March 30, 2007 

MEMORANDUM TO: Luis A. Reyes 

 Executive Director for Operations 

FROM: Stephen D. Dingbaum/RA/ 

Assistant Inspector General for Audits 

SUBJECT: SUMMARY REPORT AND PERSPECTIVES ON 

BYPRODUCT MATERIAL SECURITY AND 

CONTROL (OIG-07-A-12) 

This report presents the results of the subject audit. Agency comments provided 

at the exit conference on October 4, 2006, and in a written response, dated 

January 12, 2007, have been incorporated, as appropriate, into this report. 

Appendix B contains a copy of the agency’s written comments and Appendix C 

contains our response. 

Please provide information on actions taken or planned on the recommendation 

contained in this report within 30 days of the date of this memorandum. Actions 

taken or planned are subject to OIG follow up as stated in Management 

Directive 6.1. 

We appreciate the courtesies and cooperation extended to us by members of 

your staff during the audit. If you have any questions or comments about our 

report, please contact me at 301-415-5915, or Tony Lipuma at 415-5910. 

Attachment: As stated 
ELECTRONIC DISTRIBUTION

 

Frank P. Gillespie, Executive Director, Advisory Committee on Reactor 

Safeguards/Advisory Committee on Nuclear Waste 

E. Roy Hawkens, Chief Administrative Judge, Atomic Safety and 

 Licensing Board Panel 

Karen D. Cyr, General Counsel 

John F. Cordes, Jr., Director, Office of Commission Appellate Adjudication 

Jesse L. Funches, Chief Financial Officer 

Luis A. Reyes, Executive Director for Operations 

Janice Dunn Lee, Director, Office of International Programs 

Rebecca L. Schmidt, Director, Office of Congressional Affairs 

Eliot B. Brenner, Director, Office of Public Affairs 

Annette Vietti-Cook, Secretary of the Commission 

William F. Kane, Deputy Executive Director for Reactor 

 and Preparedness Programs, OEDO 

Martin J. Virgilio, Deputy Executive Director for Materials, Research, 

 State and Compliance Programs, OEDO 

Jacqueline E. Silber, Deputy Executive Director for Information Services 

 and Administration and Chief Information Officer, OEDO 

Michael R. Johnson, Assistant for Operations, OEDO 

Timothy F. Hagan, Director, Office of Administration 

Cynthia A. Carpenter, Director, Office of Enforcement 

Charles L. Miller, Director, Office of Federal and State Materials 

 and Environmental Management Programs 

Guy P. Caputo, Director, Office of Investigations 

Edward T. Baker, Director, Office of Information Services 

James F. McDermott, Director, Office of Human Resources 

R. William Borchardt, Director, Office of New Reactors 

Jack R. Strosnider, Director, Office of Nuclear Material Safety and Safeguards 

James E. Dyer, Director, Office of Nuclear Reactor Regulation 

Brian W. Sheron, Director, Office of Nuclear Regulatory Research 

Corenthis B. Kelley, Director, Office of Small Business and Civil Rights 

Roy P. Zimmerman, Director, Office of Nuclear Security and Incident Response 

Samuel J. Collins, Regional Administrator, Region I 

William D. Travers, Regional Administrator, Region II 

James L. Caldwell, Regional Administrator, Region III 

Bruce S. Mallett, Regional Administrator, Region IV 
AUDIT REPORT 

Summary Report and Perspectives on 

Byproduct Material Security and Control 

OIG-07-A-12 March 30, 2007 

All publicly available OIG reports (including this report) are accessible through 

NRC’s Web site at: 

http:/www.nrc.gov/reading-rm/doc-collections/insp-gen/ 
Summary Report and Perspectives on Byproduct Material Security and Controls 

i

EXECUTIVE SUMMARY 

BACKGROUND

The events of September 11 made it clear that terrorists have the 

patience and ability to plan and conduct devastating attacks in the 

U.S. The National Strategy for Homeland Security describes 

terrorists as “strategic actors” who choose their targets deliberately 

based on the weaknesses they observe in U.S. defenses and 

preparations, adjust their plans in response to U.S. efforts to close 

vulnerabilities, and shift their focus to other, exposed vulnerabilities. 

The strategy also states that terrorists are working to obtain 

chemical, biological, radiological, and nuclear weapons, and that 

the knowledge, technology, and materials needed to build such 

weapons is spreading. 

After September 11, NRC acted immediately to begin addressing 

physical security in the byproduct material program. This included 

conducting security assessments for a sample of various types of 

material licensees. NRC also has some on-going efforts that are 

intended to improve material security. 

In February 2005, the NRC Office of Inspector General (OIG) 

began a review to determine if NRC's oversight of byproduct 

material provides reasonable assurance that licensees are using 

the material safely and account for and control material. During 

2006, OIG issued three reports related to material tracking and 

licensing. Also during this timeframe, the Government 

Accountability Office (GAO) conducted an investigation to ascertain 

whether radioactive sources could be smuggled across U.S. 

borders. 

