100(b) of this part.
    Rail transit facility means rail transit stations, terminals, and 
locations at which rail transit infrastructure assets are stored, 
command and control operations are performed, or maintenance is 
performed. The term also includes rail yards, crew management centers, 
dispatching centers, transportation terminals and stations, fueling 
centers, and telecommunication centers.
    Rail transit system or ``Rail Fixed Guideway System'' means any 
light, heavy, or rapid rail system, monorail, inclined plane, 
funicular, cable car, trolley, or automated guideway that traditionally 
does not operate on track that is part of the general railroad system 
of transportation.
    Railroad means any form of nonhighway ground transportation that 
runs on rails or electromagnetic guideways, including: Commuter or 
other short-haul railroad passenger service in a metropolitan or 
suburban area and commuter railroad service that was operated by the 
Consolidated Rail Corporation on January 1, 1979; and high speed ground 
transportation systems that connect metropolitan areas, without regard 
to whether those systems use new technologies not associated with 
traditional railroads; but does not include rapid transit operations in 
an urban area that are not connected to the general railroad system of 
transportation. The term includes rail transit service operating on 
track that is part of the general railroad system of transportation but 
does not include rapid transit operations in an urban area that are not 
connected to the general railroad system of transportation. See 49 
U.S.C. 20102(1).
    Railroad carrier means a person providing railroad transportation. 
See 49 U.S.C. 20102(2).
    Residue means the hazardous material remaining in a packaging, 
including a tank car, after its contents have been unloaded to the 
maximum extent practicable and before the packaging is either refilled 
or cleaned of hazardous material and purged to remove any hazardous 
vapors. See 49 CFR 171.8.
    Tourist, scenic, historic, or excursion operation means a railroad 
operation that carries passengers, often using antiquated equipment, 
with the conveyance of the passengers to a particular destination not 
being the principal purpose. Train movements of new passenger equipment 
for demonstration purposes are not tourist, scenic, historic, or 
excursion operations. See 49 CFR 238.5.
    Transit means mass transportation by a conveyance that provides 
regular and continuing general or special transportation to the public, 
but does not include school bus, charter, or sightseeing 
transportation. See 49 U.S.C 5302(a). Transit may occur on or off the 
general railroad system of transportation. For purposes of this part, 
the term ``transit'' excludes buses and commuter passenger train 
service.
    Transportation or transport means the movement of property 
including loading, unloading, and storage. Transportation or transport 
also includes the movement of people,

[[Page 72175]]

boarding, and disembarking incident to that movement.


Sec.  1580.5  Inspection authority.

    (a) This section applies to the following:
    (1) Each freight railroad carrier that operates rolling equipment 
on track that is part of the general railroad system of transportation.
    (2) Each rail hazardous materials shipper.
    (3) Each rail hazardous materials receiver located within an HTUA.
    (4) Each passenger railroad carrier, including each carrier 
operating light rail or heavy rail transit service on track that is 
part of the general railroad system of transportation, each carrier 
operating or providing intercity passenger train service or commuter or 
other short-haul railroad passenger service in a metropolitan or 
suburban area (as described by 49 U.S.C. 20102), and each public 
authority operating passenger train service.
    (5) Each passenger or freight railroad carrier hosting an operation 
described in paragraph (a)(4) of this section.
    (6) Each tourist, scenic, historic, and excursion rail operator, 
whether operating on or off the general railroad system of 
transportation.
    (7) Each operator of private cars, including business/office cars 
and circus trains, on or connected to the general railroad system of 
transportation.
    (8) Each operator of a rail transit system that is not operating on 
track that is part of the general railroad system of transportation, 
including heavy rail transit, light rail transit, automated guideway, 
cable car, inclined plane, funicular, and monorail systems.
    (b) The persons described in paragraph (a) of this section must 
allow TSA and other authorized DHS officials, at any time and in a 
reasonable manner, without advance notice, to enter, inspect, and test 
property, facilities, equipment, and operations; and to view, inspect, 
and copy records, as necessary to carry out TSA's security-related 
statutory or regulatory authorities, including its authority to--
    (1) Assess threats to transportation;
    (2) Enforce security-related regulations, directives, and 
requirements;
    (3) Inspect, maintain, and test the security of facilities, 
equipment, and systems;
    (4) Ensure the adequacy of security measures for the transportation 
of passengers and freight, including hazardous materials;
    (5) Oversee the implementation, and ensure the adequacy, of 
security measures at rail yards, stations, terminals, transportation-
related areas of rail hazardous materials shipper and receiver 
facilities, crew management centers, dispatch centers, 
telecommunication centers, and other transportation facilities and 
infrastructure;
    (6) Review security plans; and
    (7) Carry out such other duties, and exercise such other powers, 
relating to transportation security, as the Assistant Secretary of 
Homeland Security for the TSA considers appropriate, to the extent 
authorized by law.
    (c) TSA and DHS officials working with TSA, may enter, without 
advance notice, and be present within any area or within any conveyance 
without access media or identification media issued or approved by a 
railroad carrier, rail transit system owner or operator, rail hazardous 
materials shipper, or rail hazardous materials receiver in order to 
inspect or test compliance, or perform other such duties as TSA may 
direct.
    (d) TSA inspectors and DHS officials working with TSA will, on 
request, present their credentials for examination, but the credentials 
may not be photocopied or otherwise reproduced.

