Senators to WMATA: How Will You Keep Next-Gen Metro Cars Safe from Foreign Tampering?

The Washington, D.C. area will be getting another new round of Metro rail cars in a couple years. But the predominance of foreign manufacturers is giving four senators pause when it comes to the cybersecurity of critical transportation infrastructure in the nation’s capital.

The Washington Metropolitan Area Transit Authority issued a request for proposals in September for the design and construction of 256 new railcars, which will be known as the 8000 series. In keeping with technology trends in every sector, the new cars will include several technology upgrades for passengers, as well as for the overall operation of the trains.

Virginia Democrats Mark Warner and Tim Kaine and Maryland Democrats Ben Cardin and Chris Van Hollen wrote to WMATA General Manager and CEO Paul Wiedefeld last week noting the authority did not include requirements in the RFP that would favor domestic companies.

The senators cited automated train controls, network controls, video surveillance and data connections as potential threat vectors a foreign adversary could use to damage the Metro system or otherwise cause havoc in the D.C. area.

“Many of these technologies could be entirely susceptible to hacking, or other forms of interference, if adequate protections are not in place to ensure they are sourced from safe and reliable suppliers,” the senators wrote.

The senators said there is a growing interest in foreign companies investing in local transit programs across the country. In D.C., only the first line of Metro cars—the 1000 series built in the 1970s—was built by an American company: Rohr Industries, which is owned by United Technologies Corporation.

The 7000-series rail cars—currently nearing the end of the production run—were designed and manufactured by Kawasaki, a Japanese company. The 6000-series cars were made by Alstom, headquartered in Saint-Ouen, France. Previous lines were manufactured by companies from Spain and Italy.

“While we are aware that nearly all passenger railcar manufacturers in the United States are foreign-owned, what steps is WMATA taking to ascertain and mitigate against the involvement of foreign governments in this procurement?” the senators asked in a list of questions for WMATA leadership.

These concerns are not unfounded, according to Marty Edwards, director of strategic initiatives for the International Society of Automation and former director of the Industrial Control Systems Cyber Emergency Response Team at the Homeland Security Department.

“Electronic systems installed in these future rail cars could potentially be used for surveillance by a foreign adversary, or even to cause a safety problem if the system being attacked was used to control the train functions,” Edwards told Nextgov.

“All critical infrastructure owners and operators should have procurement policies in place to screen incoming systems for potentially damaging malware—regardless of country of origin—and ensure the security of their supply chains, especially if the supply chain extends into countries that could be viewed as unfriendly to the United States,” he added, citing congressional bans on the use of Huawei products as an example.

In their list of questions, the senators asked about consultations with the Homeland Security and Defense departments, whether the actions of foreign governments will be taken into account during bid evaluation and request an update on cybersecurity requirements being added to the RFP.

A WMATA spokesperson told Nextgov an amendment to the RFP addressing cybersecurity issues will be released in the coming weeks. The amendment and broader WMATA cybersecurity requirements will follow the cybersecurity framework developed by the National Institute of Standards and Technology.

WMATA has received the letter and is preparing a response to the senators, Wiedefeld told Nextgov in a statement.

“We recognize the important national security concerns being raised and we are working to strengthen this procurement and others with new cybersecurity requirements,” he said. “While we have a fiduciary responsibility with all procurements, safety and security is always our first priority.”