PURPOSE

Through this report, OIG seeks to synthesize the findings of 

previous OIG and GAO reviews and investigations in order to 

provide a more complete perspective of NRC’s approach to 

byproduct material security and control. The specific objective for 

this report was to discuss whether NRC has adequately adapted its 

approach to byproduct material security in the post-September 11 

era in accordance with the expectations of congressional and 

executive policymakers and the American people. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

ii

RESULTS IN BRIEF

While NRC has implemented or planned a variety of measures to 

regulate and provide for the security of byproduct material in the 

post-September 11 era, the agency, in its approach to byproduct 

material security, has not adequately identified and evaluated 

byproduct material security risks. Specifically, the NRC has not 

conducted an impartial and comprehensive look inwards at its own 

business and regulatory processes. Consequently, the agency is 

not aware of potential weaknesses and vulnerabilities in its 

byproduct material security program. Furthermore, NRC’s 

approach has resulted in an agency policy and some practices that 

do not consider the full range of potential consequences of a 

radiological dispersal device (RDD or “dirty bomb”). 

RECOMMENDATION

This report recommends that the Executive Director for Operations 

convene an independent panel of experts external to the agency to 

identify agency vulnerabilities concerning NRC’s material licensing 

and tracking programs and validate the agency’s ongoing 

byproduct material security efforts. 

OIG ANALYSIS OF AGENCY COMMENTS

On January 12, 2007, the NRC provided comments concerning the 

draft audit report and stated its belief that the agency’s current 

participation in an independent, inter-agency Task Force on 

Radiation Source Protection and Security, as well as securityrelated actions implemented prior to the formation of the Task 

Force, meets the objectives of OIG’s recommendation. However, 

the Task Force did not perform a comprehensive vulnerability 

assessment of NRC material programs. Such an assessment 

should necessarily include examination of the management, 

operational, and technical security controls and the extent to which 

these controls are (1) implemented correctly, (2) operating as 

intended, and (3) producing the desired outcome with respect to 

mitigating security vulnerabilities. Furthermore, the Task Force, 

chaired by the NRC and staffed by members of the agency, was 

not independent. 

Finally, the agency response does not acknowledge the need to 

perform an impartial, comprehensive review as a measure of selfassurance with regard to unknown vulnerabilities. Appendix B 

contains NRC’s formal comments and Appendix C contains OIG’s 

response to the agency’s comments. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

iii

ABBREVIATIONS AND ACRONYMS 

CBP Customs and Border Protection 

CIA Central Intelligence Agency 

DOD Department of Defense 

DOE Department of Energy 

DHS Department of Homeland Security 

the Act Energy Policy Act of 2005 

FBI Federal Bureau of Investigation 

FSME Office of Federal and State Materials and 

Environmental Management Programs 

GAO Government Accountability Office 

IAEA International Atomic Energy Agency 

9/11 Commission National Commission on Terrorist Attacks 

Upon the United States 

NMSS Office of Nuclear Material Safety and 

Safeguards 

NRC Nuclear Regulatory Commission 

NSIR Office of Nuclear Security and Incident 

Response 

NSTS National Source Tracking System 

OIG Office of the Inspector General 

RDD radiological dispersal device 

Task Force Radiation Source Protection and Security Task 

Force 
Summary Report and Perspectives on Byproduct Material Security and Controls 

iv

[Page intentionally left blank.] 
Summary Report and Perspectives on Byproduct Material Security and Controls 

v

TABLE OF CONTENTS 

 EXECUTIVE SUMMARY.........................................................................i 

 ABBREVIATIONS AND ACRONYMS ................................................... iii 

 I. BACKGROUND .............................................................................1 

 II. PURPOSE......................................................................................5 

 III. FINDING ........................................................................................6 

NRC Efforts to Regulate Byproduct Material Security .................6 

 IV. SUMMARY AND CONCLUSION .................................................18 

 APPENDIX 

 A. SCOPE AND METHODOLOGY...................................................21 

B. FORMAL AGENCY COMMENTS ................................................25 

 C. OIG ANALYSIS OF AGENCY COMMENTS ................................31 
Summary Report and Perspectives on Byproduct Material Security and Controls 

vi

[Page intentionally left blank.] 
Summary Report and Perspectives on Byproduct Material Security and Controls 

1

I. BACKGROUND 

The Nuclear Regulatory Commission’s (NRC) mandate to protect 

public health and safety and the environment, and to provide for the 

common defense and security, includes regulation of radioactive 

byproduct material. Byproduct material includes radioactive 

material generated by or from a nuclear reactor.1 It is used in 

medical, academic, and industrial applications, as well as consumer 

products such as smoke detectors and “exit” signs. 

 Agreement State Program 

In accordance with section 274 of the Atomic Energy Act of 1954, 

as amended, NRC has relinquished its authority to regulate 

byproduct material to selected States. The States must first 

demonstrate that their regulatory programs are compatible with 

NRC’s program and adequate to protect public health and safety. 

The 34 States which currently have an agreement with NRC to 

assume this regulatory authority are called Agreement States. The 

Agreement States, shown in Figure 1 below, administer about 

17,450 material licenses, while NRC administers approximately 

4,500 such licenses. 

