Passenger Rail Transportation Security Regulations (SOR/2020-222)

Interpretation

Marginal note:Definitions

1 The following definitions apply in these Regulations.

host company

host company means a railway company that authorizes a passenger company to operate on its railway. (compagnie hôte)

passenger company

passenger company means a company whose operations include the transport of passengers by railway. (compagnie de transport de voyageurs)

small passenger company

small passenger company means a passenger company that transported fewer than 60,000 passengers in one of the two previous calendar years. (petite compagnie)

train

train means all the pieces of railway equipment that are joined together and that move as a unit for the transport of passengers. (rame ferroviaire)

PART 1Security Awareness Training

Marginal note:Security awareness training program

• 2 (1) A passenger company and host company must have a security awareness training program that promotes a culture of vigilance with respect to passenger rail transportation security.

• Marginal note:Program training topics

  (2) The security awareness training program must cover the following topics:

  • (a) a description of the main security risks related to passenger rail transportation;

  • (b) any potential threats and other security concerns related to passenger rail transportation and how to recognize them;

  • (c) the actions to be taken to deal with potential threats and other security concerns; and

  • (d) any measures of the passenger company or host company that are designed to enhance passenger rail transportation security.

• Marginal note:Prescribed persons

  (3) The passenger company or host company must ensure that any person employed by, and any person acting on behalf of, the company and who have any of the following duties relating to the transport of passengers, as well as the direct supervisors of those persons, undergo security awareness training:

  • (a) operating, maintaining or inspecting railway equipment or railway works;

  • (b) controlling the dispatch or movement of railway equipment;

  • (c) ensuring the security of railway equipment and railway works;

  • (d) loading or unloading goods to or from railway equipment;

  • (e) interacting with the public for the purposes of railway transportation; or

  • (f) ensuring compliance with its security processes, including those set out in their security plan.

• Marginal note:Provision of training

  (4) The passenger company or host company must ensure that security awareness training is provided to the person

  • (a) within 90 days after the day on which this section comes into force, unless the person has received equivalent security awareness training before that day;

  • (b) within 90 days after the day on which the person initially assumed any of the duties referred to in subsection (3) with that company, if the duties were assigned to that person after the day on which this section comes into force; and

  • (c) on a recurrent basis at least once every three years after the day on which the person completed their previous training, including any equivalent security awareness training received before the day on which this section comes into force.

• Marginal note:Supervision

  (5) The passenger company or host company must ensure that, until the person undergoes the security awareness training, the person performs their duties under the supervision of a person who has undergone that training.

• Marginal note:Training records

  (6) The passenger company or host company must ensure that a training record is kept for each person who has undergone security awareness training and that the record

  • (a) is kept up to date;

  • (b) includes the person’s name and details of their most recent training, including the date, duration and the title of the training, the delivery method and the name of the provider of the training;

  • (c) includes the title and the date of any previous security awareness training taken by the person; and

  • (d) is retained for at least two years after the day on which the person ceases to be employed by, or ceases to act on behalf of, the company.

• Marginal note:Retention of training materials

  (7) The passenger company or host company must ensure that a copy of the most recent awareness training materials is kept.

PART 2Coordination and Reporting

Marginal note:Rail security coordinator

• 3 (1) A passenger company and host company must have, at all times, a rail security coordinator or an acting rail security coordinator.

• Marginal note:Contact information

  (2) The passenger company and host company must provide the Minister with

  • (a) the name and job title of the rail security coordinator or acting rail security coordinator; and

  • (b) the 24-hour contact information for the rail security coordinator or acting rail security coordinator.

• Marginal note:Duties — passenger company

  (3) The passenger company must ensure that the rail security coordinator or acting rail security coordinator

  • (a) coordinates security matters within the passenger company;

  • (b) acts as the principal contact between the passenger company and the Minister with respect to security matters; and

  • (c) coordinates communications between the passenger company, the host company, law enforcement and emergency response agencies with respect to security matters.

