Description

The intent of this study is to assess the readiness, resourcing, and capabilities of public transit agencies to detect, identify, be protected from, respond to, and recover from cybersecurity vulnerabilities and threats. This study is an update of the 2020 Mineta Transportation Institute (MTI) study, “Is the Transit Industry Prepared for the Cyber Revolution? Policy Recommendations to Enhance Surface Transit Cyber Preparedness.” In the previous study, the authors found that the transit industry was ill-prepared for cybersecurity attacks. Unfortunately, after four years and the development of new, and often free, resources, the situation has not markedly improved. In fact, this survey, which included a larger number of small rural transit agencies, shows that they lag far behind their larger peers. The increasing sophistication of cybercriminals, in combination with a greater reliance on technology within the transit industry, puts the industry at greater risk than in 2020. This study reviews and updates the state of best cybersecurity practices in public surface transit; outlines U.S. public surface transit operators’ cybersecurity operations and the resources available to them; reviews U.S. policy on cybersecurity in public surface transportation; and provides policy recommendations that address gaps or identify issues for Congress, the Executive Branch, public surface transit agencies, and their associations and other supporting organizations. Research methods include an online survey and oral interviews with public surface transit agencies in the United States as well as oral interviews with members of the Executive Branch (e.g., the U.S. Department of Transportation, the U.S. Department of Homeland Security), as well as research of literature published in periodicals. There is an exponentially expanding gap between the cybersecurity preparedness that should exist and the growing threats from increased reliance on technology and the opportunities by malicious actors. This research provides information that can be used to help close that gap.

Publication Date

5-1-2025

Publication Type

Report

Topic

Planning and Policy, Security and Counterterrorism

Digital Object Identifier

10.31979/mti.2025.2405

MTI Project

2405

Keywords

Cybersecurity, enterprise risk management, policy, security, transit

Disciplines

Cybersecurity | Transportation

Additional Files
2405-RB-Belcher-Transit-Industry-Cybersecurity-Risks.pdf (974 kB)
Research Brief
2405-Dataset.zip (11 kB)
Dataset
Download

Additional files available below

Share

COinS