Authenticated Railway Data Can Still Be Operationally Wrong

Identity and transport security do not establish operational truth

The new European Telematics Applications TSI consolidates the previous passenger and freight telematics regimes into a common framework for interoperable data sharing. It covers processes including capacity management, train preparation and traffic management, and requires telematics applications based on APIs for machine-to-machine exchange or web interfaces for human-to-machine exchange. ERA highlights a common ontology, data-quality requirements, cybersecurity and safe use of data as core elements of the framework.

That is an important interoperability step, but it sharpens a security distinction that becomes more consequential as decisions depend on shared services: authentication proves the identity associated with a message or service. Encryption protects the transport path. Neither proves that the data is fresh, semantically correct or still trustworthy for the operational decision consuming it.

Consider a hypothetical but realistic trust failure. A legitimate railway undertaking or infrastructure manager has an authorised publishing service. Its certificate is valid and the API session is correctly authenticated. The publishing environment is then compromised and starts sending stale capacity information, manipulated train-preparation data or values that are syntactically valid but semantically inconsistent with the real operating state. Nothing about TLS or publisher identity has to fail for a downstream system to receive operationally wrong information.

The security response can itself become an operational failure

The obvious security controls are necessary: schema validation, provenance, timestamps, expiry, semantic checks, anomaly detection and rapid credential or certificate revocation. The harder problem is what happens after one of those controls says that a publisher may no longer be trustworthy.

Automatically rejecting every message from an organisation because one data stream looks anomalous can be technically clean and operationally destructive. Capacity allocation, train preparation, freight coordination and traffic-management processes depend on multiple actors. A broad quarantine can create replanning, delay, contractual conflict or loss of situational continuity even when only one publisher, API, data class or time window is affected.

Detection and decision should therefore be separate. An anomaly changes the confidence assigned to data; it should not automatically dictate the operational response. The response can be graduated: request confirmation from the source, compare against an independent dataset, restrict only the affected message class, lower automation authority, or use a last-known state within an explicit validity horizon. The right action depends on the consequence of acting on wrong data and the consequence of withholding data that may still be correct.

Trust reduction needs the same governance discipline as trust establishment

The TEL TSI makes the organisational nature of the rail data ecosystem explicit. It defines telematics stakeholders, organisation codes, common reference data, APIs and responsibilities for shared information. ERA's implementation Q&A further discusses governance, APIs, ontology, traffic management, cybersecurity and data exchange. This means the trust boundary increasingly crosses company and service boundaries rather than ending at a railway operator's network perimeter.

CLC/TS 50701 and IEC 62443 provide useful security-engineering concepts for railway and industrial systems, while NIS2 reinforces governance and risk-management obligations for network and information systems. But distributed data trust also requires an operational contract: who can declare a publisher or data class untrusted, what evidence justifies that action, what fallback remains valid, who owns the resulting operational impact, and what evidence is required to restore normal trust.

These rules need to exist before an incident because restoration can be harder than containment. A certificate can be reissued quickly; confidence in the data source may not be. Restoring trust may require clean-system evidence, data reconciliation, replay of missed messages, confirmation from independent sources and a bounded period of enhanced monitoring. Without defined restoration criteria, emergency quarantine can quietly become a new normal operating state.

Written by

Antonio González, PhD

Cybersecurity practitioner focused on product security, OT/ICS and cyber-physical systems. Cybersecurity Under Pressure translates incident evidence into engineering and business decisions.

About →LinkedIn ↗