APTA: Federal Transit Administration

National Transit Response Model Homeland Security Presidential Directive #3

FTA Policy Statement

The Federal Transit Administration (FTA) supports the initiatives of the Office of Homeland Security (OHS) and (1) shall define a plan to guide U.S. transit industry response to the OHS Homeland Security Advisory System (HSAS) and (2) provide technical guidance to the U.S. transit industry to assist in implementing this plan.

Introduction and Background

The Federal Transit Administration (FTA), in response to the Office of Homeland Security (OHS), has defined the following plan to guide transit response to the HSAS as defined in Homeland Security Presidential Directive #3. This plan addresses the need to establish a consistent and coordinated transit response to potential threats in order to protect transit passengers, employees, and infrastructure, and to support community emergency response efforts. Further, this plan is compatible with the following attributes of contemporary transit operations.

Transit relies on an inherently open architecture, allowing free movement of passengers in public facilities and vehicles. This freedom of movement must be maintained to permit transit to perform its basic functions.

Transit is geographically widespread, often operating on public infrastructure where transit management has no direct authority to implement protective measures. Thus, transit is dependent on the jurisdictions in which it operates, requiring important interagency cooperation to ensure protection.

There is great diversity in how police and security forces are provided and deployed across the broad expanse of the Nation’s transit systems. There is no national mandate to standardize this facet of transit operations and security force policies will remain a local agency decision.

Transit functions include substantial differences in equipment, infrastructure, operations and security practices from agency to agency. While this plan provides general guidance for response to individual threat conditions, the details of specific implementation vary substantially throughout these agencies.

Transit systems are routinely under surveillance by their operating staff (e.g., drivers, supervisors, station attendants, and controllers), security employees, and, with increasing frequency, transit passengers. This normal level of vigilance, supplemented by appropriate awareness training and the protective measures identified under threat condition green, may be sufficient vigilance for some systems.

The FTA and transit industry organizations have been providing technical guidance on transit security to the transit industry for many years. In fact, the State Safety Oversight Rule (49 CFR Part 659) places specific transit security requirements, including system security plans, on agencies that operate fixed guideway transit systems. The current FTA Model Transit Bus Safety and Security Program is developing security and emergency response guidance for the transit bus industry. Thus, within some segments of the transit industry, response priorities already exist that may be compatible with the published HSAS response structure. The FTA National Transit Response Model incorporates these preexisting response priorities.

FTA Response Posture

The FTA has adopted and extended for the transit industry the threat and response guidance defined in Homeland Security Presidential Directive #3. The general FTA response posture shall be as follows.

Threat Condition	FTA Response Posture
Green (Low)	Prepare
Blue (Guarded)	Practice
Yellow (Elevated)	Standby
Orange (High)	Activate
Red (Severe)	Stand Ready

The FTA response model supplements the existing HSAS model with Black and Purple designations to further define appropriate transit industry activities when an event is in progress and during the post-event recovery of transit services and facilities.

Event Description	FTA Response Posture
Black (Attack)	Response
Purple (Recovery)	Recovery

The Black and Purple designations are interpreted as follows.

Black indicates that an attack is underway against a specific transit agency or within the agency’s immediate geographic area. The Black state is entered only when an attack has occurred. Black includes the immediate post-attack time period when the transit agency may be responding to casualties, assisting in evacuations, inspecting and securing transit facilities, or helping with other tasks directed by the local emergency management authority.

Purple indicates the recovery of transit service after an attack has occurred. Purple includes restoration of levels of service, routes, and schedules, repairing or reopening facilities, adjustment of staff work schedules and duty assignments, responding to customer inquiries about services, and other activities necessary to restore transit service. The Purple state follows the Black state and may also exist for short time periods when the agency is transitioning from a higher threat condition to a lower threat condition (e.g., from Red to Orange). The Purple state will coexist with the prevailing threat condition. In other words, business recovery (Purple) will be accomplished while maintaining the prevailing readiness status (e.g., Orange protective measures).

Threat Information

Threat information shall be provided to the transit agencies to assist them in implementing protective measures for the appropriate threat condition. Guidance related to establishing the threat condition originates from the Attorney General in consultation with the Office of Homeland Security. Threat information and guidance will be transmitted to the U. S. Department of Transportation, Transportation Security Administration, and the Federal Transit Administration for dissemination to other transit agencies.

Threat information may be provided with national, regional, or local guidance, or guidance may be directed to specific transit modes or other factors depending upon the specificity of the threat information. Transit response posture may vary depending on the nature of the guidance. For example, threat guidance focused on the northeastern region may dictate that transit agencies in that region maintain a higher response posture than other regions of the country. If the guidance is modal-based, for example a threat to subways and transit agencies with subway modes may maintain a higher response posture than agencies without subways. In fact, large multi-modal transit agencies may operate their different modes with different response postures.