Subpart B--Freight Rail Including Freight Railroad Carriers, Rail 
Hazardous Materials Shippers, Rail Hazardous Materials Receivers, 
and Private Cars


Sec.  1580.100  Applicability.

    (a) Applicability. The requirements of this subpart apply to:
    (1) Each freight railroad carrier that operates rolling equipment 
on track that is part of the general railroad system of transportation.
    (2) Each rail hazardous materials shipper.
    (3) Each rail hazardous materials receiver located with an HTUA.
    (4) Each freight railroad carrier hosting a passenger operation 
described in Sec.  1580.1(d) of this part.
    (5) Each operator of private cars, including business/office cars 
and circus trains, on or connected to the general railroad system of 
transportation.
    (b) Rail security-sensitive materials. The requirements of this 
subpart apply to:
    (1) A rail car containing more than 2,268 kg (5,000 lbs) of a 
Division 1.1, 1.2, or 1.3 (explosive) material, as defined in 49 CFR 
173.50;
    (2) A tank car containing a material poisonous by inhalation as 
defined in 49 CFR 171.8, including anhydrous ammonia, Division 2.3 
gases poisonous by inhalation as set forth in 49 CFR 173.115(c), and 
Division 6.1 liquids meeting the defining criteria in 49 CFR 
173.132(a)(1)(iii) and assigned to hazard zone A or hazard zone B in 
accordance with 49 CFR 173.133(a), excluding residue quantities of 
these materials; and
    (3) A rail car containing a highway route-controlled quantity of a 
Class 7 (radioactive) material, as defined in 49 CFR 173.403.


Sec.  1580.101  Rail security coordinator.

    (a) Applicability. This section applies to:
    (1) Each freight railroad carrier that operates rolling equipment 
on track that is part of the general railroad system of transportation.
    (2) Each rail hazardous materials shipper.
    (3) Each rail hazardous materials receiver located with an HTUA.
    (4) Each freight railroad carrier hosting the passenger operations 
described in Sec.  1580.1(d) of this part.
    (5) Each operator of private cars, including business/office cars 
and circus trains, on or connected to the general railroad system of 
transportation, when notified by TSA in writing, that a threat exists 
concerning that operation.
    (b) Each person described in paragraph (a) of this section must 
designate and use a primary and at least one alternate Rail Security 
Coordinator (RSC).
    (c) The RSC and alternate(s) must be appointed at the corporate 
level.
    (d) Each freight railroad carrier, rail hazardous materials 
shipper, and rail hazardous materials receiver required to have an RSC 
must provide to TSA the names, title, phone number(s), and e-mail 
address(es) of the RSCs and alternate RSCs, and must notify TSA within 
7 calendar days when any of this information changes.
    (e) Each freight railroad carrier, rail hazardous materials 
shipper, and rail hazardous materials receiver required to have an RSC 
must ensure that at least one RSC:
    (1) Serves as the primary contact for intelligence information and 
security-related activities and communications with TSA. Any individual 
designated as an RSC may perform other duties in addition to those 
described in this section;
    (2) Is available to TSA on a 24-hours a day, 7 days a week basis; 
and
    (3) Coordinates security practices and procedures with appropriate 
law enforcement and emergency response agencies.

[[Page 72176]]

Sec.  1580.103  Location and shipping information for certain rail 
cars.

