Homeland Security Advisory System Increased to Orange for Mass Transit and Passenger Rail

Joint Information Bulletin

5 pages
For Official Use Only
July 7, 2005

ATTENTION:

Federal Departments and Agencies, State Homeland Security Advisors, Security Managers, State and Local Law Enforcement, and Information Sharing and Analysis Centers (ISACs). Secondary release, dissemination or sharing of this product is authorized by Federal Departments and Agencies within their respective departments and agencies, and by State Homeland Security Advisors within their state and local jurisdictions to authorized homeland security partners, that have an official valid need-to-know. Any further release, dissemination or sharing of this product, or any information contained herein, (beyond that indicated above) is not authorized without further approval from the Department of Homeland Security (DHS), Information Analysis and Infrastructure Protection (IAIP) Directorate, Information Analysis – Requirements (IA-R) Division at DHS.IAIP@dhs.gov.

This is a Joint DHS-FBI Advisory.

Based on this notification, the United States Homeland Security Advisory System (HSAS) level for the mass transit and passenger rail systems portion of the transportation sector nationwide is raised from YELLOW – ELEVATED to ORANGE – HIGH. This change only affects regional inter-city commuter and mass transit passenger rail and bus systems. In other transportation systems, increased vigilance is warranted. The U.S. Coast Guard is implementing a targeted Maritime Security Condition 2 to heighten vigilance and security measures on ferries exceeding 150 passengers. CBP is coordinating with Canada to enhance security for cross-border passenger trains and buses. The threat level for the rest of the nation remains at YELLOW – ELEVATED.

OVERVIEW

The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have no specific, credible information suggesting an imminent attack in the United States. The following information is being provided to advise state and local officials and private sector owners and operators of mass transportation systems about the recent bombings on the London public transit system to raise general awareness and provide protective measures recommendations. This attack, along with the horrific rail bombings that took place in Madrid last year, highlights the variety of tactics and methods that are used by terrorist groups. The intent of al-Qaida and affiliated organizations to attack in Europe and the United States has been well documented, and continues to
be reflected in intelligence reporting.

DETAILS

According to initial reports, during the July 7, 2005 morning rush hour in London, England from approximately 8:50 a.m. to 10 a.m. local time, four simultaneous terrorism-related explosions occurred within the city’s public transit system. Most of the explosions occurred within London’s subway system, with at least one confirmed explosion on a passenger bus. According to a London Metropolitan Police statement, London police were responding to reports from at least six subway stations. Casualty counts are beginning to be reported, and will likely continue to rise as emergency personnel continue to respond to the incidents and access previously inaccessible locations. The nature of the devices used to conduct the attacks remains unclear, but preliminary information suggests they were improvised explosive devices. At this time, we have no indication that chemical/biological agents were used in the attacks.

It is currently unclear which specific terrorist group or network conducted the attacks, although we believe Sunni Islamic extremists are likely responsible. At least one Internet site has claimed an apparently al-Qaida-affiliated group, the “Secret Organization Group of al-Qaida of Jihad Organization in Europe,” was responsible. However, at this time there has been no independent corroboration of this claim. If the attacks are related to al-Qaida, we currently do not know if they were planned and directed by senior al-Qaida operational planners, or whether they were conceived and planned at a more decentralized level. The London attacks bear some similarities to the March 2004 attacks in Madrid, when Islamic extremists targeted commuter trains with improvised explosive devices. There is no indication that suicide bombers were employed in the attacks. DHS and FBI have no recent information indicating that attacks similar to the London bombings are planned for the United States. The Madrid attacks highlight the concern of the potential for terrorist groups to target U.S. public transportation systems. Although there are no indicators of operational planning including specific timing, targeting, or operatives, recent intelligence continues to indicate that senior al-Qaida planners have been interested, among other things, in conducting attacks against passenger trains in the United States.

The following indicators may suggest logistical planning for an attack against rail transportation:
• Abandoning potential containers for explosives (e.g., vehicles or suitcases).
• Suspicious or improper attempts to acquire official vehicles, uniforms, badges, access cards, or identification which may be exploited to gain access to public areas or other areas not normally accessible to the general public.
• Suspicious questions regarding rail operations, equipment, and security procedures.
• Individuals observed near rail switches, switch stands, and other restricted areas along railroad tracks.
• The presence of stolen or unauthorized vehicles or vehicles left unattended for extended periods of time near railroad tracks or in train station parking lots.
• Placement of obstructions, such as loose track equipment or debris, on railroad tracks. Law enforcement and security personnel should remain vigilant to potential indicators of preoperational planning and to attempts by individuals to bring improvised explosive or chemical and biological devices on a subway or rail system. Emergency response personnel should also be alert to the possibility of booby-trapped devices set to detonate during disarming attempts and to the possible placement of secondary devices designed to target law enforcement and first responders. Law enforcement personnel are encouraged to make contact with local railroad/transit police or operating personnel when responding to incidents on rail/transit property.

