New UMD Center Puts Focus on Railway Cybersecurity and Safety

Trains ground to a halt for several hours in Denmark last November after a ransomware attack hit a railway subcontractor. Earlier in 2022, cybercriminals breached the computer system used by Italy’s state railroad, forcing a suspension of ticket sales. In 2016, a cyberattack shut down ticketing machines for the San Francisco Bay area’s light rail system.

To fight such incidents—and prevent even more serious ones—the new Digital and Cyber Railway Engineering and Operations Center (DCREOC) based at the University of Maryland will help the rail industry bring high-tech tools to bear to secure this crucial part of the nation’s infrastructure.

Among other research areas, the center will explore the use of quantum computing and technology to address operational, logistical and maintenance issues in railway engineering, leveraging resources available at UMD like the Joint Quantum Institute, the Joint Center for Quantum Information and Computer Science, the Quantum Technology Center and the NanoCenter.

The center seeks to be a leader in maximizing the benefits of digital technologies in providing safe and secure railways, said Nii Attoh-Okine, chair of the Department of Civil and Environmental Engineering, who will direct the new center based there.

“Our aim is to support industry through research, education and policy,” he said. “Our center will work with a diverse range of specialists and partners to facilitate changes that will address appropriate maintenance techniques, operational efficiency, and security and safety in railway engineering and operations.”

As with most other industries, U.S. railways have undergone major transformations as a result of the digital revolution, with distributed computer systems now handling many aspects of their control and operations, he said.

That leaves them potentially vulnerable to cyberattacks and other forms of sabotage. A bad actor could theoretically interfere in myriad ways, from introducing delays to orchestrating an accident. Although malicious cyberactivities aimed at railroads have been relatively minor so far, an attack on railway infrastructure, whether cyber or physical, could be catastrophic, particularly if it targets trains carrying chemicals or hazardous materials. Such an accident can have a cascading effect, amplifying the scale of environmental disaster. Interaction between railway and other infrastructure relies increasingly on distributed computer systems, opening the door for attacks.

“In the era of digital applications, fundamental changes are needed in areas such as data storage and sharing,” Attoh-Okine said. “As leaders in the railway engineering field identify the needed changes and develop best practices, the DCREOC will serve as a focal point to guide this new era of railway transportation.” The center will also help in developing the next generation of railway engineers and practitioners, ensuring they are well-versed in emerging technologies.

In addition to tapping the expertise available at UMD’s highly regarded transportation engineering program, the center will partner with two external institutions—the Center for Artificial Intelligence at Japan’s University of Tsukuba and the railway engineering program at Delft University, Netherlands. Research will cover a gamut of resilience- and security-related topics, from blockchain applications to train track geometry modeling.

Dean Samuel Graham. Jr. of the Clark School welcomed the launch of the new center, saying it would further enhance Maryland Engineering’s role in supporting critical societal needs, including the security of rail-dependent logistical supply chains.

“To ensure the efficient delivery of goods through this supply chain, it’s essential we continue to modernize and protect our infrastructure involving trains, railways and other assets needed in their operation,” he said. “With our leading capabilities in AI, machine learning, quantum and data analytics, we’re uniquely positioned to advance the country’s rail infrastructure and enable the employees who manage it.”