    (a) Applicability. This section applies to:
    (1) Each freight railroad carrier transporting one or more of the 
categories and quantities of rail security-sensitive materials.
    (2) Each rail hazardous materials shipper.
    (3) Each rail hazardous materials receiver located with an HTUA.
    (b) General requirement. Each person described in paragraph (a) of 
this section must have procedures in place to determine the location 
and shipping information for each rail car under its physical custody 
and control that contains one or more of the categories and quantities 
of rail security-sensitive materials.
    (c) Required information. The location and shipping information 
required in paragraph (b) of this section must include the following:
    (1) The rail car's current location by city, county, and state, 
including, for freight railroad carriers, the railroad milepost, track 
designation, and the time that the rail car's location was determined.
    (2) The rail car's routing, if a freight railroad carrier.
    (3) A list of the total number of rail cars containing the 
materials listed in Sec.  1580.100(b) of this part, broken down by:
    (i) The shipping name prescribed for the material in column 2 of 
the table in 49 CFR 172.101;
    (ii) The hazard class or division number prescribed for the 
material in column 3 of the table in 49 CFR 172.101; and
    (iii) The identification number prescribed for the material in 
column 4 of the table in 49 CFR 172.101.
    (4) Each rail car's initial and number.
    (5) Whether the rail car is in a train, rail yard, siding, rail 
spur, or rail hazardous materials shipper or receiver facility, 
including the name of the rail yard or siding designation.
    (d) Timing-class I freight railroad carriers. Upon request by TSA, 
each Class I freight railroad carrier described in paragraph (a) of 
this section must provide the location and shipping information to TSA 
no later than:
    (1) Five minutes if the request concerns only one rail car; and
    (2) Thirty minutes if the request concerns two or more rail cars.
    (e) Timing-other than class I freight railroad carriers. Upon 
request by TSA, all persons described in paragraph (a) of this section, 
other than Class I freight railroad carriers, must provide the location 
and shipping information to TSA no later than 30 minutes, regardless of 
the number of cars covered by the request.
    (f) Method. All persons described in paragraph (a) of this section 
must provide the requested location and shipping information to TSA by 
one of the following methods:
    (1) Electronic data transmission in spreadsheet format.
    (2) Electronic data transmission in Hyper Text Markup Language 
(HTML) format.
    (3) Electronic data transmission in Extensible Markup Language 
(XML).
    (4) Facsimile transmission of a hard copy spreadsheet in tabular 
format.
    (5) Posting the information to a secure website address approved by 
TSA.
    (6) Another format approved by TSA.
    (g) Telephone number. Each person described in paragraph (a) of 
this section must provide a telephone number for use by TSA to request 
the information required in paragraph (a)(4) of this section.
    (1) The telephone number must be monitored at all times.
    (2) A telephone number that requires a call back (such as an 
answering service, answering machine, or beeper device) does not meet 
the requirements of paragraph (f) of this section.
    (h) Definition. As used in this section, Class I has the meaning 
assigned by regulations of the Surface Transportation Board (STB) (49 
CFR part 1201; General Instructions 1-1).


Sec.  1580.105  Reporting significant security concerns.

    (a) Applicability. This section applies to:
    (1) Each freight railroad carrier that operates rolling equipment 
on track that is part of the general railroad system of transportation.
    (2) Each rail hazardous materials shipper.
    (3) Each rail hazardous materials receiver located with an HTUA.
    (4) Each freight railroad carrier hosting a passenger operation 
described in Sec.  1580.1(d) of this part.
    (5) Each operator of private cars, including business/office cars 
and circus, on or connected to the general railroad system of 
transportation.
    (b) Each person described in paragraph (a) of this section must 
immediately report potential threats and significant security concerns 
to DHS by telephoning the Freedom Center at 703-563-3240 or 1-877-456-
8722.
    (c) Potential threats or significant security concerns encompass 
incidents, suspicious activities, and threat information including, but 
not limited to, the following:
    (1) Interference with the train crew.
    (2) Bomb threats, specific and non-specific.
    (3) Reports or discovery of suspicious items that result in the 
disruption of railroad operations.
    (4) Suspicious activity occurring onboard a train or inside the 
facility of a freight railroad carrier, rail hazardous materials 
shipper, or rail hazardous materials receiver that results in a 
disruption of operations.
    (5) Suspicious activity observed at or around rail cars, 
facilities, or infrastructure used in the operation of the railroad, 
rail hazardous materials shipper, or rail hazardous materials receiver.
    (6) Discharge, discovery, or seizure of a firearm or other deadly 
weapon on a train, in a station, terminal, facility, or storage yard, 
or other location used in the operation of the railroad, rail hazardous 
materials shipper, or rail hazardous materials receiver.
    (7) Indications of tampering with rail cars.
    (8) Information relating to the possible surveillance of a train or 
facility, storage yard, or other location used in the operation of the 
railroad, rail hazardous materials shipper, or rail hazardous materials 
receiver.
    (9) Correspondence received by the freight railroad carrier, rail 
hazardous materials shipper, or rail hazardous materials receiver 
indicating a potential threat. Other incidents involving breaches of 
the security of the freight railroad carrier, rail hazardous materials 
shipper, or rail hazardous materials receiver's operations or 
facilities.
    (d) Information reported should include, as available and 
applicable:
    (1) The name of the reporting freight railroad carrier, rail 
hazardous materials shipper, or rail hazardous materials receiver and 
contact information, including a telephone number or e-mail address.
    (2) The affected train, station, terminal, rail hazardous materials 
facility, or other rail facility or infrastructure.
    (3) Identifying information on the affected train, train line, and 
route.
    (4) Origination and termination locations for the affected train, 
including departure and destination city and the rail line and route, 
as applicable.
    (5) Current location of the affected train.
    (6) Description of the threat, incident, or activity.
    (7) The names and other available biographical data of individuals 
involved in the threat, incident, or activity.

