Nuclear Security: NRC Has Enhanced the Controls of Dangerous Radioactive Materials, but Vulnerabilities Remain
Highlights
What GAO Found
The Nuclear Regulatory Commission (NRC) and the 37 states it permits to grant licenses for radioactive materials—called agreement states—have taken several steps since 2007 to help ensure that licenses are granted only to legitimate organizations and that licensees can only obtain such materials in quantities allowed by their licenses. However, NRC and agreement states have not taken some measures to better control some dangerous quantities of radioactive materials. The International Atomic Energy Agency established a system ranking quantities of certain radioactive materials into five categories based on their potential to harm human health, with, in descending order of danger, categories 1, 2, and 3 all considered dangerous. NRC developed revised guidance, screening criteria, and a checklist, among other things, and now directs NRC regions and agreement states to conduct prelicensing site visits—focusing on questions related to the applicant's business operations, facility, radiation safety operations, and personnel qualifications for all unknown applicants. NRC, however, has not strengthened controls for all categories of radioactive material considered dangerous. Unlike its process for applicants for category 1 and 2 quantities of radioactive materials, for category 3 applicants NRC does not review specific security measures before a license is issued. NRC has also developed and deployed the National Source Tracking System (NSTS), the Web-based Licensing System (WBL), and the License Verification System to better control some materials. However, these systems focus on more dangerous category 1 and 2 quantities but not category 3 quantities. Further, NRC does not specifically require that the validity of category 3 licenses be verified by the seller with NRC or the agreement states—creating risks that licenses could be counterfeited or that licensees could obtain radioactive materials in quantities greater than what is allowed by their licenses.
GAO's covert testing of NRC requirements showed them to be effective in two out of our three cases; in a third case, GAO was able to obtain a license and secure commitments to purchase, by accumulating multiple category 3 quantities of materials, a category 2 quantity of a radioactive material considered attractive for use in a “dirty bomb”—which uses explosives to disperse radioactive material. To test NRC's prelicensing processes, GAO established three fictitious companies, leased vacant space for each company (two in agreement states, one in an NRC state), and submitted an application to the appropriate agreement state or NRC office for a license to possess a category 3 source only slightly below the threshold for category 2. GAO made no attempt to outfit the site to make it appear as if a legitimate business was operating there. In the two cases where GAO was unable to obtain a license, the scrutiny provided by NRC or agreement state (regulatory body) officials during the prelicensing site visit led to the license not being granted. In the third case, the official from the regulatory body accepted GAO's assurances without scrutinizing key aspects of the fictitious business, which led to a license being obtained. NRC is currently taking corrective actions to provide training to NRC and agreement state officials to emphasize greater scrutiny in conducting prelicensing site visits. According to NRC officials, NRC and agreement state working groups are currently developing and evaluating enhancements to (1) prelicensing guidance overall and (2) license verification and transfer requirements for category 3 licenses.
Why GAO Did This Study
In 2007, GAO reported weaknesses in NRC's licensing program as GAO investigators, after setting up fictitious companies, were able to obtain an NRC license and then alter it to obtain agreements to purchase devices containing, in aggregate, a dangerous quantity of radioactive materials.
GAO was asked to review and assess the steps NRC and agreement states have taken to strengthen their licensing processes. This report examines (1) the steps NRC and agreement states have taken to ensure that radioactive materials licenses are granted only to legitimate organizations and licensees can obtain materials only in quantities allowed by their licenses; and (2) the results of covert vulnerability testing designed to test the effectiveness of these controls. GAO reviewed relevant guidance documents, regulations, and analyses of orders, and interviewed NRC and state officials. GAO also established three fictitious businesses and applied for a radioactive materials license for each.
Recommendations
GAO is making three recommendations to NRC, including that NRC (1) take steps to include category 3 quantities of radioactive materials in NSTS and WBL, and (2) require that transferors of category 3 quantities of radioactive materials confirm the validity of licenses with regulators before selling or transferring these materials. GAO provided a draft of this report to NRC for comment. NRC neither agreed nor disagreed with GAO's recommendations, but noted that the agency has formal evaluations underway considering all three recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Nuclear Regulatory Commission |
Priority Rec.
