On July 15, 2016, the Government Accountability Office (GAO) released GAO-16-330 titled, “Nuclear Security: NRC Has Enhanced the Controls of Dangerous Radioactive Materials, but Vulnerabilities Remain.” The report examines
- the steps that the U.S. Nuclear Regulatory Commission (NRC) and the 37 states it permits to grant licenses for radioactive materials—called Agreement States—have taken to ensure that radioactive materials licenses are granted only to legitimate organizations and licensees can obtain materials only in quantities allowed by their licenses; and,
- the results of covert vulnerability testing designed to test the effectiveness of these controls.
In the report, GAO concludes that NRC and Agreement States have taken several steps to help ensure that radioactive materials licenses are granted only to legitimate organizations and that licensees can only obtain such materials in quantities allowed by their licenses.
However, GAO also determined that NRC and Agreement States have not taken some measures for better controlling Category 3 quantities of radioactive material—such as tracking and agency license verification—that leave vulnerabilities.
GAO-16-330 was prepared in response to a request from the Committee on Homeland Security of the U.S. House of Representatives.
GAO-16-330 can be obtained online at www.gao.gov/assets/680/678170.pdf.
Background
In 2007, a GAO covert vulnerability testing effort revealed weaknesses in the NRC’s licensing program when GAO investigators, after setting up fictitious companies, were able to obtain an NRC license and then alter it to obtain agreements to purchase devices containing, in aggregate, a dangerous quantity of radioactive materials.
In 2008, however, GAO found that NRC had worked with the Agreement States and others to
- identify sealed sources of greatest concern;
- enhance requirements to secure radioactive sources; and,
- ensure that security requirements were implemented.
In addition, GAO found that NRC had made progress toward implementing recommendations to
- modify its process for issuing licenses to ensure that radioactive materials cannot be purchased by those with no legitimate need for them; and,
- examine whether certain radioactive sources should be subject to more stringent regulations.
Nonetheless, the 2008 GAO work also found that NRC could do more to ensure the security of radioactive materials. Specifically, GAO recommended that, among other things, NRC take steps to develop and implement the systems it was then planning to better track, secure and control radioactive materials
The Committee on Homeland Security then asked GAO to review and assess the steps NRC and the Agreement States have taken to strengthen their licensing processes since the 2007 covert vulnerability testing and subsequent 2008 GAO report.
Methodology
In preparing the new report, GAO reviewed relevant guidance documents, regulations, and analyses of orders. GAO also interviewed NRC and state officials.
In addition, GAO tested the effectiveness of the NRC and Agreement State controls through the use of covert investigative techniques. Specifically, GAO established fictitious businesses and applied for radioactive materials licenses in three states—two Agreement States and one NRC state—for a license to possess a Category 3 source only slightly below the threshold for Category 2.
In all three states, GAO leased vacant space in an industrial or office park. GAO made no attempt to outfit the sites to make it appear as if legitimate businesses were operating there. Instead, GAO used these spaces as the physical addresses of fictitious businesses and these locations were later the subject of pre-licensing site visits by Agreement State or NRC officials as part their pre-licensing reviews of GAO’s applications.
GAO selected the three states based on a non-generalizable sampling strategy focusing on states with a history of issuing the largest numbers of radioactive materials licenses for the type of devices GAO sought for its fictitious businesses and, in one case, a state that GAO believes to have a history of weaknesses in its radioactive materials regulatory program.
Findings
GAO-16-330 finds that the NRC and Agreement States have taken several steps since 2007 to help ensure that licenses are granted only to legitimate organizations and that licensees can only obtain such materials in quantities allowed by their licenses.
However, GAO determined that NRC and Agreement States have not taken some measures to better control some dangerous quantities of radioactive materials that could be used in a “dirty bomb,” which uses explosives to disperse radioactive material.
Screening Criteria, Site Visit Checklist and Guidance The International Atomic Energy Agency (IAEA) established a system ranking quantities of certain radioactive materials into five categories based on their potential to harm human health. In descending order of danger, Categories 1, 2, and 3 are all considered dangerous under the IAEA system.