Individual transit agencies may also receive threat information and guidance from their local emergency management organizations, a joint terrorism task force, a police agency, or other sources. The transit agency is responsible for determining the appropriate response posture based on an assessment of the guidance received from all sources and the response posture of the communities where the agency provides service.

FTA Response Activities

The FTA has a responsibility to assist the transit industry in the mission of homeland security and shall support the transit mission through a series of activities appropriate to the prevailing response posture. These actions may be administered and coordinated through the FTA Administrator’s Office (HQ), the FTA Office of Safety and Security (OSS), or the FTA Regional Offices (RO). The FTA will review its programs and activities from time to time to maintain the currency and relevancy of these programs with respect to the homeland security mission.

The FTA response posture follows the general guidance below.

The threat/risk goes up with each successive level.
Responses are additive; each level incorporates all activities from the previous levels.
Threat information may be general or indicated for different geographical regions of the country, metro areas, cities, transit agencies, industries, facility types (e.g., subway, tunnel, bus, control center, etc.), or for a specific facility.
Protective measures are suggested or recommended actions, not requirements. Specific implementation must be determined by the agency in light of actual events.

The FTA response posture treats the FTA activities and transit protective measures for Green and Blue threat conditions as a single set of activities. This factor results from the basic level of preparedness activities reflected in current FTA technical guidance to the transit industry according to the State Safety Oversight Rule (49 CFR Part 659) and transit industry initiatives. The FTA’s intent is that the lowest response posture for the transit industry shall be a combination of Green and Blue protective measures due to the responsibility to protect transit passengers, employees, and infrastructure in transit’s inherently open and diverse architecture.

The following table outlines the general FTA activities in response to HSAS threat conditions.

HSAS Threat Condition	FTA Activities
Green (Low)	FTA OSS provides technical guidance for security and emergency response planning. FTA OSS plans and prepares security, emergency response, and other appropriate training materials. FTA HQ and RO communicate threat information to transit agencies on a regular basis. FTA HQ regularly reviews transit agency compliance with FTA requirements (e.g., triennial reviews). FTA OSS sponsors training courses for the transit industry delivered via TSI, NTI, or other sources. FTA OSS sponsors a voluntary security review program, available to transit agencies upon request.
Blue (Guarded)	FTA HQ and OSS provide security and emergency management technical assistance teams to transit agencies. FTA HQ & OSS organize and provide community forums to support coordinated planning efforts between the transit agency and local emergency response agencies. FTA HQ and OSS conduct periodic drills to update plans. FTA HQ updates secure website on current threat intelligence.
Yellow (Elevated)	FTA HQ and OSS perform independent security readiness assessments and threat and vulnerability assessments. FTA HQ and RO increase communications to transit agencies to update threat information and response guidance. FTA OSS and RO provide recommendations to transit agencies to test communications equipment and procedures.
Orange (High)	FTA HQ assigns staff liaison to DOT Operations Center to facilitate frequent communication with FTA Regional Offices and transit agencies. FTA RO assigns staff liaison to local/regional Emergency Management Center to facilitate communications with transit agencies and local response organizations. FTA HQ manages national media inquiries and issues press releases on transit states of readiness. FTA RO manages local/regional media inquiries, assists local transit agencies with media relations, and issues press releases on transit states of readiness.
Red (Severe)	FTA HQ assigns staff to DOT Operations Center to facilitate 24/7 communications with FTA Regional Offices and transit agencies. FTA RO assigns staff to local/regional Emergency Management Center to facilitate 24/7 communications with transit agencies and local response organizations. FTA HQ manages media inquiries and issues press releases on transit states of readiness with increased frequency. FTA RO manages local/regional media inquiries, assists local transit agencies with media relations, and issues press releases on transit states of readiness with increased frequency.

The FTA, as well as the transit industry, must be prepared to respond to specific events and the aftermath of those events. FTA must be prepared to participate in the recovery process as the transit industry moves to a recovery state after an attack. The following table outlines the general FTA activities in response to an event and the post-event recovery process.

Event Description

FTA Activities

Black (Attack)

FTA HQ implements FTA Incident Response Plan and COOP.
FTA HQ rapidly assists in the dissemination of updated threat information and response guidance to transit agencies outside the attack area.
FTA HQ and RO coordinate transit attack response activities with other Federal agencies.
FTA HQ, RO, OSS stand ready to provide assistance in coordinating transit response efforts in the attack area, including arranging loans of needed equipment from neighboring transit agencies.
FTA HQ provides public information guidance to transit agencies.