• Marginal note:Duties — host company

  (4) The host company must ensure that the rail security coordinator or acting rail security coordinator

  • (a) acts as the principal contact between the host company and the Minister with respect to security matters related to passenger rail transportation on its railway; and

  • (b) coordinates communications between the host company, passenger companies that operate on its railway, law enforcement and emergency response agencies with respect to security matters related to passenger rail transportation on its railway.

Marginal note:Security Reporting

• 4 (1) A passenger company or host company must report to the Transport Canada Situation Centre, by any direct means of communication established and communicated by the Centre, any threat or other security concern that results or may result in an unlawful interference with passenger rail transportation. The report must be made as soon as feasible but no later than 24 hours after the occurrence of the threat or other security concern.

• Marginal note:Threats and other security concerns

  (2) Threats and other security concerns include

  • (a) any interference with the work of a train crew or service personnel;

  • (b) any bomb threats, either specific or non-specific;

  • (c) any report or discovery of a suspicious item;

  • (d) any suspicious activity observed on, inside or near railway equipment or railway works used by that company;

  • (e) the discovery, seizure or discharge of a weapon, explosive substance or incendiary device on, inside or near railway equipment or railway works used by that company;

  • (f) any sign of tampering with railway equipment or railway works;

  • (g) any information relating to the possible surveillance of railway equipment or railway works; and

  • (h) any suspicious person, circumstance or object that the passenger company or host company considers to be a threat or other security concern.

• Marginal note:Information to be provided

  (3) The information provided must include, to the extent known, the following:

  • (a) the passenger company’s or host company’s name and contact information, including its telephone number and email address;

  • (b) the name of the person who is making the report on behalf of the passenger company or host company and the person’s title and contact information, including their telephone number and email address;

  • (c) any information that identifies any train that is affected by the threat or other security concern, including its itinerary and line or route position;

  • (d) any information that identifies any railway equipment or railway works that is affected by the threat or other security concern;

  • (e) a description of the threat or other security concern, including the date and time that the passenger company or host company became aware of it;

  • (f) the names of the persons involved in the threat or other security concern, and any other information related to those persons, if the disclosure of those names and that information is permitted; and

  • (g) the source of any threat information or other security concern, if its disclosure is permitted.

• Marginal note:Follow-up information

  (4) The passenger company or host company must provide to the Transport Canada Situation Centre any information referred to in subsection (3) that was not previously reported, as soon as it becomes known.

• Marginal note:Avoidance of double reporting — other company

  (5) The passenger company or host company is not required to make a report under this section if the same threat or other security concern has been reported by another company under this section.

• Marginal note:Provision of information — passenger company

  (6) A passenger company that operates on a host company’s railway must, as soon as feasible, notify the host company if the passenger company becomes aware of a threat or other security concern that could impact the operations of the host company.

• Marginal note:Provision of information — host company

  (7) A host company must, as soon as feasible, notify a passenger company that operates on its railway if the host company becomes aware of a threat or other security concern that could impact the operations of the passenger company.

PART 3Security Inspections

Marginal note:Security inspections

• 5 (1) For the purposes of this section, car means a piece of railway equipment that is used for passenger rail transportation and includes a baggage car, a dining car, a sleeping car, a lounge car, an observation car, the locomotive and any freight car that can be subjected to a walk-through inspection.

• Marginal note:Process

  (2) A passenger company must establish and document a process with respect to security inspections, including

  • (a) a procedure for conducting security inspections;

  • (b) a method for determining whether security has been compromised;

  • (c) a method for determining whether additional security inspections are necessary if, having regard to the circumstances, security could be compromised;

  • (d) a method for addressing the situation, if security has been compromised, before the train enters into service; and

  • (e) a method for preventing unauthorized interference with the train after the inspection and until passengers board the train.

• Marginal note:Inspection

  (3) In order to ensure that there are no security concerns related to passenger rail transportation, a passenger company must ensure that security inspections consist of both a ground-level visual inspection of the exterior of the train and an inspection of the interior of each car and are carried out in accordance with the process set out in subsection (2).

• Marginal note:Time of inspection

  (4) The passenger company must ensure that a security inspection is carried out before the train enters service for the day. In all cases, the inspection must be carried out before passengers board the train.

