Public Transit Security: Safeguarding Passengers, Employees, and Infrastructure

More than 3 million Canadians rely on public transit every single day. We ride to and from home, work, school, and shopping centres on buses, subways, trains, and streetcars; it’s clear that public transit is essential in our daily lives. As vital as it is, it also faces myriad and unique security challenges that must be met during the design, construction, testing and ongoing operations of our transit systems. Safeguarding passengers and staff, and securing geographically dispersed infrastructure demands a holistic and multi-layered approach.

The Growing Need for Public Transit Security 

Public transit security is more than just fare gates, surveillance cameras and security guards. A proper security posture requires a comprehensive, multi-layered approach that integrates physical security, cybersecurity, emergency preparedness, and proactive crime prevention strategies. Creating and maintaining safe transit systems means thoughtful design, considered policies, procedures and processes, well-trained and capable staff, proactive planning, application of appropriate technology and a culture of security awareness. The security landscape is also dynamic and ever-changing – not all of yesterday’s solutions are effective today; the evolution of security threats must be matched with an evolution in security strategies. 

Three Pillars of Public Transit Security: 

1. Risk Assessment 

Developing and carrying out a fit-for-purpose Risk Assessment is the critical foundational step in the provision of security in any endeavour, and public transit is no exception. A risk assessment includes a number of steps and ‘sub-assessments’, but ultimately gives us information about five important things: 

• Assets – the things that need to be protected 
• Threats – the events that may cause harm to assets 
• Vulnerabilities – the things that facilitate a threat event coming to pass 
• Risk – the relative risk of harm posed by each of the threats 
• Security mitigations – the things that can be done to reduce the risk or degree of harm 

Without a Risk Assessment, we would be operating in the dark – without knowledge of assets, how do you know what to protect? Without a list of threats, how do you know what needs to be protected against? An effective risk assessment provides a defensible starting point for the development of the rest of the security program, and supports the efficient prioritization and allocation of resources.  

Physical and cyber security risk assessments generally follow a similar process, however the methodologies used for each can differ significantly due to the distinct nature of the two disciplines. It is critical to ensure there is communication and coordination between the disciplines, and that the boundary of cyber-physical is well defined on both sides to minimize potential for gaps or overlap. 

2. Security Planning 

After a Risk Assessment, developing a comprehensive Security Plan is the next most important piece for a transit system or project. 

A Security Plan should tell the story, from beginning to end, about the application of security measures in support of the stated goals and objectives, in conformance with a security policy, as well as contractual, regulatory and legal requirements. The Plan should outline the who, what, when, why, where and how of security roles and measures, in sufficient detail to generate actionable requirements. 

Scoping of plans, and security activities outlined in security plans is particularly important, especially in projects with multiple or complex stakeholder relationships, brownfield projects, or when broad-scale updates are made to existing plans in support of major infrastructure changes (e.g. extensions, integration with new lines, etc.) 

Security plans should generally cover: 

• Security Roles, Responsibilities and Accountability 
• Security Policy, Goals and Objectives 
• Contractual, Regulatory and Legal Compliance 
• Risk Assessment 
• Derivation and Application of Security Mitigations – Infrastructural, Technological, Administrative  
• Security Training, Drills and Exercises
• Public Relations and Security Communications 
• Incident Reporting and Investigations 
• Human Resources Security 
• Information Sharing / Stakeholder Coordination and Communication 
• Emergency Management, Response, Recovery 
• Maintenance 
• Continuous Improvement and Auditing 

3. Defense in Depth / Layered Security 

Defense in Depth is a concept/approach to security that prioritizes the provision of multiple layers of protection to mitigate security threat risks. Instead of relying on a single security measure to address a particular vulnerability, Defense in Depth recognizes the importance of implementing overlapping or redundant controls to ensure that if one layer fails, others will still provide security. There is an additional benefit to this strategy, as multiple layers of security controls provide a synergistic net effect – the whole is greater than the sum of the parts. Layered security measures, taken together, are generally much more effective at deterring, delaying, denying and detecting threats than singular security layers or measures. 

This approach is especially relevant in the transit environment due to the volume of people that come into contact with system assets on a regular basis, and their relative proximity to those major assets. 

Evolving Threats in Public Transit: 

As the world becomes more interconnected, public transit systems face an increasing range of physical and cyber security threats. The incredible advances we’re witnessing in AI, facial recognition technology, and predictive analytics offers transit systems new tools for monitoring and responding to threats. However, these tools also raise potential privacy concerns and, as ever, implementation of these technologies must balance security with the protection of passengers’ rights. 

The need for cybersecurity in public transit cannot be overstated. From hackers attempting to compromise fare systems to ransomware attacks on transit networks, the potential for disruption is real. As technology advances, so do the threats facing transit systems, requiring a proactive and comprehensive security strategy. 

Challenges in Public Transit Security: 

The complexities of public transit security stem from the need to protect both people and infrastructure in environments that are – by necessity – open and easily accessible. Additionally, there are often multiple stakeholders involved in large transit projects, and the development of an effective security program necessitates coordination, communication and cooperation with multiple parties.  

Challenges can be particularly acute during the bid preparation and design and construction phases of a new transit system, as many different disciplines must work together – often under tight timelines – to develop a cohesive and holistic product. Security practitioners can struggle in such environments as the integration of security measures requires constant communication and integration with multiple disciplines, departments and processes – systems engineering, systems and safety assurance, verification and validation, requirements management, procurement, commercial and legal teams to name a few. Without a firm understanding of the structure of these large design-build contracts, there is a risk that security can be overlooked and left behind. 

Operating systems face their own unique security challenges. Aging systems and out-dated plans, policies, procedures and training can be a major liability for operators, while systemic reviews, updates and retrofits can loom as major barriers to initiating action.  

How Kirsch Group Can Help: 

At Kirsch Group, we offer a comprehensive approach to public transit security. With decades of experience in security risk assessment, security planning, training, and emergency response, we help designer-builders or new systems, and owners/operators of existing systems, identify potential vulnerabilities, develop tailored security solutions, and ensure that assets remain safe and secure in the face of evolving threats. 

Safeguarding passengers and transit system assets is a complex and dynamic process. As technology continues to advance and security threats evolve, it is vital to stay ahead of the curve. By investing in a comprehensive, multi-layered security strategy, transit systems can provide passengers with the safety they need while maintaining operational efficiency and protecting their infrastructure. 

If you’re looking to improve your transit security posture or would like to discuss how we can help with your security needs, don’t hesitate to reach out to our team at Kirsch Group. Together, we can create a safer and more secure transit experience for everyone.