John Adams, a retired Army brigadier general, is president of Guardian Six Consulting and national security adviser to the Rail Security Alliance, an advocacy organization supported by freight rail manufacturers, suppliers, workers’ unions and steel interests.
The Washington Metropolitan Area Transit Authority did the right thing when it extended the deadline for proposals from manufacturers for its next series of rail cars. WMATA’s decision is good news, provided that it addresses cybersecurity concerns related to the purchase of new rail cars.
Andrew Grotto, a former senior director for cybersecurity policy on the National Security Council, recently warned that Metro’s request for proposals did not allow the transit agency to reject a bid because of cybersecurity worries. “The risk of espionage is uniquely high in our nation’s capital,” Grotto, now a fellow at Stanford University’s Center for International Security and Cooperation, said. “Malware could divert data collected from the high definition security cameras. An adversary with that data could then use facial recognition algorithms to track riders, potentially right down to the commuting patterns of individual riders.”
Do we want Chinese intelligence, using facial-recognition sensors or electronic intercept technology, to track Metro riders in and out of the Pentagon? Or the State Department? Or anywhere else in the Metro system? The answer is obvious.
And there’s more. Last October, in a report titled National Security Vulnerabilities of the U.S. Freight Rail Infrastructure and Manufacturing Sector — Threats and Mitigation, I outlined the reason WMATA and other transit agencies must look deeper than ever into their cybersecurity risks.
WMATA’s biggest threat comes from China.
The playbook is simple: China, via the state-owned CRRC Corporation Limited, enters a market at the local level, subsidizes the assembly of Chinese rail cars with Chinese parts and components and supplies them to cash-strapped transit agencies at bargain-basement prices. In the process, Chinese companies bring a small number of assembly jobs to the United States but keep the manufacturing, technology, and research and development locked down in China. CRRC made headlines when it announced plans to build a 42,500-square-foot facility in Springfield, Mass. Though hiring fewer than 200 employees, CRRC has worked tirelessly to create the facade that it’s bringing manufacturing back to the city. It’s not. Just like CRRC’s presence in Chicago, the Massachusetts CRRC facility is nothing more than an assembly plant for transit rail parts made in China and then shipped to our shores.
CRRC’s aggressive show of force hinges on anti-competitive bidding practices and only serves the long-term strategic and technological aims of the Chinese government. CRRC contracts also come with serious cybersecurity risks. After all, rail cars are no longer just big metal boxes. They are computerized smart cars with sensors that transmit billions of instructions per second and are prone to the same kinds of cyberattacks as a 5G network.
Regrettably, cities such as Boston, Chicago, Los Angeles and Philadelphia have contracted with CRRC already, putting short-term savings over long-term national and economic security. Such shortsighted decision-making simply cannot occur in Washington, where national security is essential.
In a February hearing before the House Committee on Homeland Security, Erik Olson, vice president of the Rail Security Alliance, said, “Whomever is selected to supply rail cars for WMATA will become a partner in the day-to-day operations of a Metro system whose stops include the Pentagon and the Capitol, as well as unfettered access to our nation’s tunnels and underground infrastructure.”
Now that WMATA has built in more time to handle its procurement of the 8000-series rail cars, it needs to take a page from the Metropolitan Atlanta Rapid Transit Authority. MARTA recently rejected CRRC’s active, anti-competitive bidding and awarded its contract to Stadler, a Swiss company. With Stadler, new subway cars will be manufactured from start to finish in the United States in Salt Lake City, creating genuine manufacturing jobs for up to 1,000 people. Real jobs. Real construction. Really American-made. And no security concerns. WMATA, please pay attention, and don’t fall into the trap set by China.