If Philadelphia's 30th Street Station needed to be locked down in an emergency, the task would be difficult because Amtrak's staff doesn't have keys to secure the doors.
The situation would be compounded by a number of additional security problems, including other exterior doors without locks and security cameras that don't work.
These security lapses were uncovered by Amtrak's inspector general and made public Monday in an explosive audit report.
30th Street Station, Philadelphia's main train station, is Amtrak's third-busiest station, handling more than 4.4 million passengers a year. The building also houses a SEPTA regional rail station, serves as a major meeting place and is the central hub for the Schuylkill Yards development project that aims to transform the eastern end of University City.
Busy train stations such as 30th Street are often cited by government and private sector security officials as high-risk targets for nefarious activity, including terror attacks.
According to the report, an inspection in November found an undisclosed number of the station's doors can't be locked because they either lack locks or because staff don't have keys for them.
For the keys that do exist, management is unsure who may have copies of them.
The audit also dinged Philadelphia officials for not properly using a security badge system and not regularly changing codes on combination locks.
More than 450 staff members have security badges that will open doors and control elevators at 30th Street Station, but only 26 employees work there, the report says. Moreover, more than two dozen employees have more than one duplicate security badge in their possession.
Some staff said codes have remained the same for several years allowing, in at least one instance, a fired employee to get into a restricted area.
In a most egregious example, an employee told inspectors that a gate allowing access to the 36-acre Penn Coach Yard, which is adjacent to the station, hasn't had the code changed in 20 years.
The yard, which sits just north of the station, has several security issues as well. According to the report, trespassers regularly access areas where trains are either traveling or sitting by entering through broken fencing or open entrances.
In 2013, a drunk driver drove onto tracks in the yard. Auditors also found a boat and sports car being stored in the train yard. Neither are owned by Amtrak.
In addition to the physical security troubles, some staff members said they lacked the proper training to deal with major security events like an active shooter or terrorist attack. Auditors said training classes focused on these events were removed to "reduce the length of required training for frontline employees."
The security issues were first uncovered in 2009, but have remained unaddressed mostly because of money, according to the report.
Officials in Philadelphia requested $750,000 to fix the door lock issue, but that request was denied by the company's finance department saying internal teams could handle the project. Inspectors said that left the project at a stalemate.
The report said Amtrak spent $12 million since 2009 to fix security issues. But they say it would cost an additional $20 million to fully address the problems.
In a short statement to NBC10, local Amtrak officials said they "already started to address the identified security vulnerabilities."
According to the report, Amtrak officials planned to fix the door locks, badging and surveillance systems by December. They vowed to address security in the train yard and training for staff by March 2019.
Bob Casey, the U.S. Senator from Pennsylvania, said the report highlights the longstanding issue surrounding Amtrak: underfunding.
"Amtrak has been underfunded for years and this is one more example why we need to invest in our national infrastructure and Amtrak," he said via email.