OIG: Amtrak should strengthen controls over high-security keys

Amtrak hasn’t consistently implemented controls over the distribution, tracking and retrieval of its high-security keys, which contributes to security and safety risks, according to an Amtrak Office of Inspector General (OIG) report issued earlier this week.

The high-security keys are physical keys used by Amtrak employees and contractors to access critical and sensitive infrastructure. In July,  an OIG investigation found that a Florida-based employee tried to sell the keys online, which prompted the OIG’s review. The state of Florida charged the individual for attempting the sale and for dealing in stolen property, OIG officials said in a press release.

Such high-security keys are broadly available to the public and can surface in online and brick-and-mortar marketplaces, contributing to security and safety risks, the OIG report states. Senior Amtrak officials told the OIG that the railroad has measures in place to largely mitigate serious risks. However, the availability of the keys could still enable "bad actors" to disrupt train operations, causing unnecessary delays and costs, OIG officials believe.

The OIG recommended that Amtrak consider assessing the cost and risks associated with implementing better controls over high-security keys in circulation, and implementing controls that are practical. 

In addition, Amtrak management may want to help develop a policy that institutes new controls establishing a centralized mechanism for tracking high-security keys, the report states.