 

1 The Atomic Energy Act of 1954, as amended, defines byproduct material, as (1) any radioactive material 

(except special nuclear material) yielded in or made radioactive by exposure to the radiation incident to the 

process of producing or utilizing special nuclear material; (2) the tailings or wastes produced by the 

extraction or concentration of uranium or thorium from any ore processed primarily for its source material 

content; (3)(A) any discrete source of radium-226 that is produced, extracted, or converted after extraction, 

before, on, or after the date of enactment of this paragraph for use for a commercial, medical, or research 

activity; or (B) any material that—(i) has been made radioactive by use of a particle accelerator; and (ii) is 

produced, extracted, or converted after extraction, before, on, or after the date of enactment of this 

paragraph for use for a commercial, medical, or research activity; and (4) any discrete source of naturally 

occurring radioactive material, other than source material, that—(A) the Commission, in consultation with the 

Administrator of the Environmental Protection Agency, the Secretary of Energy, the Secretary of Homeland 

Security, and the head of any other appropriate Federal agency, determines would pose a threat similar to 

the threat posed by a discrete source of radium-226 to the public health and safety or the common defense 

and security; and (B) before, on, or after the date of enactment of this paragraph is extracted or converted 

after extraction for use in a commercial, medical, or research activity. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

2

Figure 1: Agreement and Non-Agreement States 

Source: http://nrc-stp.ornl.gov/ [as of March 2007] 

 Byproduct Material Safety and Security 

Responsibility for byproduct material safety and security is shared 

among several organizations in NRC. These include the Office of 

Nuclear Material Safety and Safeguards (NMSS), the Office of 

Nuclear Security and Incident Response (NSIR), the Office of 

Federal and State Materials and Environmental Management 

Programs (FSME), and NRC’s regional offices. 

NRC Management Directive 9.26 spells out NMSS’ responsibilities 

to regulate material licenses.2

 Among other things, the directive 

authorizes the NMSS Director to prescribe license conditions and 

recommend rules and regulations for safety, material accounting, 

and physical security measures amongst U.S. material licensees. 

In 2002, NRC created NSIR to consolidate certain safeguards, 

security, and incident response functions under one organization, 

including some security functions previously under NMSS. 

According to NSIR’s Web page on the NRC intranet, its mission is 

“to prevent nuclear security incidents and prepare for and respond 

to safety and security events.” Essentially, NSIR is the lead NRC 

 

2 Management Directive 9.26, Chapter NRC-0124, “Organization and Functions, Office of Nuclear Material 

Safety and Safeguards,” October 27, 1989.
Summary Report and Perspectives on Byproduct Material Security and Controls 

3

organization for security in the byproduct material program, and 

NMSS and NRC’s regional offices are the lead organizations for 

safety. 

NMSS and the Agreement States have assumed responsibility for 

many byproduct materials under NRC’s public health and safety 

authority3

 and are responsible for knowing who and where the 

licensees are. The NRC regional offices are responsible for 

implementing any security changes to the license review and 

inspection process developed by NSIR and issued by NMSS. 

License reviewers and inspectors in the regional offices are the 

eyes and ears of the agency, interacting with licensees and the 

material user community. 

FSME was established as part of an agency reorganization on 

October 1, 2006. It has been charged with developing and 

implementing rules and guidance for the safe and secure use of 

source, byproduct, and special nuclear material. This includes 

providing and updating guidance on material licensing and 

inspection in the regions. It also has responsibility for all safety and 

security interface issues between NRC and the Agreement States. 

 Byproduct Material and the Dirty Bomb 

The terrorist attacks of September 11, 2001, heightened the 

Nation’s concerns that the loss or theft of radioactive material could 

lead to malicious use in a radiological dispersal device (RDD). An 

RDD, also known as a dirty bomb, is a conventional explosive that 

incorporates radioactive material and releases it on detonation. 

The major purpose of a dirty bomb is to create terror and disruption, 

not to cause death by radiation. 

There is widespread agreement in the Federal Government 

regarding the threat and effects of a dirty bomb. In a June 2003 

press release, the White House stated, “There is growing concern 

that terrorists or the states which support them could acquire 

radioactive sources to construct dirty bombs. Detonation of a dirty 

bomb could harm civilians and result in severe economic costs.”4

 

For example, a September 2005, BusinessWeek Online article 

postulated that the economic losses from a dirty bomb exploded 

outside the New York Stock Exchange could reach $1 trillion. The 

threat posed by a potential dirty bomb is also reflected in a 

 

3

 While Agreement States have authority to license byproduct material in their respective states, the Atomic 

Energy Act of 1954, as amended, prevents the NRC from delegating “common defense and security” 

authority to Agreement States. 

4 The White House Office of the Press Secretary, Countering "Dirty Bomb" Threat Fact Sheet, June 2, 2003.
Summary Report and Perspectives on Byproduct Material Security and Controls 

4

Department of Homeland Security (DHS) one-page “Radiation 

Threat” visual guide, which pictorially depicts blast and protection 

information related to the detonation of a dirty bomb. 

The events of September 11 made it clear that terrorists have the 

patience and ability to plan and conduct devastating attacks in the 

United States. The National Strategy for Homeland Security

describes terrorists as “strategic actors” who choose their targets 

deliberately based on the weaknesses they observe in U.S. 

defenses and preparations; adjust their plans in response to U.S. 

efforts to close vulnerabilities; and shift their focus to other, 

exposed vulnerabilities. The strategy also states that terrorists are 

working to obtain chemical, biological, radiological, and nuclear 

weapons, and that the knowledge, technology, and materials 

needed to build such weapons is spreading. 

