Rail Theft Watch: Freight Rail Theft Detection and Evidence

VERTICAL-DRIVEN ARCHITECTURES · SUPPLY CHAIN AND LOGISTICS

Rail Theft Watch

A system design for the operations technology lead accountable for freight security, railroad police leadership and their analysts, and the engineers who would build it. It shows how a freight railroad can tell a robbery from a defect when a train stops, route the alert to a named responder, and build the evidence package as the event unfolds.

THE CASE IN BRIEF

• Organized freight theft happens where no signal reaches: trains stopped in remote corridors and containers opened in yards.
• The railroad already generates the signals that would reveal it, including brake pipe pressure, container GPS, seal records, cameras and drone feeds.
• Each sits in a separate system, so a stopped train looks the same whether it is a mechanical defect or a robbery in progress.
• By the time the signals are joined by hand, the responders who could have acted are too far away and the evidence is incomplete.
• Rail Theft Watch fuses every signal into one model the railroad owns, so each alert reaches a named responder with a reason and a response clock.
• Detection runs at the edge, the control systems are read through a one-way diode, and every decision to act stays with a person.

WHY THIS MATTERS

The first minute decides the outcome. Distinguishing a robbery from a defect quickly is the difference between a recovered shipment and a report written the next day.

The signals exist but never meet. A brake pipe drop, a container that stops reporting and a vehicle waiting on an adjacent highway together tell a story that no single system can.

Evidence has to stand up in court. Prosecution depends on a chain of custody that links the stop, the seal, the footage and the responders in one record.

And security spending often stops where the theft starts. Remote corridors have no cellular coverage, so detection must run at the edge on hardware the railroad controls.

This creates a structural exposure.

• Train control data shows that a train stopped but not why.
• Container GPS and seal records sit apart from the train they travel on.
• Cameras and drones capture footage that is reviewed after the event.
• Alerts reach dispatch without a named responder or a response clock.
• Evidence for prosecution is assembled by hand from several systems.
• Hosted inference cannot run where the corridors have no connectivity.

Build the case before the train stops moving.

Every alert carries a named responder, a reason and a clock, and every piece of evidence is held by the railroad.

WHAT YOU'LL LEARN

Inside the architecture, you'll find:

• Why freight is stolen where no signal reaches, and what answering in the first minute requires
• How nine security feeds each hold one slice of the theft, and why none can name the responder
• The four constraints that fix the design: edge inference in dead zones, operator-held weights, models that propose while people decide, and a read-only boundary to control systems
• Three scoping decisions and what each costs, from a one-corridor pilot to reusing the existing camera estate
• What the design chose against, including letting a language model classify stops
• The layered stack from ten sources through two adapter families to three surfaces
• The sixteen-object model, with the emergency stop event shown in its recorded form
• How the alert object carries the human loop, from paging to acknowledgment to recorded action
• How time synchronization keeps camera, GPS and brake pipe records within an evidence-grade budget
• Why detection runs at the edge, correlation in the yard and reasoning in the data center, with the sizing arithmetic
• How the classification budget is met with deterministic physics rather than a model turn
• The three models and the license positions that let the railroad hold and inspect every weight
• How shadow mode tests every alert before it is trusted
• The named failure modes, lessons the design encodes and the questions still open
• How Praxis contextualized the requirement, read it through eight lenses and reasoned every choice in the design

DOWNLOAD THE ARCHITECTURE

Read the complete architecture, from the security feeds that each hold one slice of a theft, through the object model, ingestion, inference placement and model register, to a gated two-phase rollout and the reasoning Praxis recorded for every choice.

A railroad that can recognize a robbery while it is happening can send the right people and hold the evidence that follows. Keeping that intelligence on its own infrastructure keeps the case, and the lessons from it, with the railroad.