Title: Preventing A Dirty Bomb--Vulnerabilities Persist in Oversight of
Licensing for Purchases of High-Risk Radioactive Materials

Description: Radioactive materials are commonly used in medical and
industrial devices. But even in small amounts, in the wrong hands, these
materials could be used to make dirty bombs. The Nuclear Regulatory
Commission (NRC) is responsible for licensing, commercial possession and
use of radioactive materials to make sure they don't end up in the wrong
hands. Our investigators went undercover to see how effective NRC's
oversight of licensing is. We find out more from GAO's Allison Bawden
and Howard Arp.

Related GAO Work: GAO-22-103441, Preventing A Dirty Bomb:
Vulnerabilities Persist in NRC's Controls for Purchases of High-Risk
Radioactive Materials

Released: July 2022

[Music]

[Allison Bawden:] We see the risk of terrorists or other bad actors
using a dirty bomb to disperse radioactive material. We see the risk of
that increasing.

[Holly Hobbs:] Hi and welcome to GAO's Watchdog Report, your source for
news and information from the U.S. Government Accountability Office. I'm
your host--Holly Hobbs. Radioactive materials are commonly used in
medical and industrial devices. But even in small amounts, in the wrong
hands, these materials could be used to make dirty bombs. The Nuclear
Regulatory Commission, or NRC, is responsible for licensing, commercial
possession and use of radioactive materials to make sure they don't end
up in the wrong hands. 
Our investigators went undercover to see how effective NRC's oversight
of licensing is. Today, we'll find out more from two GAO directors
Allison Bawden, an expert on U.S. nuclear  weapons, and Howard Arp, an
expert on investigations into fraud. Thanks for joining us. 

[Allison Bawden:] Thank you so much for having us. 

[Howard Arp:] Thank you. 

[Holly Hobbs:] So, Howard, to understand NRC's oversight and
verifications of licensing, we tested it. How did we do it? 

[Howard Arp:] So, we can't get into all the specifics of everything we
did because we're not going to write a playbook for bad actors out
there. But this was a significant joint effort. And to start with, we
had to determine whether or not we would even be able to perform such an
investigative effort and what all it would take to do so--recognizing
that there were safety and security concerns given the material we were
going to potentially be ordering. And so we had to consider many things
that unfortunately a bad actor wouldn't have to consider. So we created
some businesses and used fraudulent licenses to then make purchases from
vendors in the United States of materials. And ultimately requested to
have those materials shipped to us and held at facilities, and then we
declined those shipments and had them returned to maintain the material
in the proper regulatory control. So that was really a very quick
summary of everything we did and how we did it. 

[Holly Hobbs:] And what did we find? 

[Howard Arp:] What we found was our shell companies were able to
actually purchase dangerous quantities of radioactive material and have
that shipped to our businesses where we were able to then turn around
and return those. And that was all done based on fraudulent licenses.
And the licenses were never verified with NRC by the vendor, which
allowed for our activities to occur. 

[Holly Hobbs:] Allison there have been past incidents involving lost or
stolen radioactive materials. Can you tell us a little bit about that? 

[Allison Bawden:] You're right. These incidents are evidence of the risk
that the materials can pose, especially if they're not appropriately
protected. Most of these incidents, the 4,500 that you mentioned were
benign. But I want to focus on 34 of them that weren't. These 34
incidents represent events involving theft and sabotage and vandalism of
high risk radioactive materials. One of these incidents occurred in
April 2019, when a technician was arrested after stealing three iridium
one 92 radiography devices from his workplace in Arizona. According to a
court filing we reviewed, the technician intended to release that
radioactive material at a nearby shopping mall, but was arrested after a
two hour standoff and before he could do so. So these are real life
things that happen and risks that need attention. 

[Holly Hobbs:] So let me ask this--we looked for weaknesses in NRC's
licensing to use and possess radioactive materials. But how is it
supposed to work?

[Allison Bawden:] It's a great question. And obviously it's complicated.
And it's important to note that radioactive materials are really
important materials to multiple industries in this country. Medical
devices, food sterilization, industrial sterilization, all use
radioactive material and appropriately so. And so generally, NRC's
licensing process is based on risk associated with different quantities
of radioactive material--because the more material you have, the riskier
it is. So NRC breaks quantities down into five categories--with
categories one and two being the highest and requiring the most
stringent security measures for those who possess it or want to purchase
it, as well as the most stringent licensing requirements. 

[Holly Hobbs:] Howard said something about vendors reaching out to NRC
to verify licensing. When is that supposed to happen?

