NJ Transit's Use of Modeling Software Miscalculated Storm Surge Threat Level

New Jersey Transit's use of a federal government storm modeling software underestimated the threat of storm surges to the Meadows Maintenance Complex, leaving millions of dollars worth of equipment in the rail yard before Hurricane Sandy struck.

Risk classification

• Primary risk domain: 5 Human-Computer Interaction
• Primary risk subdomain: 5.1 Overreliance and unsafe use

NJ Transit officials relied on the outputs of the SLOSH simulation software despite inputting incorrect parameters and ignoring explicit, severe storm surge warnings from the National Weather Service.

Causal factors

• Entity: Human
• Intent: Unintentional
• Timing: Post-deployment

The incident was caused by human operators inputting incorrect parameters into the SLOSH software, leading to an unintended underestimation of the storm surge during active deployment.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The system is used in critical infrastructure, specifically for emergency planning and decision-making in public transit (NJ Transit), which has significant implications for public safety and infrastructure protection.

AI system and alleged parties

• AI system: federal government storm modeling software
• AI purpose: Behavioral Modeling; Threat Detection
• Behaviour type: Tool
• Alleged developer: National Weather Service
• Alleged deployer: New Jersey Transit
• Alleged harmed parties: New Jersey Transit passengers, New Jersey Transit

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Substantial, indirect Substantial
• Property: direct Severe, indirect Negligible
• Financial: direct Severe, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Infrastructure

Reported: The report explicitly describes extensive damage to transit infrastructure, specifically rail cars and maintenance facilities.

Directly caused: A storm surge engulfed hundreds of rail cars (over a quarter of NJ Transit's fleet) stored at the Meadows Maintenance Complex and Hoboken yards.

Indirectly caused: The inundation of the rail yards and equipment caused months of service disruptions and delays for passengers.

Property

Reported: The report explicitly describes damage to NJ Transit's rolling stock (trains and locomotives).

Directly caused: Over a quarter of the agency's fleet (hundreds of rail cars, some brand new) and one-third of its locomotives were inundated and damaged, costing over $120 million (or $100 million according to Report 2).

Financial

Reported: The report explicitly describes financial losses of over $120 million (Report 1) or $100 million (Report 2) due to equipment damage. For the 1 occurrence, the average financial loss is approximately $120 million.

Directly caused: An average financial loss of $120 million per occurrence due to the damage to hundreds of rail cars and locomotives.

Inferred additional harm: It is likely that the total financial impact, including lost productivity from commuter delays and repair costs for the maintenance facilities, was significantly higher than the reported $120 million.

People affected

• Occurrences reported: 1
• People reportedly harmed: 900000
• People reportedly exposed: 900000

Potential causes

Management

• Ignored Climate Risk Reports: Leadership failed to study or act on internal climate vulnerability reports.
• Poor Leadership Communication: NJ Transit executive director and Governor did not communicate before storm.
• Security Prioritized Over Weather: Emergency planning focused on active shooters rather than weather events.

Technology

• Incorrect Simulation Inputs: Software modeled wrong storm direction and speed, underestimating surge.
• Misuse of SLOSH Software: NWS simulation software was used incorrectly by untrained transit officials.
• Lack of Software Guardrails: The software allowed highly unrealistic inputs without flagging anomalies.

Data Inputs

• Flawed Weather Model Inputs: Inputs had storm going northeast at 10mph instead of west-northwest at 20mph.
• Ignored Official Forecast Data: Official NWS warnings of 15-foot surges were not used in the local model.
• Lack of Real-Time Data Validation: No process to validate simulation inputs against actual NWS briefing data.

Human Factors

• Confirmation Bias in Modeling: Officials accepted low surge outputs because they aligned with history.
• Lack of Technical Expertise: Staff lacked training to correctly operate the storm simulation software.
• Overreliance on Flawed Model: Blind trust in the incorrect 3-foot surge output over actual warnings.

Process and Methods

• No Consultation with Experts: NJ Transit failed to contact NWS to verify their simulation parameters.
• Inadequate Emergency Modeling: Modeling was treated as a real-time decision tool rather than planning tool.
• Lack of Peer Review for Models: No internal or external review of the simulation setup was conducted.

Regulatory Environment

• No Standard for Transit Modeling: Absence of regulatory standards for climate risk and storm surge modeling.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, consistent, and highly detailed accounts of the incident, including specific technical details about the incorrect inputs (northeast trajectory, 10 mph speed), the resulting underestimated surge (3 feet vs 9.23 feet), and the exact financial and physical damage ($100-$120 million, over a quarter of the fleet). Statements from NWS meteorologists and NJ Transit officials are directly quoted, leaving very little ambiguity about the sequence of events.
• Ambiguities identified: The exact internal process of who entered the incorrect data and why they chose those specific parameters remains unconfirmed as NJ Transit declined to answer specific questions.
• Alternative interpretations: One could argue this is purely a human management failure rather than an AI safety incident, but the central role of the SLOSH simulation software in justifying the decision makes it a clear case of overreliance on incorrectly used technology.

NJ Transit staff incorrectly configured the NWS SLOSH storm surge model, leading to an underestimation of Hurricane Sandy's impact. Relying on this flawed output, the agency stored locomotives in low-lying yards, resulting in over 100 million dollars in damage to transit infrastructure and months of severe commuter disruptions, highlighting critical infrastructure vulnerabilities to model overreliance.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: NJ Transit staff

Threat characteristics

• Imminence: Long-term. The incident represents an ongoing strategic concern regarding how public agencies integrate and rely on predictive models for emergency planning.
• Autonomy: Human-controlled. The SLOSH software acted purely as a tool assisting decision-makers, requiring manual input of parameters and human interpretation of results.
• Novelty: Established threat. Human error in data entry and overreliance on computer simulations are well-established operational risks in emergency management.

Impact by dimension

• Physical security: Substantial. Incorrect use of storm surge modeling led to the flooding of a major transit maintenance complex, damaging over a quarter of the passenger fleet and causing months of severe service disruptions to critical public transportation infrastructure.
• Information security: Negligible. No information warfare, espionage, or intelligence compromise occurred in connection with this incident.
• Sovereignty: Minor. A state transit agency's emergency decision-making process was compromised due to flawed simulation inputs, leading to localized governance and operational failures during a natural disaster.
• Economic security: Substantial. The incident resulted in direct property damage of 100 to 120 million dollars to transit assets and caused significant indirect economic disruption by halting commutes for nearly 900,000 daily workers in a major economic corridor.
• Societal stability: Minor. While causing massive daily disruption and frustration to nearly a million commuters, the incident did not threaten basic human rights, civil liberties, or broader societal stability.