Following September 11, 2001, it became clear that governmental 

institutions with a defense or security mission should evaluate and 

transform—or adapt—their business approaches and missions to 

address the threats posed by terrorists. This transformation 

philosophy was conceptualized by the President in September 

2002 in The National Security Strategy of the United States of 

America which stated “The major institutions of American national 

security were designed in a different era to meet different 

requirements. All of them must be transformed.” 

 NRC Measures to Secure Material 

NRC has implemented a variety of measures to improve the 

Nation’s security of radioactive material. After the events of 

September 11, NRC acted immediately to begin addressing 

physical security in the byproduct material program. This included 

conducting security assessments for a sample of various types of 

material licensees. In October 2001, NRC issued advisories to 

material licensees that emphasized the importance of the security 

and control of licensed material. In the weeks, months, and years 

after September 11, NRC also issued security-related orders to the 

largest material licensees. These orders addressed potential 

vulnerabilities in storage, transportation, and access of byproduct 

material among the licensees. 

NRC also has some on-going efforts that are intended to improve 

material security. These include continuing development of a 

National Source Tracking System (NSTS), distributing pre-licensing 
Summary Report and Perspectives on Byproduct Material Security and Controls 

5

guidance to the Regions and Agreement States, developing a 

rulemaking on background checks required of certain licensees, 

and sharing licensee information with other Federal agencies. 

 The Radiation Source Protection and Security Task Force 

The Energy Policy Act of 2005 (the Act) established a multi-agency 

task force on radiation source protection and security (Task Force) 

with the NRC Chairperson or a designee as chair. The Task Force 

is required to evaluate and provide recommendations relating to the 

security of radiation sources in the United States from potential 

terrorist threats, and present its findings in a report within 1 year of 

passage of the Act and every 4 years thereafter. 

The first Task Force report, released August 15, 2006, identified the 

key accomplishments of the U.S. Government related to the 

security of radioactive materials in use, storage, or transport. The 

Task Force concluded that “since September 11, 2001, Federal 

Agencies have implemented or are in the process of implementing 

actions to increase security. While implementation of some of 

these activities is still in progress, the actions taken to date have 

substantially enhanced security.” 

II. PURPOSE 

In February 2005, the NRC Office of the Inspector General (OIG) 

began a review to determine if NRC's oversight of byproduct 

material provides reasonable assurance that licensees are using 

the material safely and account for and control material. During 

2006, OIG issued three reports related to material tracking and 

licensing. Also during this timeframe, the Government 

Accountability Office (GAO) conducted an investigation to ascertain 

whether radioactive sources could be smuggled across U.S. 

borders. The GAO work culminated in a March 2006 congressional 

hearing to discuss the results of the investigation. 

Through this report, OIG seeks to synthesize the findings of those 

reviews and investigations in order to provide a more complete 

perspective of NRC’s approach to byproduct material security and 

control. In preparing the report, OIG conducted follow-on audit 

work and developed an additional recommendation to reflect this 

more complete perspective. The specific objective for this report 

was to discuss whether NRC has adequately adapted its approach 

to byproduct material security in the post-September 11 era in 

accordance with the expectations of congressional and executive 

policymakers and the American people. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

6

III. FINDING 

NRC Efforts to Regulate Byproduct Material Security 

While NRC has implemented or planned a variety of measures to 

regulate and provide for the security of byproduct material in the 

post-September 11 era, the agency has bypassed an important 

step in doing so. After the terrorist attacks of September 11, 2001, 

the Federal Government expected governmental institutions to 

evaluate and adapt their missions and security approaches to 

address threats posed by terrorists. However, NRC has not fully 

adapted its approach to byproduct material security, because the 

agency has not taken the step to adequately identify and evaluate 

security risks in the byproduct material area. Specifically, the 

agency has not conducted an impartial and comprehensive look 

inwards at its own business and regulatory processes. The agency 

also lacks an independent perspective to assess the security 

measures in place. Consequently, NRC’s approach has resulted in 

an agency policy and some practices that do not consider the full 

range of potential consequences of a dirty bomb. 

Government Agencies Are Expected to Evaluate and Adapt 

Missions

In the wake of the terrorist attacks of September 11, 2001, 

governmental institutions were expected to evaluate and adapt their 

missions to address the threats posed by terrorists. Expectations 

to adapt agency missions have come from the highest levels of the 

Federal Government as embodied in National Strategic documents 

and Presidential Directives. For example, the National Strategy for 

Homeland Security,

5

 published in July 2002, described securing the 

American homeland as the U.S. Government’s most important 

mission, requiring a coordinated and focused effort from the entire 

American society. In The National Security Strategy of the United 

States of America,6

 published in September 2002, the President 

stated “The major institutions of American national security were 

designed in a different era to meet different requirements. All of 

them must be transformed.” 

