Norfolk Southern is the party responsible I believe.
No, the owner of the freight car (a tank car I believe) that suffered a hot box is the one with primary liability. Most railway tank cars are own not by a railroad but a carrier group such as GATX.