[[Page 72177]]

    (8) The source of any threat information.


Sec.  1580.107  Chain of custody and control requirements.

    (a) Within or outside of an HTUA, rail hazardous materials shipper 
transferring to carrier. Except as provided in paragraph (e) of this 
section, at each location within or outside of an HTUA, a rail 
hazardous materials shipper transferring custody of a rail car 
containing one or more of the categories and quantities of rail 
security-sensitive materials to a freight railroad carrier must:
    (1) Physically inspect the rail car before loading for signs of 
tampering, including closures and seals; other signs that the security 
of the car may have been compromised; suspicious items or items that do 
not belong, including the presence of an improvised explosive device.
    (2) Keep the rail car in a rail secure area from the time the 
security inspection required by paragraph (a)(1) of this section or by 
49 CFR 173.31(d), whichever occurs first, until the freight railroad 
carrier takes physical custody of the rail car.
    (3) Document the transfer of custody to the railroad carrier in 
writing or electronically.
    (b) Within or outside of an HTUA, carrier receiving from a rail 
hazardous materials shipper. At each location within or outside of an 
HTUA where a freight railroad carrier receives from a rail hazardous 
materials shipper custody of a rail car containing one or more of the 
categories and quantities of rail security-sensitive materials, the 
freight railroad carrier must document the transfer in writing or 
electronically and perform the required security inspection in 
accordance with 49 CFR 174.9.
    (c) Within an HTUA, carrier transferring to carrier. Within an 
HTUA, whenever a freight railroad carrier transfers a rail car 
containing one or more of the categories and quantities of rail 
security-sensitive materials to another freight railroad carrier, each 
freight railroad carrier must adopt and carry out procedures to ensure 
that the rail car is not left unattended at any time during the 
physical transfer of custody. These procedures must include the 
receiving freight railroad carrier performing the required security 
inspection in accordance with 49 CFR 174.9. Both the transferring and 
the receiving railroad carrier must document the transfer of custody in 
writing or electronically.
    (d) Outside of an HTUA, carrier transferring to carrier. Outside an 
HTUA, whenever a freight railroad carrier transfers a rail car 
containing one or more of the categories and quantities of rail 
security-sensitive materials to another freight railroad carrier, and 
the rail car containing this hazardous material may subsequently enter 
an HTUA, each freight railroad carrier must adopt and carry out 
procedures to ensure that the rail car is not left unattended at any 
time during the physical transfer of custody. These procedures must 
include the receiving railroad carrier performing the required security 
inspection in accordance with 49 CFR 174.9. Both the transferring and 
the receiving railroad carrier must document the transfer of custody in 
writing or electronically.
    (e) Within an HTUA, carrier transferring to rail hazardous 
materials receiver. A freight railroad carrier delivering a rail car 
containing one or more of the categories and quantities of rail 
security-sensitive materials to a rail hazardous materials receiver 
located within an HTUA must not leave the rail car unattended in a non-
secure area until the rail hazardous materials receiver accepts custody 
of the rail car. Both the railroad carrier and the rail hazardous 
materials receiver must document the transfer of custody in writing or 
electronically.
    (f) Within an HTUA, rail hazardous materials receiver receiving 
from carrier. Except as provided in paragraph (j) of this section, a 
rail hazardous materials receiver located within an HTUA that receives 
a rail car containing one or more of the categories and quantities of 
rail security-sensitive materials from a freight railroad carrier must:
    (1) Ensure that the rail hazardous materials receiver or railroad 
carrier maintains positive control of the rail car during the physical 
transfer of custody of the rail car.
    (2) Keep the rail car in a rail secure area until the car is 
unloaded.
    (3) Document the transfer of custody from the railroad carrier in 
writing or electronically.
    (g) Within or outside of an HTUA, rail hazardous materials receiver 
rejecting car. This section does not apply to a rail hazardous 
materials receiver that does not routinely offer, prepare, or load for 
transportation by rail one or more of the categories and quantities of 
rail security-sensitive materials. If such a receiver rejects and 
returns a rail car containing one or more of the categories and 
quantities of rail security-sensitive materials to the originating 
offeror or shipper, the requirements of this section do not apply to 
the receiver. The requirements of this section do apply to any railroad 
carrier to which the receiver transfers custody of the rail car.
    (h) Document retention. Covered entities must maintain the 
documents required under this section for at least 60 calendar days and 
make them available to TSA upon request.
    (i) Rail secure area. The rail hazardous materials shipper and the 
rail hazardous materials receiver must use physical security measures 
to ensure that no unauthorized person gains access to the rail secure 
area.
    (j) Exemption for rail hazardous materials receivers. A rail 
hazardous materials receiver located within an HTUA may request from 
TSA an exemption from some or all of the requirements of this section 
if the receiver demonstrates that the potential risk from its 
activities is insufficient to warrant compliance with this section. TSA 
will consider all relevant circumstances, including--
    (1) The amounts and types of all hazardous materials received.
    (2) The geography of the area surrounding the receiver's facility.
    (3) Proximity to entities that may be attractive targets, including 
other businesses, housing, schools, and hospitals.
    (4) Any information regarding threats to the facility.
    (5) Other circumstances that indicate the potential risk of the 
receiver's facility does not warrant compliance with this section.
    (k) Terms used in this section. (1) As used in this section, a rail 
car is attended if an employee or authorized representative:
    (i) Is physically located on site in reasonable proximity to the 
rail car;
    (ii) Is capable of promptly responding to unauthorized access or 
activity at or near the rail car, including immediately contacting law 
enforcement or other authorities; and
    (iii) Immediately responds to any unauthorized access or activity 
at or near the rail car either personally or by contacting law 
enforcement or other authorities.
    (2) As used in this section, maintains positive control means that 
the rail hazardous materials receiver and the railroad carrier 
communicate and cooperate with each other to provide for the security 
of the rail car during the physical transfer of custody. Attending the 
rail car is a component part of maintaining positive control.
    (3) As used in this section, document the transfer means 
documentation uniquely identifying that the rail car was attended 
during the transfer of custody, including:
    (i) Car initial and number.