SUGGESTED PROTECTIVE MEASURES

Recommended protective measures for mass transit and passenger rail owners and operators, security managers, and where appropriate, state and local government entities:

• Encourage personnel to be alert and immediately report any situation that appears to constitute a threat or suspicious activity.
• Conduct routine sweeps of common areas (e.g. trash receptacles, newspaper dispensers, planters, or anything that could potentially conceal an IED) to identify unattended packages. Review bomb response and facility evacuation plans.
• Rearrange exterior vehicle barriers, traffic cones.
• Institute/increase visible vehicle, foot, and road blocks to alter traffic patterns near facilities.
• Institute/increase visible vehicle, foot, and roving security patrols varying in size, timing, and routes.
• Ensure information on heightened security measures is communicated to passengers, i.e., via periodic public security announcements or posting of signs large enough to be clearly visible by all transit riders, in stations where practicable or on trains and buses and ask passengers to report unattended property or suspicious behavior to uniformed crew members and/or law enforcement personnel.
• Ensure all appropriate personnel are notified via briefings, email, voice mail, or signage of any changes in threat conditions and protective measures, and reinforce employee watch programs.
• Implement random security guard shift changes.
• Arrange for law enforcement vehicles to be parked near entrances and exits.
• Limit the number of access points and strictly enforce access control procedures.
• If practicable, prohibit vehicles from parking within 300 feet of any station or terminal to reduce the threat posed by vehicle-borne improvised explosive devices (VBIEDs); reconfigure vehicular traffic patterns as necessary.
• Approach all illegally parked vehicles in and around facilities, question drivers, and direct them to move immediately. If an owner cannot be identified, have vehicle towed by law enforcement.
• Increase perimeter lighting.
• Deploy visible security cameras and motion sensors.
• Review reviews of security camera footage daily to detect for possible indicators of preoperational surveillance.
• Remove vegetation in and around perimeters and maintain regularly.
• Institute a robust vehicle inspection program to include checking under the undercarriage of trains and vehicles. Provide vehicle inspection training to security personnel.
• Deploy explosive detection devices and explosives detection canine teams.
• Increase monitoring of transit system interdependencies (e.g. power sources, lines of communication, fuel sources, etc.) and provide additional protective measures as deemed necessary.
• Increase manning of transit control centers.
• If feasible, review vulnerability studies focusing on physical security, structural engineering, infrastructure engineering, power, water, and air infiltration, and implement corresponding security plans.
• Remove trash receptacles from all platforms. For mass transit, including bus and passenger rail systems, we recommend the following protective measures: • Ensure critical street vents, doors, and fences have appropriate security measures in place to include surveillance cameras, locks, and covers.
• Monitor street vents, doors, and fences for unauthorized access or exploitation of security boundaries.
• Ensure critical subway system assets have sufficient lighting.
• Ensure passive vehicle barriers are employed to protect crowded or popular subway stations or other critical areas from VBIEDs.
• Establish procedures for maintaining control of location, accountability, and security of passenger rail cars.
• Implement security sweeps of subway stations for suspicious activities and packages.
• Conduct increased monitoring and review of video surveillance cameras to determine if any preoperational surveillance activities have or are taking place.
• Increase security on subway power substations.
• Review incident/emergency response plans.
• Report any suspicious multiple medical conditions of personnel in subways/enclosed public spaces (e.g. shopping malls).
• Keep all bus doors, hatches, and compartments locked when vehicle is unattended.
• Conduct pre-trip and post-trip vehicle inspections.

Basic precautions that should be taken, including for buses and other mass transit:
• Encourage personnel to be alert and immediately report any situation that appears to constitute a threat or suspicious activity.
• Increase review of surveillance camera tapes.
• Keep all vehicle doors, hatches, and compartments locked when vehicle is unattended.
• Conduct pre-trip and post-trip vehicle inspections.
• Look for unattended packages.

Suspicious Indicators:
• Suspect’s clothing is out of sync with either the weather, grooming (e.g. he appears well groomed but is wearing sloppy clothing or vice versa), or location (wearing a coat inside a building).
• Clothing is loose.
• Suspect may be carrying heavy luggage, bag, or wearing a backpack.
• Pale face from recent shaving of beard.
• Eyes appear to be focused and vigilant.
• Does not respond to authoritative voice commands or direct salutation from a distance.
• Behavior is consistent with no future, e.g. individual purchases a one-way ticket or is unconcerned about receipts for purchases, or receiving change.
• Suspect is walking with deliberation but not running.

REPORTING NOTICE:

DHS and FBI encourage recipients of this document to report information concerning suspicious or criminal activity to the local FBI Joint Terrorism Task Force (JTTF) – the FBI regional phone numbers can be found online at HTUhttp://www.fbi.gov/contact/fo/fo.htmUTHU.U For transportation suspicious incidents and threat reporting contact the Transportation Security Operations Center (TSOC) at 703- 563-3236/3237 and email HTUM&L.TSOC@tsa.dot.govUTH. For information affecting the private sector and critical infrastructure, contact the National Infrastructure Coordinating Center (NICC), a subelement of the HSOC. The NICC can be reached via telephone at 202-282-9201 or via email at HTUNICC@dhs.govUTH. When available, each report submitted should include the date, time, location, type
of activity, number of people and type of equipment used for the activity, the name of the submitting company or organization, and a designated point of contact (POC).

For comments or questions related to the content or dissemination of this document, please contact the DHS/IAIP, IA-R – Information Management staff at HTUDHS.IAIP@dhs.govUTH.