[Allison Bawden:] So when someone seeks to purchase a category one or
two quantity of material, there is a license verification process in
place. But to purchase a category three quantity of material, which is
what we did during this investigation--under current licensing rules, the
vendors selling the material simply needs to obtain a copy of the
purchaser's license and no independent verification of that license is
required. Because licenses can be granted by NRC or any of 39 states to
which NRC has delegated licensing authority, licenses can look really
different from one another, and that makes it easy for a vendor not to
know quite what to look for. Plus, licenses are still often paper based
and that can compromise their integrity. So we demonstrated during this
investigation that a bad actor could take steps to change a paper based
license and create fraudulent licenses. And we made multiple purchases
of category three quantity of material that we believe could have been
accumulated into a category two quantity of material. 

[Holly Hobbs:] And this actually isn't the first time we've investigated
NRC's oversight, right? What did we do in our prior work? 

[Allison Bawden:] So this is actually sort of the fourth investigation
that we've done, going all the way back to 2006. In March of 2006, we
demonstrated that it was possible to transport unlicensed radioactive
material through ports of entry into the U.S. using a fraudulent
license. In 2007, we used a shell company to obtain a valid NRC license,
and we altered that license to secure commitments to purchase a
dangerous quantity of radioactive material. And then in 2016, we again
established multiple shell companies and successfully obtained a valid
license for one of these companies that we again altered and used to
secure commitments to purchase material. 

[Howard Arp:] And Holly, I would like to add here, the important
distinction in this particular piece of work is that here we actually
made the orders and had the material shipped to a shipping facility
nearest our businesses, whereas in the prior ones we just obtain
commitments to make purchases. So we didn't actually go through the full
process of purchasing the material. So that's a significant difference
between this work and a prior work. 

[Holly Hobbs:] I think this all sounds very scary. We're a government
entity trying to test the system, but there could be others testing the
system that have more dark intentions. Do we know if the vulnerabilities
in NRC's oversight actually led to any radioactive materials ending up
in the wrong hands, or is this just something we're concerned about at
this point?

[Allison Bawden:] Fortunately, as of right now, this is something we're
just concerned about. But based on our current and prior work, we see
the risks of terrorists or other bad actors using a dirty bomb to
disperse radioactive material. We see the risk of that increasing. That
assessment is based on other federal agencies that are doing their own
assessments of this risk. And our prior work shows that even small
amounts of radioactive material can produce billions of dollars in
damage as well as economic and social upheaval. And our new report shows
that some key controls to keep these materials secured are not yet
effective.

{MUSIC}

[Holly Hobbs:] So, Allison and Howard just told us that GAO's
investigation into the Nuclear Regulatory Commission's oversight of
licensing showed weaknesses that could result in the illegal purchase
and use of dangerous radioactive materials, which could be used to make
a dirty bomb. So, Allison, what steps do we think NRC should take to
improve its oversight? 

[Allison Bawden:] In this investigation, we highlight a few things.
First, NRC has already begun a rulemaking process that would require
license verification for category three quantities of material. It could
take until the end of 2023 for that rulemaking to be completed. And so
we've recommended that NRC use authorities that it has to more
immediately require license verification for category three quantities
of material. In addition, we have recommended that NRC take steps to
improve the integrity of its licenses so that they're less subject to
fraud--such as requiring two factor verification or other kinds of
measures that would help validate the veracity of a license.

[Holly Hobbs:] And last question, what's the bottom line of this report?
Allison, maybe you can start? 

[Allison Bawden:] Radioactive materials are in significant use
throughout this country for all kinds of medical and industrial
purposes. And it's really important that our security regime protect
these materials and ensure that the people who possess them are
appropriately licensed. Over the last decade plus, we've demonstrated
opportunities to improve that licensing system. And this investigation
showed that we still have opportunity to improve that. 

[Holly Hobbs:] And Howard?

[Howard Arp:] Yeah, I would add that this investigation also shows GAO's
ability to perform our oversight work and the unique tools we have
available to us to conduct work such as this even, whenever there is
significant safety and security considerations. But that it is extremely
important to ensure the safety of these materials to avoid any potential
bad actor obtaining material and causing harm to citizens and others. 

[Holly Hobbs:] That was Allison Bawden and Howard Arp talking about
GAO's recent review of NRC's oversight of radioactive materials. Thanks
for your time. 

[Allison Bawden:] Thank you, Holly. 

[Howard Arp:] Thank you, Holly. 

[Holly Hobbs:] And thank you for listening to the Watchdog Report. To
hear more podcasts, subscribe to us on Apple Podcasts, Spotify, or
wherever you listen and make sure to leave a rating and review to let
others know about the work we're doing. For more from the congressional
watchdog, the U.S. Government Accountability Office, visit us at
GAO.gov.