[[Page 72178]]

    (ii) Identification of individuals who attended the transfer (names 
or uniquely identifying employee number).
    (iii) Location of transfer.
    (iv) Date and time the transfer was completed.


Sec.  1580.109  Preemptive effect.

    Under 49 U.S.C. 20106, issuance of the regulations in this part 
preempts any State law, regulation, or order covering the same subject 
matter, except an additional or more stringent law, regulation, or 
order that is necessary to eliminate or reduce an essentially local 
security hazard; that is not incompatible with a law, regulation, or 
order of the United States Government; and that does not unreasonably 
burden interstate commerce. For example, under 49 U.S.C. 20106, 
issuance of Sec.  1580.107 of this subpart preempts any State or tribal 
law, rule, regulation, order or common law requirement covering the 
same subject matter.


Sec.  1580.111  Harmonization of federal regulation of nuclear 
facilities.

    TSA will coordinate activities under this subpart with the Nuclear 
Regulatory Commission (NRC) and the Department of Energy (DOE) with 
respect to regulation of rail hazardous materials shippers and 
receivers that are also licensed or regulated by the NRC or DOE under 
the Atomic Energy Act of 1954, as amended, to maintain consistency with 
the requirements imposed by the NRC and DOE.

Subpart C--Passenger Rail Including Passenger Railroad Carriers, 
Rail Transit Systems, Tourist, Scenic, Historic and Excursion 
Operators, and Private Cars


Sec.  1580.200  Applicability.

    This subpart includes requirements for:
    (a) Each passenger railroad carrier, including each carrier 
operating light rail or heavy rail transit service on track that is 
part of the general railroad system of transportation, each carrier 
operating or providing intercity passenger train service or commuter or 
other short-haul railroad passenger service in a metropolitan or 
suburban area (as described by 49 U.S.C. 20102), and each public 
authority operating passenger train service.
    (b) Each passenger railroad carrier hosting an operation described 
in paragraph (a) of this section.
    (c) Each tourist, scenic, historic, and excursion rail operator, 
whether operating on or off the general railroad system of 
transportation.
    (d) Each operator of private cars, including business/office cars 
and circus trains, on or connected to the general railroad system of 
transportation.
    (e) Each operator of a rail transit system that is not operating on 
track that is part of the general railroad system of transportation, 
including heavy rail transit, light rail transit, automated guideway, 
cable car, inclined plane, funicular, and monorail systems.


Sec.  1580.201  Rail security coordinator.