 

5 The White House Office of Homeland Security, National Strategy for Homeland Security, July 2002. 6 The President of the United States, The National Security Strategy of the United States of America, 

September 2002.
Summary Report and Perspectives on Byproduct Material Security and Controls 

7

Since September 2001, Federal efforts to transform or adapt 

agencies’ security-related missions include: 

3⁄4 Establishment of the Department of 

Homeland Security (DHS) by bringing 22 

Federal entities with roles to play in 

protecting our Nation and preventing terrorist 

attacks under its authority. 

3⁄4 Establishment of the Office of the Director of 

National Intelligence, which was endowed 

with expanded budgetary and personnel 

authorities to integrate the efforts of the 

intelligence community—including the Central 

Intelligence Agency (CIA) and the Federal 

Bureau of Investigation (FBI)—into a more 

unified and coordinated whole. 

3⁄4 Initiation of a Department of Defense (DOD) transformation 

effort to better balance its capabilities across several categories 

of challenges, including meeting the threats of terrorism and the 

use of weapons of mass destruction by state and non-state 

actors. 

The Federal Government also places a priority on keeping 

radiological weapons technology away from terrorists. In 2003, the 

President’s National Strategy for Combating Terrorism,

7

 stated that 

the probability of a terrorist organization using a chemical, 

biological, radiological, or nuclear weapon, or high-yield explosives, 

has increased significantly during the past decade. It concluded 

that preventing terrorist groups from gaining access to such 

technology will be one of the country’s highest priorities. Also in 

2003, a Homeland Security Presidential Directive titled Critical 

Infrastructure Identification, Prioritization, and Protection directed 

DHS to continue to work with NRC to ensure the necessary 

protection of nuclear material in medical, industrial, and academic 

settings and facilities that fabricate nuclear fuel; and the 

transportation, storage, and disposal of nuclear material and waste. 

By March 2006, the National Security Strategy was updated to, 

among other things, clarify the President’s expectations that 

transformation and adaptation efforts be extended to key domestic 

institutions. The President’s expectations require that agencies 

with traditional domestic functions, like NRC, increasingly play a 

 

7 The President of the United States, National Strategy for Combating Terrorism, February 2003.
Summary Report and Perspectives on Byproduct Material Security and Controls 

8

role in foreign and security policies. NRC has an important security 

role in protecting nuclear materials. This security role is reflected in 

the agency’s strategic plan as a discrete goal: “Ensure the secure 

use and management of radioactive materials.” 

As a greater number of Federal agencies adapt their approaches to 

meet the expectations presented in the March 2006 National 

Security Strategy, the importance of intergovernmental cooperation 

and coordination becomes apparent. This concept was recognized 

by the National Commission on Terrorist Attacks Upon the United 

States, also known as the 9/11 Commission. In its 2004 report, the 

9/11 Commission made recommendations that would “require a 

government better organized than the one that exists today” in 

order to “build unity of effort across the U.S. government." 

NRC Has Not Fully Adapted Its Byproduct Material Security 

Approach 

NRC has not fully adapted its byproduct material security approach 

to accommodate changes in threats to the Nation. OIG made this 

conclusion on the basis of findings reached in previous OIG and 

GAO reports on byproduct material security. From this body of 

work, two primary areas of concern in the agency’s approach have 

emerged: 1) NRC has not identified or closed all security gaps in its 

material licensing process, and 2) NRC does not currently track all 

dangerous byproduct material. Moreover, some individual 

members of Congress—on a bipartisan basis—have observed that 

NRC has not done enough with regard to material security and has 

not fully adapted to the post-September 11 threat environment. 

 NRC Has Not Identified or Closed Gaps in Its Material Licensing 

Process 

Both OIG and GAO have performed reviews of NRC’s material 

licensing process and have found security gaps and other 

shortcomings in the program. Some of the security gaps in NRC’s 

licensing process remain and compromise material security. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

9

In August 2003, GAO reported that NRC’s licensing process left 

sealed sources8 vulnerable because NRC’s licensing procedures 

do not require inspection of a licensee’s facilities before issuance of 

a license.9 GAO thus recommended that NRC modify its process of 

issuing specific licenses to ensure that sealed sources cannot be 

purchased before NRC’s verification, 

through inspection or other means, and 

that the material will be used as 

intended. NRC stated that it agrees 

with the objective of the 

recommendation. In December 2006, 

the agency issued pre-licensing review 

guidance for Agreement State and NRC 

Regional license reviewers. NRC 

officials believe that this guidance 

addresses the vulnerability identified by 

GAO. The GAO recommendation 

remains open, but GAO is currently 

reviewing NRC’s pre-licensing guidance 

as part of a follow-on job commenced in September 2005. 

In March 2006, OIG reported that NRC 

officials were not aware of all the 

potential security gaps in the byproduct 

material license application and review 

process.10 This lack of awareness was 

attributed to NRC’s failure to take a 

comprehensive look inwards at its own 

business and regulatory processes, 

which would include conducting 

vulnerability assessments of the license 

application and review process. As a 

result, individuals with malevolent 

intentions could exploit vulnerabilities in 

the license application and review 

process to obtain byproduct material for use in a dirty bomb. 