Purple (Recovery)

FTA HQ requests special grant funding to restore the transit facilities damaged during the attack.
FTA HQ assigns staff to the affected transit agency and/or Regional Office to facilitate grant assistance, PMO oversight, and other issues during recovery effort.
FTA HQ and RO provide assistance in coordinating "mutual assistance" shared resources (transit vehicles, managers, fuel, etc.) from neighboring transit agencies.
FTA OSS provides assistance in preparing "after action" reports to identify lessons learned for future dissemination to the transit industry.

FTA Homeland Security National Transit Response Model

General Guidance

The following Table 1 outlines the FTA National Transit Response Model in comparison with the direction provided by the OHS Presidential Directive #3. The response posture follows the general guidance that the threat/risk goes up with each successive condition and responses are additive; each level incorporates all activities from the previous levels. The protective measures identified in the table are suggested or recommended actions, not requirements. Specific implementation must be determined by the agency in light of actual events. Table 2 provides proposed transit response activities during an actual event and the post-event recovery process.

Table 3 provides definitions of different transit Protective Measures and a suggested relationship to different threat conditions. A characteristic of this table is that the transit protective measures for the Green and Blue threat conditions are identical. As described above, this "protective measures" definition reflects the FTA’s intent that the lowest response posture for the transit industry shall be a combination of Green and Blue protective measures.

Table 1. Homeland Security Threat Conditions and Response Levels
Threat Condition	Homeland Security Advisory System (HSAS)	Proposed Transit Response Posture
Green (Low) – This condition is declared when there is a low risk of terrorist attacks.	Refining and exercising as appropriate preplanned Protective Measures. Ensuring personnel receive proper training on the HSAS and specific preplanned department or agency Protective Measures. Institutionalizing a process to assure that all facilities and regulated sectors are regularly assessed for vulnerabilities to terrorist attacks, and all reasonable measures are taken to mitigate these vulnerabilities.	PREPARE Identify and assess threats and vulnerabilities. Plan response strategies, complete formal system security and emergency operations plans. Organize response organization roles and duties, including internal, external, and outside agencies. Train transit employees on response plans and priorities, including individual roles. Gather, collect and analyze intelligence information to substantiate and establish threat conditions. Purchase/invest in security infrastructure for those items needed in Blue and above. Test levels of preparedness through drills.
Blue (Guarded) – This condition is declared when there is a general risk of terrorist attacks.	Increasing surveillance of critical locations. Reviewing and updating emergency response procedures. Providing the public with any information that would strengthen its ability to act appropriately.	PRACTICE Implement procedures and plans throughout the organization. Practice using drills and exercises, including the use of outside responders. Communicate with passengers, educate them regarding security tips and proper behavior. Review and reevaluate response procedures based on practice results and fill gaps identified.
Yellow (Elevated) – An elevated condition is declared when there is a significant risk of terrorist attacks.	Increasing surveillance of critical locations. Coordinating emergency plans, as appropriate, with nearby jurisdictions. Assessing whether the precise characteristics of the threat require the further refinement of preplanned PMs. Implementing, as appropriate, contingency and emergency response plans.	STANDBY Activate readiness plans, communicate and coordinate with other agencies. Agency and staff placed on alert, on standby for activation, and security staff on call. Alter appearance (e.g., vests) and patrol strategies to disrupt terrorist planning. Collect, analyze, and communicate (i.e., share) intelligence on threats. Increase access control to selective facilities.
Orange (High) – A high condition is declared when there is a high risk of terrorist attacks.	Coordinating necessary security efforts with Federal, State, and local law enforcement agencies or any National Guard or other appropriate armed forces organizations. Taking additional precautions at public events and possibly considering alternative venues or even cancellation. Preparing to execute contingency procedures, such as moving to an alternate site or dispersing the workforce. Restricting threatened facility access to essential personnel only.	ACTIVATE Focused response posture, internal and external communications. Activate response plans, sweep vehicles, and increase patrols. Activate Emergency Operations Center and deploy liaisons to outside agencies. Communicate with federal, state, local authorities; Interpol, National Guard, USCG, and US Military as necessary. Restrict access and implement 100% access control to non-public facilities. Increase facilities inspection including remote facilities. Maximum sustainable security operations.
Red (Severe) – A Severe Condition reflects a severe risk of terrorist attacks.	Under most circumstances, the PMs for a Severe Condition are not intended to be sustained for substantial periods of time Increasing or redirecting personnel to address critical emergency needs. Assigning emergency response personnel and pre-positioning and mobilizing specially trained teams or resources. Monitoring, redirecting, or constraining transportation systems. Closing public and government facilities.	STAND READY Respond to specific threat or event for defined time frame. Personnel management and reassignment. Selectively close facilities. Restrict/redirect transportation assets to reduce vulnerability. Channel passengers and implement maximum screening protocols. Implement plans to assist in evacuations or respond to emergency management requests.