• Marginal note:Additional inspections

  (5) The passenger company must ensure that additional security inspections are carried out after the train enters service for the day, if it is determined, in accordance with the method referred to in paragraph (2)(c), that they are necessary.

• Marginal note:Protection of train

  (6) When the security inspection is carried out before passengers board the train, the passenger company must ensure that the train is protected from unauthorized interference from the start of the security inspection until passengers board the train.

• Marginal note:Signs of tampering, suspicious objects and other things

  (7) If signs of tampering or the presence of a suspicious object or any other thing that raises security concerns is discovered during the security inspection, the passenger company must determine whether security has been compromised.

• Marginal note:Compromise of security

  (8) If it is determined that security has been compromised, the passenger company must ensure the situation is resolved before allowing the train to enter into service.

• Marginal note:Records

  (9) The passenger company must keep a record of each security inspection and ensure that the record contains the following information:

  • (a) the time and date of the inspection;

  • (b) the information identifying the train that was inspected;

  • (c) the name of the person who conducted the inspection;

  • (d) the details of any signs of tampering, suspicious objects or other things that raise security concerns; and

  • (e) the measures taken to resolve the situation, if the company determined that security was compromised.

• Marginal note:Retention period

  (10) The passenger company must retain the record for three years after the day on which the security inspection is conducted.

PART 4Security Risk Assessment

Marginal note:Security risk assessment

• 6 (1) A passenger company, other than a small passenger company, must conduct a security risk assessment of its network and operations that are related to passenger rail transportation in Canada that identifies, describes, assesses and prioritizes security risks and that

  • (a) is based on the following elements:

    • (i) current security threats, including security threat information received from a federal department or agency and threats or immediate threats identified in an instrument made by an inspector under section 31 of the Railway Safety Act or by the Minister under section 33 or 39.1 of that Act;

    • (ii) operations, railway equipment, railway works and other assets that are deemed critical and that most require protection from acts and attempted acts of unlawful interference with passenger rail transportation;

    • (iii) security vulnerabilities, including those identified during daily operations, in security reports made under section 4, during security inspections carried out under section 5 and during security exercises carried out under section 9; and

    • (iv) potential impacts, including a decrease in public safety and security, loss of life, damage to property or the environment, disruption of rail transportation and financial and economic loss;

  • (b) identifies, for each risk, the likelihood that the risk will occur and the severity of the impact that it could have if it occurs; and

  • (c) identifies potential safeguards intended to mitigate the risks identified.

• Marginal note:Report

  (2) The security risk assessment must be documented in a report within 30 days after the day on which the assessment is completed and the report must

  • (a) indicate the date of completion of the assessment; and

  • (b) contain all the information referred to in subsection (1).

• Marginal note:Subsequent risk assessments

  (3) A passenger company, other than a small passenger company, must conduct a new security risk assessment within three years after the date of completion of the current security risk assessment, or any assessment that is carried out before the day on which this section comes into force and that meets the requirements of this section.

• Marginal note:Review

  (4) A passenger company, other than a small passenger company, must review its security risk assessment within seven days after the day on which

  • (a) there is a change in circumstances that is likely to adversely affect passenger rail transportation security;

  • (b) an instrument that identifies a threat or an immediate threat to passenger rail transportation security that is not described in the assessment is made by an inspector under section 31 of the Railway Safety Act or by the Minister under section 33 or 39.1 of that Act; or

  • (c) the company identifies a significant security vulnerability that is not described in the assessment.

• Marginal note:Periodic review

  (5) A passenger company, other than a small passenger company, must review its security risk assessment at least once every 12 months. A new risk assessment conducted under subsection (3) or a review conducted under subsection (4) is a review for the purposes of this subsection.

• Marginal note:Requirements for review

  (6) As part of a review referred to in subsection (4) or (5) — with the exception of a new risk assessment referred to in subsection (5) — a passenger company, other than a small passenger company, must

  • (a) identify, describe, assess and prioritize any new security risks in accordance with subsection (1); and

  • (b) document the review in the report on the current security risk assessment, including the date of the review, the reason for the review under subsection (4) or (5) and any new risks that have been identified, their priority level and the potential security safeguards, if applicable.