In a March 28, 2006, testimony statement before the U.S. Senate 

Committee on Homeland Security and Governmental Affairs, 

Permanent Subcommittee on Investigations, GAO reported on an 

investigation it had conducted to transport radioactive material into 

 

8 A sealed source is radioactive material that is permanently sealed in a capsule or closely bonded in a solid 

form.

9 GAO, Nuclear Security: Federal and State Action Needed to Improve Security of Sealed Radioactive 

Sources, GAO-03-804 (Washington, D.C.: August 6, 2003). 10 NRC Office of the Inspector General, Audit of the NRC Byproduct Materials License Application and 

Review Process, OIG-06-A-11 (March 10, 2006).
Summary Report and Perspectives on Byproduct Material Security and Controls 

10

the United States across the northern and southern borders.11 The 

GAO developed counterfeit bill-of-lading and counterfeit NRC 

documents to accompany the transport of the material. It is 

uncertain whether the NRC documents were required to 

accompany the shipment. Nevertheless, the U.S. Customs and 

Border Protection (CBP) officers at the border inspected the NRC 

documents and could not detect that the documents were 

fraudulent. Moreover, as OIG reported earlier,12 NRC documents 

are used by licensees for other purposes, and it is important that 

regulators and material manufacturers and distributors have a way 

to verify the legitimacy of such documents. 

 NRC Does Not Track All Dangerous Byproduct Material

As OIG and GAO have previously reported, NRC does not currently 

track all dangerous radioactive byproduct material, representing 

another gap in the agency’s approach to material security. The 

International Atomic Energy Agency (IAEA) developed a 

categorization system that provides a relative ranking and grouping 

of radioactive sources. While the IAEA classifies sources into 5 

categories, it notes that sources in Categories 1 through 3 are 

designated as varying degrees of dangerous. Yet, NRC is not 

currently tracking Category 3 sources and cannot today accurately 

account for the current location of all dangerous sources. 

NRC has proposed a system to track 

radioactive byproduct sources, yet 

experts have identified areas where the 

proposal falls short of enhanced public 

health and safety and security goals. 

NRC’s proposed National Source 

Tracking System (NSTS) has not yet 

been deployed, but the agency plans for 

it to be a Web-based system that will 

contain cradle-to-grave information on 

high-risk sealed sources. According to 

the Task Force report, NRC is 

developing the NSTS to track Category 

1 and 2 sources, plus three additional radionuclides of interest to 

the Department of Energy (DOE). In September 2005, GAO found 

that, as proposed, the NSTS would be of little use to DOE in its 

efforts for the recovery and disposal of unwanted sealed 

 

11 GAO, Border Security: Investigators Transported Radioactive Sources Across Our Nation’s Borders at 

Two Locations, GAO-06-583T, Testimony Before the Permanent Subcommittee on Investigations, 

Committee on Homeland Security and Governmental Affairs, U.S. Senate, March 28, 2006. 12 OIG-06-A-11.
Summary Report and Perspectives on Byproduct Material Security and Controls 

11

radiological sources, largely because the proposed NSTS will not 

track beyond Category 2 sources.13 According to the GAO report, 

the aggregate radioactivity of co-located individual sources poses 

enough of a safety and security risk to warrant their recovery by 

DOE, but the sources will not be tracked in NSTS because they are 

not Category 1 or 2 sources. Also, in September 2005, the Health 

Physics Society14 noted shortcomings in the proposed NSTS due to 

NRC’s failure to include Category 3 sources. 

The Commission decided that until the NSTS is implemented,15

NRC will maintain an inventory of sources at or above Code of 

Conduct Category 2 values in an Interim Database that will be 

updated annually. In other words, until full implementation of 

NSTS, NRC will have only an annual snapshot of the inventory of 

licensees permitted to possess the most dangerous sources. In 

addition, NRC has not undertaken any inspection efforts to validate 

the accuracy of information reported to the NRC. 

On June 9, 2006, the Commission directed the staff to perform a 

one-time NSTS data collection and analysis of sources.16 The 

Commission said that the staff should collect these data to support 

two objectives. The first objective is to provide analysis that would 

support a proposed rule that would include Category 3 sources in 

the NSTS. As the staff stated in an issue paper to the Commission, 

the primary objective of this activity would be to determine the 

numbers of Category 3 licensees, sources, and transactions. The 

Commission’s directions to the staff stated that a formal rulemaking 

plan is not required, but that the staff should plan to complete the 

expansion of the NSTS within 3 years. The second objective is to 

evaluate the Category thresholds for general licenses to determine 

if some generally-licensed byproduct material should be specifically 

licensed down to the Category 3.5 level.17

Congressional Criticism of NRC Material Security Efforts 

Selected U.S. Congressional observations suggest that NRC has 

not done enough with regard to material security and has not fully 

adapted to the post-September 11 threat environment. 

 

13 GAO, Nuclear Security: DOE Needs Better Information to Guide Its Expanded Recovery of Sealed 

Radiological Sources, GAO-05-967 (Washington, D.C.: September 22, 2005). 14 The Health Physics Society is an independent scientific organization of radiation safety professionals. 15 According to the Task Force report, an initial, basic version of NSTS is currently expected to go online in 

spring 2007, with a more advanced, second release expected in winter 2007/2008.