Because some quantities of radioactive materials are potentially dangerous to human health if not properly handled, NRC should take action to better track and secure these materials and verify the legitimacy of the licenses for those who seek to possess them. Specifically, the NRC should take the steps needed to include category 3 sources in the National Source Tracking System and add agreement state category 3 licenses to the Web-based Licensing System as quickly as reasonably possible. |
In October 2016, NRC issued a Staff Requirements Memorandum (SRM) "Proposed Staff Re-Evaluation of Category 3 Source Accountability," (SRM-COMJMB-16-0001) and directed NRC staff to take specific actions to evaluate whether it is necessary to revise NRC regulations or processes governing source protection and accountability for category 3 sources. Among other things, this re-evaluation considered GAO's recommendations. In August 2017, NRC staff completed its analysis and provided recommendations to the NRC Commissioners. (Most of this analysis is available on NRC's website.) In its analysis, the NRC staff recommended not including category 3 sources in the National Source Tracking System. They also recommended not adding agreement state category 3 licenses to the Web-based Licensing System. Subsequently, in December 2021, NRC issued SECY-17-0083: Re-Evaluation of Category 3 Source Security and Accountability in Response to SRM-COMJMB-16-0001. If this SRM is implemented, it would provide an incentive for agreement states to use the Web-Based Licensing System (WBL). According to NRC staff, the SRM will have to go through public comment, and NRC is uncertain when it will be implemented. Furthermore, according to agency staff, NRC has no plans to put category 3 quantities into the National Source Tracking System (NSTS).
|
| Nuclear Regulatory Commission |
Priority Rec.
Because some quantities of radioactive materials are potentially dangerous to human health if not properly handled, NRC should take action to better track and secure these materials and verify the legitimacy of the licenses for those who seek to possess them. Specifically, the NRC should at least until such time that category 3 licenses can be verified using the License Verification System, require that transferors of category 3 quantities of radioactive materials confirm the validity of a would-be purchaser's radioactive materials license with the appropriate regulatory authority before transferring any category 3 quantities of licensed materials. |
In October 2016, NRC issued a Staff Requirements Memorandum (SRM) "Proposed Staff Re-Evaluation of Category 3 Source Accountability," (SRM-COMJMB-16-0001) and directed NRC staff to take specific actions to evaluate whether it is necessary to revise NRC regulations or processes governing source protection and accountability for category 3 sources. Among other things, this re-evaluation considered GAO's recommendations. In August 2017, NRC staff completed its analysis and provided recommendations to the NRC Commissioners. (Most of this analysis is available on NRC's website.) In its analysis, the NRC staff recommended not requiring transferors of category 3 quantities of radiological material to confirm the validity of licenses prior to transferring any category 3 quantities of these materials. In December 2021, NRC issued SECY-17-0083: Re-Evaluation of Category 3 Source Security and Accountability in Response to SRM-COMJMB-16-0001. This SRM recommends requiring licensees transferring category 3 quantities of radioactive material to verify licenses through the Licensee Verification System (LVS) or by calling the Agreement State office. If NRC were to take action, it would fully address this recommendation. However, the process must undergo a public comment period and NRC officials are uncertain when the rulemaking will be completed.
|
| Nuclear Regulatory Commission | Because some quantities of radioactive materials are potentially dangerous to human health if not properly handled, NRC should take action to better track and secure these materials and verify the legitimacy of the licenses for those who seek to possess them. Specifically, the NRC should, as part of the ongoing efforts of NRC working groups meeting to develop enhancements to the prelicensing requirements for category 3 licenses, consider requiring that an on-site security review be conducted for all unknown applicants of category 3 licenses to verify that each applicant is prepared to implement the required security measures before taking possession of licensed radioactive materials. |
In 2017, NRC staff conducted an analysis of options to address our recommendation. In its analysis, staff recommended the Commission pursue non-rulemaking and rulemaking options to update NRC's pre-licensing security review process. In 2019, NRC updated guidance that regulators are required to use when conducting pre-licensing site visits for unknown applicants for licenses to possess radioactive materials, including category 3 quantities of such materials. The updated guidance clarifies what constitutes a known and unknown applicant, requires that regulators conduct in-person pre-licensing site visits of all such unknown applicants, and includes questions regarding applicants' ability to provide for adequate security. We originally considered this recommendation open while NRC also developed a draft rule that would have further strengthened NRC's response to our recommendation. However, in March 2024, NRC staff informed us that the Commission tied 2-to-2 on a decision to propose the draft rule, meaning the rule would not be promulgated. NRC staff we spoke with in March 2024 stated that NRC has no further plans to pursue the rulemaking or our recommendation. However, after discussions with NRC staff, we determined that NRC's 2019 actions to update its required pre-licensing guidance nonetheless also address our recommendation by providing for adequate assurance that unknown applicants are legitimate and are prepared to provide adequate security for their radioactive materials.
|