    (a) Applicability. This section applies to:
    (1) Each passenger railroad carrier, including each carrier 
operating light rail or heavy rail transit service on track that is 
part of the general railroad system of transportation, each carrier 
operating or providing intercity passenger train service or commuter or 
other short-haul railroad passenger service in a metropolitan or 
suburban area (as described by 49 U.S.C. 20102), and each public 
authority operating passenger train service.
    (2) Each passenger railroad carrier hosting an operation described 
in paragraph (a)(1) of this section.
    (3) Each operator of a rail transit system that is not operating on 
track that is part of the general railroad system of transportation, 
including heavy rail transit, light rail transit, automated guideway, 
cable car, inclined plane, funicular, and monorail systems.
    (4) Each operator of private cars, including business/office cars 
and circus trains, on or connected to the general railroad system of 
transportation, when notified by TSA, in writing, that a security 
threat exists concerning that operation.
    (5) Each tourist, scenic, historic, or excursion operations, 
whether on or off the general railroad system of transportation, when 
notified by TSA, in writing, that a security threat exists concerning 
that operation.
    (b) Each person described in paragraph (a) of this section must 
designate and use a primary and at least one alternate RSC.
    (c) The RSC and alternate(s) must be appointed at the corporate 
level.
    (d) Each passenger railroad carrier and rail transit system 
required to have an RSC must provide to TSA the names, titles, phone 
number(s), and e-mail address(es) of the RSCs, and alternate RSCs, and 
must notify TSA within 7 calendar days when any of this information 
changes.
    (e) Each passenger railroad carrier and rail transit system 
required to have an RSC must ensure that at least one RSC:
    (1) Serves as the primary contact for intelligence information and 
security-related activities and communications with TSA. Any individual 
designated as an RSC may perform other duties in addition to those 
described in this section.
    (2) Is available to TSA on a 24-hours a day, 7 days a week basis.
    (3) Coordinate security practices and procedures with appropriate 
law enforcement and emergency response agencies.


Sec.  1580.203  Reporting significant security concerns.

    (a) Applicability. This section applies to:
    (1) Each passenger railroad carrier, including each carrier 
operating light rail or heavy rail transit service on track that is 
part of the general railroad system of transportation, each carrier 
operating or providing intercity passenger train service or commuter or 
other short-haul railroad passenger service in a metropolitan or 
suburban area (as described by 49 U.S.C. 20102), and each public 
authority operating passenger train service.
    (2) Each passenger railroad carrier hosting an operation described 
in paragraph (a)(1) of this section.
    (3) Each tourist, scenic, historic, and excursion rail operator, 
whether operating on or off the general railroad system of 
transportation.
    (4) Each operator of private cars, including business/office cars 
and circus trains, on or connected to the general railroad system of 
transportation.
    (5) Each operator of a rail transit system that is not operating on 
track that is part of the general railroad system of transportation, 
including heavy rail transit, light rail transit, automated guideway, 
cable car, inclined plane, funicular, and monorail systems.
    (b) Each person described in paragraph (a) of this section must 
immediately report potential threats or significant security concerns 
to DHS by telephoning the Freedom Center at 703-563-3240 or 1-877-456-
8722.
    (c) Potential threats or significant security concerns encompass 
incidents, suspicious activities, and threat information including, but 
not limited to, the following:
    (1) Interference with the train or transit vehicle crew.
    (2) Bomb threats, specific and non-specific.
    (3) Reports or discovery of suspicious items that result in the 
disruption of rail operations.
    (4) Suspicious activity occurring onboard a train or transit 
vehicle or inside the facility of a passenger railroad carrier or rail 
transit system that results in a disruption of rail operations.

[[Page 72179]]

    (5) Suspicious activity observed at or around rail cars or transit 
vehicles, facilities, or infrastructure used in the operation of the 
passenger railroad carrier or rail transit system.
    (6) Discharge, discovery, or seizure of a firearm or other deadly 
weapon on a train or transit vehicle or in a station, terminal, 
facility, or storage yard, or other location used in the operation of 
the passenger railroad carrier or rail transit system.
    (7) Indications of tampering with passenger rail cars or rail 
transit vehicles.
    (8) Information relating to the possible surveillance of a 
passenger train or rail transit vehicle or facility, storage yard, or 
other location used in the operation of the passenger railroad carrier 
or rail transit system.
    (9) Correspondence received by the passenger railroad carrier or 
rail transit system indicating a potential threat to rail 
transportation.
    (10) Other incidents involving breaches of the security of the 
passenger railroad carrier or the rail transit system operations or 
facilities.
    (d) Information reported should include, as available and 
applicable:
    (1) The name of the passenger railroad carrier or rail transit 
system and contact information, including a telephone number or e-mail 
address.
    (2) The affected station, terminal, or other facility.
    (3) Identifying information on the affected passenger train or rail 
transit vehicle including number, train or transit line, and route, as 
applicable.
    (4) Origination and termination locations for the affected 
passenger train or rail transit vehicle, including departure and 
destination city and the rail or transit line and route.
    (5) Current location of the affected passenger train or rail 
transit vehicle.
    (6) Description of the threat, incident, or activity.
    (7) The names and other available biographical data of individuals 
involved in the threat, incident, or activity.
    (8) The source of any threat information.