NRC developed revised guidance, screening criteria, and a checklist, among other things, and now directs NRC regions and Agreement States to conduct pre-licensing site visits that focus on questions related to the applicant’s business operations, facility, radiation safety operations, and personnel qualifications for all unknown applicants.
GAO-16-330 finds, however, that NRC has not strengthened controls for all categories of radioactive material considered dangerous. Specifically, unlike its process for applicants for Category 1 and 2 quantities of radioactive materials, NRC does not review specific security measures before a license is issued for Category 3 applicants.
Tracking, Licensing and Verification Systems NRC has also developed and deployed the National Source Tracking System (NSTS), the Web-based Licensing System (WBL), and the License Verification System (LVS) to better control some materials. However, GAO-16-330 notes that these systems focus on more dangerous Category 1 and 2 quantities, but not Category 3 quantities. Further, NRC does not specifically require that the validity of Category 3 licenses be verified by the seller with NRC or the Agreement States—creating risks that licenses could be counterfeited or that licensees could obtain radioactive materials in quantities greater than what is allowed by their licenses.
Covert Testing Results GAO’s covert testing of NRC requirements showed them to be effective in two out of three cases. In the third case, however, GAO was able to obtain a license. GAO altered the license and secured commitments from two companies to purchase—by accumulating multiple Category 3 quantities of materials—a Category 2 quantity of a radioactive material considered attractive for use in a dirty bomb.
In the two cases where GAO was unable to obtain a license, the scrutiny provided by NRC or Agreement State (regulatory body) officials during the pre-licensing site visit led to the license not being granted. In the third case, the official from the regulatory body accepted GAO’s assurances without scrutinizing key aspects of the fictitious business, which led to a license being obtained.
Corrective Actions Upon learning of the GAO actions, NRC immediately confirmed that the Agreement State knew that the license was obtained under false pretenses and revoked it, as well as notified manufacturers and distributors of the revocation. NRC also made sure that the 36 other Agreement States knew about the issue.
Working with the Agreement State that issued the license, NRC found that the licensing staff did not complete all the required steps of the pre-licensing procedures. NRC has taken corrective actions to provide training to NRC and Agreement State officials to emphasize greater scrutiny in conducting pre-licensing site visits. All licensing and inspection staff at the NRC and in the Agreement States completed this re-training in December 2015.
NRC and Agreement State officials also formed working groups to identify lessons learned from the GAO operation. The groups, which have been meeting since January 2016, are currently developing and evaluating enhancements to pre-licensing guidance overall, as well as to license verification and transfer requirements for category 3 licenses. Once this work is completed, NRC staff will present to agency management and Commissioners any policy questions that emerge from the reviews, including whether staff believes that changes are needed to the current security and tracking requirements for radioactive materials.
Recommendations
Because some quantities of radioactive materials are potentially dangerous to human health if not properly handled, GAO recommends that NRC take action to better track and secure these materials and verify the legitimacy of the licenses for those who seek to possess them.
Specifically, GAO recommends that NRC take the following three actions:
- take the steps needed to include Category 3 sources in the NSTS and add Agreement State Category 3 licenses to the WBL as quickly as reasonably possible;
- at least until such time that Category 3 licenses can be verified using the LVS, require that transferors of Category 3 quantities of radioactive materials confirm the validity of a would-be purchaser’s radioactive materials license with the appropriate regulatory authority before transferring any Category 3 quantities of licensed materials; and,
- as part of the ongoing efforts of NRC working groups meeting to develop enhancements to the pre-licensing requirements for Category 3 licenses, consider requiring that an on-site security review be conducted for all unknown applicants of Category 3 licenses to verify that each applicant is prepared to implement the required security measures before taking possession of licensed radioactive materials.
GAO provided a draft of GAO-16-330 to NRC for comment. NRC neither agreed nor disagreed with GAO’s recommendations, but noted that the agency has formal evaluations underway considering all three recommendations.
For additional information, please contact David Trimble at (202) 512-3841 or at trimbled@gao.gov.