TSA issued five successive directives requiring certain railroads to implement a number of expensive cybersecurity preventive measures. The agency bypassed the usual notice-and-comment rulemaking procedures and instead invoked emergency procedures under 49 U.S.C. 114(l)(2), allowing TSA to issue directives in emergency situations and “shall skip notice and comment.” The affected railroads petitioned the Seventh Circuit Court of Appeals to vacate the latest directive and to require TSA to follow the regular rulemaking procedures. They argued that the ongoing threat of cyber attacks does not constitute an emergency within the meaning of the statute. The Court of Appeals disagreed and upheld the agency’s directives without resort to usual rulemaking procedures. The case is styled Grand Trunk Corp. v. Transportation Security Administration, decided August 21, 2025.

Context is important here. The directives applied only to those higher risk rail operations and freight railroads that are part of the Strategic Rail Corridor Network. They include carriers with annual revenues of $900 million or more, and those that transport rail security-sensitive materials like explosives, poisonous gases, hazardous liquids, and radioactive materials. The Network railroads a part of the Department of Defense Railroads and Highways for National Defense program, which ensures that the nation’s rail infrastructure can transport military supplies in the event of conflict. The directives require railroads to develop Cybersecurity Implementation Plans, including continuous cybersecurity monitoring, and to develop Cybersecurity Assessment Plans and submit annual updates to TSA.

In this process, TSA relies upon information from the U.S. intelligence community concerning ongoing and increasing cybersecurity threats, especially from Russia and China.

TSA estimated the cost for the railroads to comply with the directives at $100 million, in large part prompting the lawsuit, according to the opinion. Despite those costs, the Court of Appeals dwelt on the “serious national security concerns that motivate the security directives.” Considering those concerns and the fact that the military relies on rail network to move supplies and equipment and that industry relies upon it to transport food and manufacturing, the Court found these directives to qualify as emergency measures under the statute. “We are also loathe to ‘second-guess’ expert agencies on potential risks to national security,” citing Supreme Court precedent.

The Circuit Court also notes that although not required, TSA has submitted these emergency measures to regular rulemaking notice-and-comment, and that the comment period has expired.