                            Appendix A to Part 1580--High Threat Urban Areas (HTUAs)
----------------------------------------------------------------------------------------------------------------
                                                                                           Previously designated
     State        Candidate urban area      Geographic area captured in the data count     urban areas included
----------------------------------------------------------------------------------------------------------------
AZ............  Phoenix Area *.........  Chandler, Gilbert, Glendale, Mesa, Peoria,       Phoenix, AZ.
                                          Phoenix, Scottsdale, Tempe, and a 10-mile
                                          buffer extending from the border of the
                                          combined area.
CA............  Anaheim/Santa Ana Area.  Anaheim, Costa Mesa, Garden Grove, Fullerton,    Anaheim, CA; Santa
                                          Huntington Beach, Irvine, Orange, Santa Ana,     Ana, CA.
                                          and a 10-mile buffer extending from the border
                                          of the combined area.
                Bay Area...............  Berkeley, Daly City, Fremont, Hayward, Oakland,  San Francisco, CA; San
                                          Palo Alto, Richmond, San Francisco, San Jose,    Jose, CA; Oakland,
                                          Santa Clara, Sunnyvale, Vallejo, and a 10-mile   CA.
                                          buffer extending from the border of the
                                          combined area.
                Los Angeles/Long Beach   Burbank, Glendale, Inglewood, Long Beach, Los    Los Angeles, CA; Long
                 Area.                    Angeles, Pasadena, Santa Monica, Santa           Beach, CA.
                                          Clarita, Torrance, Simi Valley, Thousand Oaks,
                                          and a 10-mile buffer extending from the border
                                          of the combined area.
                Sacramento Area *......  Elk Grove, Sacramento, and a 10-mile buffer      Sacramento, CA.
                                          extending from the border of the combined area.
                San Diego Area *.......  Chula Vista, Escondido, and San Diego, and a 10- San Diego, CA.
                                          mile buffer extending from the border of the
                                          combined area.
CO............  Denver Area............  Arvada, Aurora, Denver, Lakewood, Westminster,   Denver, CO.
                                          Thornton, and a 10-mile buffer extending from
                                          the border of the combined area.
DC............  National Capital Region  National Capital Region and a 10-mile buffer     National Capital
                                          extending from the border of the combined area.  Region, DC.
FL............  Fort Lauderdale Area...  Fort Lauderdale, Hollywood, Miami Gardens,       N/A.
                                          Miramar, Pembroke Pines, and a 10-mile buffer
                                          extending from the border of the combined area.
                Jacksonville Area......  Jacksonville and a 10-mile buffer extending      Jacksonville, FL.
                                          from the city border.
                Miami Area.............  Hialeah, Miami, and a 10-mile buffer extending   Miami, FL.
                                          from the border of the combined area.
                Orlando Area...........  Orlando and a 10-mile buffer extending from the  Orlando, FL.
                                          city border.
                Tampa Area *...........  Clearwater, St. Petersburg, Tampa, and a 10-     Tampa, FL.
                                          mile buffer extending from the border of the
                                          combined area.
GA............  Atlanta Area...........  Atlanta and a 10-mile buffer extending from the  Atlanta, GA.
                                          city border.
HI............  Honolulu Area..........  Honolulu and a 10-mile buffer extending from     Honolulu, HI.
                                          the city border.
IL............  Chicago Area...........  Chicago and a 10-mile buffer extending from the  Chicago, IL.
                                          city border.
IN............  Indianapolis Area......  Indianapolis and a 10-mile buffer extending      Indianapolis, IN.
                                          from the city border.
KY............  Louisville Area *......  Louisville and a 10-mile buffer extending from   Louisville, KY.
                                          the city border.
LA............  Baton Rouge Area *.....  Baton Rouge and a 10-mile buffer extending from  Baton Rouge, LA.
                                          the city border.
                New Orleans Area.......  New Orleans and a 10-mile buffer extending from  New Orleans, LA.
                                          the city border.
MA............  Boston Area............  Boston, Cambridge, and a 10-mile buffer          Boston, MA.
                                          extending from the border of the combined area.
MD............  Baltimore Area.........  Baltimore and a 10-mile buffer extending from    Baltimore, MD.
                                          the city border.
MI............  Detroit Area...........  Detroit, Sterling Heights, Warren, and a 10-     Detroit, MI.
                                          mile buffer extending from the border of the
                                          combined area.
MN............  Twin Cities Area.......  Minneapolis, St. Paul, and a 10-mile buffer      Minneapolis, MN; St.
                                          extending from the border of the combined        Paul, MN.
                                          entity.
MO............  Kansas City Area.......  Independence, Kansas City (MO), Kansas City      Kansas City, MO.
                                          (KS), Olathe, Overland Park, and a 10-mile
                                          buffer extending from the border of the
                                          combined area.
                St. Louis Area.........  St. Louis and a 10-mile buffer extending from    St. Louis, MO.
                                          the city border.
NC............  Charlotte Area.........  Charlotte and a 10-mile buffer extending from    Charlotte, NC.
                                          the city border.
NE............  Omaha Area *...........  Omaha and a 10-mile buffer extending from the    Omaha, NE.
                                          city border.
NJ............  Jersey City/Newark Area  Elizabeth, Jersey City, Newark, and a 10-mile    Jersey City, NJ;
                                          buffer extending from the border of the          Newark, NJ.
                                          combined area.
NV............  Las Vegas Area *.......  Las Vegas, North Las Vegas, and a 10-mile        Las Vegas, NV.
                                          buffer extending from the border of the
                                          combined entity.
NY............  Buffalo Area *.........  Buffalo and a 10-mile buffer extending from the  Buffalo, NY.
                                          city border.