16 Memorandum, A. Vietti-Cook to L. Reyes, re: Staff Requirements – SECY-06-0094, Tracking or Providing 

Enhanced Controls for Category 3 Sources, dated June 9, 2006. 17 According to an NRC manager, an analysis down to Category 3.5 would include all Category 3 sources 

and the top one-tenth, based on activity, of Category 4 sources. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

12

Congressional concern has been chronicled via proposed 

legislation, hearings, correspondence with the Commission, and 

requests for GAO reviews. 

One way to gauge congressional concern is by tracking the 

legislation proposed in both the House and Senate. Since 

October 2001, members of Congress have submitted no fewer than 

50 bills that, in whole or in part, addressed issues and concerns 

related to dirty bombs.18 Of these, 16 bills included language that 

would specifically require NRC to improve its oversight of or take 

additional security measures to protect radioactive byproduct 

material.19

During the same period, Congress held numerous hearings on 

terrorism and dirty bombs. Some of these hearings included 

testimony that specifically addressed NRC’s oversight of security 

for dangerous radioactive material that could be used in a dirty 

bomb. For example, a National Academy of Sciences Director 

testified before a House Homeland Security Subcommittee in 

September 2005, his expectations that NRC will soon put stronger 

procedures in place for ensuring proper handling and security of 

radioactive material.20 

Most recently, in March 2006, Senate Homeland Security and 

Governmental Affairs Subcommittee members responded to written 

and verbal hearing statements from a number of witnesses 

regarding a GAO investigation. GAO testified before the 

subcommittee about the ease with which NRC documents 

accompanying material brought across U.S. borders could be 

falsified.21 In verbal testimony at the hearing, GAO also explained 

how a patient entity could acquire enough dangerous material to 

build a dirty bomb without attracting attention from NRC. During 

this hearing, a Senator stated that “the NRC must reform the 

processes by which anyone can acquire radiological material.” 

Another Senator observed problems with NRC’s documentation 

 

18 The number of bills counted by OIG reflects some duplication of separate bills proposed in both the House 

and the Senate. Furthermore, some bills proposed during the 107th Session of Congress were reintroduced 

for the 108th and/or the 109th Sessions of Congress.

19 These bills include the Energy Policy Act of 2005, which, in July 2005, was approved by the U.S. House of 

Representatives by a vote of 275 to 156 and in the U.S. Senate by a vote of 74 to 26. 20 Schweitzer, Glenn E., Director for Central Europe and Eurasia, National Academy of Sciences, The Nexus 

of International Organized Crime and Terrorism: The Case of Dirty Bombs, Testimony to the Subcommittee 

on Prevention of Nuclear and Biological Attacks of the Committee on Homeland Security, U.S. House of 

Representatives, September 22, 2005.

21 GAO-06-583T.
Summary Report and Perspectives on Byproduct Material Security and Controls 

13

and licensing that were identified in 2003 and which, according to 

GAO’s testimony, remain a problem to this day. The Senator 

referred to NRC’s failure to implement corrective regulations as 

“shocking.” 

Since 2001, selected members of Congress have corresponded 

directly with NRC to express concerns with NRC’s efforts to better 

oversee the security of radiological material. During a 3-month 

period in 2006, several members of Congress wrote to NRC to 

question a number of the agency’s material security decisions. 

Among other concerns, members have made the following specific 

observations: 

 

3⁄4 NRC has failed to implement selected material security-related 

sections of the Energy Policy Act of 2005 in a timely manner; 

3⁄4 NRC’s commitment to implementing future required material 

security regulations is questionable; and 

3⁄4 NRC has failed to establish a program and a database to verify 

the authenticity of NRC licensing documents. 

OIG also reviewed Congressional requests submitted to GAO for 

proposed audits and investigations. A recent request from a 

Senate Committee Chair and Ranking Member stated in an April 

27, 2006, letter to GAO that NRC’s standards appear to be 

inconsistent with standards used by other Federal agencies to 

assess the security and health risks posed by radioactive sources. 

In the letter, the members requested GAO to examine NRC’s 

material security efforts and progress since 2003 on GAO’s 

previous recommendations and on its licensing database. The 

members also requested GAO to review NRC’s coordination with 

other agencies, including efforts to reconcile inconsistencies with 

other Federal standards guiding the purchase, use, and 

transportation of radioactive material. 

NRC Has Not Fully Identified and Evaluated Risks

Based on two OIG byproduct material reports published in 2006, 

OIG concluded the NRC has not fully identified and evaluated 

security risks in the byproduct material area. Specifically, the 

agency had not conducted adequate analyses in its NSTS and 

material licensing programs. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

14

In February 2006, OIG reported that 

the proposed NSTS may be 

inadequate because NRC did not 

consider a variety of factors when the 

agency conducted a regulatory 

analysis for NSTS.22 A regulatory 

analysis provides the framework for 

making regulatory decisions. The 

factors not initially considered by 

NRC’s regulatory analysis for NSTS 

and the resulting security risks that 

NRC took by removing the factors 

from consideration for the NSTS are 

summarized in the table below. 