Table 2. Transit Response Activities During an Actual Event and Post-Event Recovery.
Event Description	Proposed Transit Response Activities
Black (Attack) – A terrorist attack has occurred.	ATTACK Activate Immediate Action Drills (IAD) and Emergency Responses to a Terrorist Attack (there are 10 essential IAD’s). Report the attack immediately to all emergency response organizations. Provide for security of the site and other transit system assets during the emergency and be alert to possible secondary attacks. Assist response to any casualties. Activate measures to mitigate the effects of the attack Assess immediately impact of the attack on transit service and facilities and adjust or terminate services as required. Advise FTA and FBI immediately of all information regarding the nature of the attack so that FTA, FBI and others may immediately disseminate that information to other transit properties nationwide. Provide Internal and Public Information as soon as possible. Designate the Incident Commander and Activate Transit Emergency Response (or Operations) Center and/or dispatch representatives to appropriate Emergency Operations Centers. Mobilize and provide transit assets (communications links, equipment, facilities and personnel) in support of the overall incident response effort. Identify Attackers for responders if witnesses and/or surveillance can provide timely and relevant information. Activate "on-call" external contractors or other special support as required.
Purple (Recovery) – Business recovery after an attack.	RECOVERY Activate Business Recovery Plan. Restore Transit System capabilities. Restore the scene of attack to functionality. Guard against secondary attacks. Evaluate why attack succeeded and update Threat and Vulnerability Analysis. Identify and implement corrective measures. Restore public confidence by announcing new measures. Return to an appropriate preventative level of GREEN thru RED. Coordinate funding and other needs for transit system restoration with FTA. Identify short and long-term capital replacement needs and develop plans and detailed designs. Complete an After Action report.

Table 3. Transit Protective Measures and Applicability to Threat Condition
Protective Measure	Definition	Green	Blue	Yellow	Orange	Red
Protective Measure	Definition	Prepare	Practice	Standby	Activate	Stand Ready
Threat & Vulnerability Analysis	A comprehensive study of a transit agency to identify components most vulnerable to criminal activity, including acts of terrorism and quasi-terrorism, and to assess the impact of such activity on passengers, employees, and the agency.				update	update
Planning	Activities that include creating procedures for emergency response, coordination within and outside the agency, etc.				update	update
Training	Activities that include safety and security training of agency and other personnel.
Technical Assistance	Make use of FTA and transit industry guidelines and take advantage of FTA readiness assessment or technical assistance teams.				update	update
Facility Access Control	Identification of personnel and related permission for entrance into various parts of a facility
Vehicle and Facility Sweeps/ Inspections	Inspection of agency vehicles and facilities looking for out-of-place parcels and security breaches.
Security Patrols Security staff Operations staff	Security personnel who walk or ride at facilities looking for anything out-of-place, security breaches, or unusual activities.
Operations Actions	Operations actions may include scheduled reductions, re-routing, canceling, or increasing of service in affected areas.
Public Communications	Communication from the transit agency to the customers on a vehicle, at a station or stop, or other facility. Also includes media relations and communications with the general public.
External Communications	Communication from the transit agency to local, state, or federal agencies.
Personnel Communications, Actions, Deployment	Communication from the transit agency to personnel for emergency and incident actions. This may include recalling personnel to duty in an emergency.
Information Technology Safeguards	Safeguards for computer systems for vehicle operation, dispatching, finances, etc. Damage to these systems could cause significant disruption of service or financial loss.
Emergency Management Control	Activation of emergency management control procedures at one or all facilities at the transit agency.
Drills/Exercises	Drills and exercises include tabletop planning and limited or full practice drills for response to mock emergencies and incidents.
Housekeeping	Standard security activities and tasks completed everyday for safe and secure transit operation.
Mail/Shipping and Receiving	Shipping and receiving activities at each facility including mail services.
	Standard activity in this threat condition.		Activity in higher elevation of threat condition, more restrictions in place.
	Activity in elevated threat condition, some restrictions in place.		Stand ready to respond to incident in progress; major restrictions in place.

Some of these pages may include links to documents in the Adobe PDF format. Please download the Adobe PDF reader if you have not already done so.