Public transit systems remain vulnerable to cyber threats

In early January, a former contractor for the transit agency in Washington, D.C., was vacationing in Russia when he opened his computer and logged onto a sensitive agency directory. 

Four years before that, penetration testing by a third-party revealed several “critical” cybersecurity vulnerabilities on a train the Washington Metropolitan Area Transit Authority was operating. That same year, an internal audit raised concerns that there was a lack of encryption on WMATA-owned devices.

These incidents were all highlighted in a recent report that chronicled ongoing cybersecurity vulnerabilities at WMATA. But experts warn that these types of issues are common in transit agencies across the country and that public transportation will remain vulnerable unless leaders act.

The WMATA Office of the Inspector General concluded that the agency’s cyber weaknesses and vulnerabilities “are a cause of grave concern,” and that the transit agency’s data, networks and physical assets are at “unacceptable risk of malicious penetration and compromise.”

For its part, WMATA said in a joint memo attached to the report that it has made “measurable improvements” in its cybersecurity program, and points out that the agency’s IT department was the first to detect the suspicious login from Russia and pushed out necessary alerts.

The memo also said that while penetration testing found several opportunities to bolster the agency’s cyber resilience, there were no indications of malicious activity.

But outside groups have been sounding the alarm on the cybersecurity vulnerabilities of transit agencies for some time, particularly after a couple of alarming incidents. San Francisco’s Bay Area Rapid Transit system was breached in 2016 by hackers, while a ransomware attack on the Southeastern Pennsylvania Transportation Authority (SEPTA) in Philadelphia in 2020 left the agency with disrupted communications.

Scott Belcher, a research associate at the Mineta Transportation Institute at San Jose State University, said he is “not surprised” that the transportation sector is as vulnerable as it is, given the chronic lack of funding, scarcity of cybersecurity specialists on staff and lack of modern technology in use.

A 2020 Mineta survey found that while over 80% of agencies feel prepared for a cyber threat, only 60% have a cybersecurity program in place and 43% said that plan is insufficient. A separate Mineta report last year called for the transit sector to undergo a “twenty-first century security upgrade.”

For transit agencies, investment in cybersecurity may fall way down on the list of priorities due to the need to invest first in all the other services they provide, like buses, rail and paratransit.

“As a result, there's a disconnect between that hardened equipment and technology that's changing on a daily or weekly basis, and trying to keep up with that,” Belcher said.

The WMATA OIG’s report hints at many of the cybersecurity issues identified by Mineta and that transit agencies face. According to the report, WMATA’s agency-issued mobile devices are still unencrypted, having first been flagged as an issue in 2019. OIG also found that WMATA has a lack of security controls around accessing sensitive information, while an investigation found that the agency “lacks controls or procedures” to prevent its assets from being transported outside the United States.

The report also found that WMATA does not have procedures or controls in place to prevent its data or networks from being accessed from abroad, as shown by the incident in January. OIG said it was concerned by that scenario as even though the employee had the authority to access the data, they did so using a personal device using an unknown wireless or cellular connection abroad.

OIG said they interviewed the employee in question, who said he was never issued a WMATA computer. The use of personal devices—something that has grown among government agencies since the onset of the COVID-19 pandemic—“increases WMATA’s risk of compromise,” OIG said.

The report also warned that the train found in 2019 to have potential cybersecurity vulnerabilities still has them and that OIG is “concerned by the lack of urgency” to address them.

Belcher said that as transit systems become more technologically advanced, with internet connectivity for passengers, real-time train and bus tracking, and mobile ticketing, among other innovations, they also become more vulnerable to attack.

“As transportation becomes more sophisticated and more connected, the risks and the opportunities for criminals to gain access have multiplied,” he said. “The more you use connectivity, the more you use connected vehicle technology, the more you access the internet, the more vulnerable you become.”

Belcher is particularly concerned about smaller agencies, which may either outsource their IT and cyber work or not have any dedicated staff at all.

He suggests that as those agencies and others look to get their arms around cybersecurity, they take advantage of federal resources from the Federal Transit Administration, Transportation Security Administration and others.

“If you're a baseball fan,” Belcher said, transit agencies have “a pretty good average” when it comes to avoiding attacks. But that could change. “It's cat and mouse and it'll continue to be that way,” he added.