[[Page 72180]]

 
                New York City Area.....  New York City, Yonkers, and a 10-mile buffer     New York, NY.
                                          extending from the border of the combined area.
OH............  Cincinnati Area........  Cincinnati and a 10-mile buffer extending from   Cincinnati, OH.
                                          the city border.
                Cleveland Area.........  Cleveland and a 10-mile buffer extending from    Cleveland, OH.
                                          the city border.
                Columbus Area..........  Columbus and a 10-mile buffer extending from     Columbus, OH.
                                          the city border.
                Toledo Area *..........  Oregon, Toledo, and a 10-mile buffer extending   Toledo, OH.
                                          from the border of the combined area.
OK............  Oklahoma City Area *...  Norman, Oklahoma and a 10-mile buffer extending  Oklahoma City, OK.
                                          from the border of the combined area.
OR............  Portland Area..........  Portland, Vancouver, and a 10-mile buffer        Portland, OR.
                                          extending from the border of the combined area.
PA............  Philadelphia Area......  Philadelphia and a 10-mile buffer extending      Philadelphia, PA.
                                          from the city border.
                Pittsburgh Area........  Pittsburgh and a 10-mile buffer extending from   Pittsburgh, PA.
                                          the city border.
TN............  Memphis Area...........  Memphis and a 10-mile buffer extending from the  Memphis, TN.
                                          city border.
TX............  Dallas/Fort Worth/       Arlington, Carrollton, Dallas, Fort Worth,       Dallas, TX; Fort
                 Arlington Area.          Garland, Grand Prairie, Irving, Mesquite,        Worth, TX; Arlington,
                                          Plano, and a 10-mile buffer extending from the   TX.
                                          border of the combined area.
                Houston Area...........  Houston, Pasadena, and a 10-mile buffer          Houston, TX.
                                          extending from the border of the combined
                                          entity.
                San Antonio Area.......  San Antonio and a 10-mile buffer extending from  San Antonio, TX.
                                          the city border.
WA............  Seattle Area...........  Seattle, Bellevue, and a 10-mile buffer          Seattle, WA.
                                          extending from the border of the combined area.
WI............  Milwaukee Area.........  Milwaukee and a 10-mile buffer extending from    Milwaukee, WI.
                                          the city border.
----------------------------------------------------------------------------------------------------------------
* FY05 Urban Areas eligible for sustainment funding through the FY06 Urban Areas Security Initiative (UASI)
  program; any Urban Area not identified as eligible through the risk analysis process for two consecutive years
  will not be eligible for continued funding under the UASI program.


                                           Appendix B to Part 1580--Summary of the Applicability of Part 1580
                                             [This is a summary--see body of text for complete requirements]
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                         Freight      Rail operations
                                                        Freight          railroad        at certain    Rail operations                    Certain other
                                                        railroad         carriers     facilities that     at certain       Passenger     rail operations
                                                      carriers NOT     transporting     ship (i.e.,    facilities that      railroad        (private,
         Security measure and rule section            transporting      specified     offer, prepare,     receive or      carriers and      business/
                                                       specified        hazardous       or load for         unload        rail transit   office, circus,
                                                       hazardous     materials (Sec.  transportation)     hazardous         systems          tourist,
                                                       materials        1580.100(b))     hazardous        materials                         historic,
                                                                                         materials     within  an HTUA                      excursion)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Allow TSA to inspect (Sec.   1580.5)..............               X                X                X                X                X                X
Appoint rail security coordinator (Sec.   1580.101               X                X                X                X                X            (\1\)
 freight; Sec.   1580.201 passenger)..............
Report significant security concerns (Sec.                       X                X                X                X                X                X
 1580.105 freight; Sec.   1580.203 passenger).....
Provide location and shipping information for rail  ...............               X                X                X   ...............  ...............
 cars containing specified hazardous materials if
 requested (Sec.   1580.103)......................
Chain of custody and control requirements for       ...............               X                X                X   ...............  ...............
 transport of specified hazardous materials that
 are or may be in HTUA (Sec.   1580.107)..........
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ Only if notified in writing that a security threat exists.


    Issued in Arlington, Virginia, on November 11, 2008.
Kip Hawley,
Assistant Secretary.
[FR Doc. E8-27287 Filed 11-25-08; 8:45 am]
BILLING CODE 9110-05-P