SAFETY AND SECURITY: Amtrak Has Opportunities to Strengthen Controls over High-security Keys

Our objective for this report was to assess the extent to which the company has controls to manage, distribute, track, and retrieve high-security keys.

We observed that high-security keys are broadly available to the public and can surface in online and brick-and-mortar marketplaces, contributing to security and safety risks. Senior officials told us the company has measures in place to largely mitigate serious risks, but the availability of these keys could still give bad actors an opportunity to disrupt train operations, causing unnecessary delays and costs.

We further observed that high-security keys are publicly available in part because the company has not consistently implemented controls over the distribution, tracking, and retrieval of them. Senior officials agreed the company may reduce its risk by better safeguarding its high-security keys going forward.

We provided several considerations for the company to address the report’s observations to include assessing the risks associated with keys currently in circulation and implementing controls to mitigate them to the extent practical. In addition, Amtrak may want to consider developing a key management policy that institutes new controls and establishing a centralized mechanism for tracking high-security keys, such as key management software.