Table 1: NSTS Factors Not Initially Considered by NRC’s Regulatory Analysis and 

Related Security Risks 

Factor not considered Related security risk 

Tracking beyond Category 2 — NRC did not 

consider the number of sources located in the 

United States for Category 3 to 5 sources. 

All material designated as “dangerous,” which 

includes Category 3, would not be tracked. 

Aggregation of sources — NRC did not 

consider the co-location of radioactive sources 

to determine if their aggregate curie activity 

would qualify the material at the next highest 

IAEA Category. 

NSTS would provide no oversight of material 

that, when aggregated, would pose the same 

or greater threat than the Category 1 or 2 

material that would be tracked or the Category 

3 sources that are currently not being tracked. 

Malevolent uses of dangerous sources — NRC 

did not consider the diversion of radioactive 

material from legal to illegal and criminal uses. 

NSTS features could be designed without the 

benefit of knowing the specific ways that 

sources could be diverted to malevolent use. 

Source: OIG analysis. 

NRC has since stated that NRC staff intends to begin the process 

to evaluate the need, benefits, and costs to tracking Category 3 

sources. However, there is no specific timeline for when, how 

many, or even if any Category 3 sources would be tracked by 

NSTS. 

OIG also found that material license application review officials 

were not aware of all the potential security gaps in the program 

because the agency had failed to look inwards at its own business 

and regulatory processes. OIG thus recommended that NRC 

conduct a vulnerability assessment of its license application and 

review process and the methods used by licensees to purchase 

 

22 NRC Office of the Inspector General, Audit of the Development of the National Source Tracking System, 

OIG-06-A-10 (February 23, 2006). 
Summary Report and Perspectives on Byproduct Material Security and Controls 

15

byproduct material from sellers. NRC stated that it is committed to 

completing an effectiveness review of its actions and does not 

believe that the additional reviews suggested by OIG’s 

recommendations are necessary at this time. However, a postimplementation effectiveness review of security actions to address 

known vulnerabilities would not help program officials become 

aware of unknown vulnerabilities. That is because an effectiveness 

review would only analyze actions taken to address known 

vulnerabilities, rather than uncover other, previously unknown 

vulnerabilities. Currently, OIG’s recommendations remain 

unresolved. 

The OIG reports illustrate two instances where the agency moved 

forward with security-related program actions without conducting a 

rigorous analysis to justify the actions. When questioned by 

Government auditors or elected officials about the bases of its 

security-related actions or about its efforts to identify and close 

vulnerabilities in its material licensing and tracking programs, NRC 

has consistently pointed to a “graded, risk-informed” approach to 

byproduct material security. For NRC, the “graded, risk-informed” 

approach results in the identification of “risk-significant” or “highrisk” sources, equivalent to IAEA Category 1 and 2 sources. 

NRC’s “graded, risk-informed” approach discounts factors related to 

malevolent terrorist intentions because the agency focuses the 

performance of its mission—including those related to common 

defense and security—to scientific and engineering evaluations of 

licensed activities that use radioactive material. Indeed, the agency 

notified the House Committee on Government Reform that 

factors—such as psychological, social, and economic effects—can 

vary and provide a less stable measure for establishing security 

measures.23 By its very definition, such an approach would 

discount the intentions and capabilities of a malevolent entity bent 

on obtaining byproduct material that could be used in a dirty bomb. 

OIG has concluded that NRC’s approach to identifying byproduct 

material security requirements lacks an independent perspective of 

a credible organization such as the National Academy of Sciences, 

particularly with regard to assessing agency programs for potential 

weaknesses. For example, an independent panel of experts 

convened externally from the agency could identify agency 

vulnerabilities according to potential consequences and risks. The 

findings of such an independent body could help validate or provide 

suggested improvements for the agency’s ongoing byproduct 

 

23 Letter from NRC Chairman Nils J. Diaz to The Honorable Thomas Davis, Chairman, Committee on 

Government Reform, U.S. House of Representatives, February 4, 2004.
Summary Report and Perspectives on Byproduct Material Security and Controls 

16

material security efforts. 

NRC’s Approach Leads to a Policy and Some Practices That 

Do Not Consider All Dirty Bomb Consequences

Consistent with its byproduct material approach, NRC has 

developed a byproduct material security policy and some practices 

that may allow for consequences that are inconsistent with other 

interests. Of particular significance is an NRC policy for evaluating 

the risk of dirty bombs that does not recognize all of the potential 

effects of a dirty bomb. Moreover, the NRC staff’s approach does 

not reflect a post-September 11 stance. 

 NRC Policy Does Not Recognize All Effects of a Dirty Bomb

During its recent review of NRC’s oversight of byproduct material 

and sealed sources, OIG became aware of an NRC policy for 

evaluating the risk of dirty bombs that does not recognize all of the 

potential effects of a dirty bomb. The staff proposed, in a 

November 2004 issue paper, a new NRC policy for assessing the 

effectiveness of security measures of material licensees based on 

“prompt fatalities” consequences only. The Commission approved 

the staff’s proposal, hereafter referred to as the “prompt fatalities” 

policy. The policy established a “decision-making framework” for 

vulnerability assessments of material licensees to judge the 

effectiveness of future security measures. 

A subsequent issue paper submitted to the Commission on 

March 1, 2006, documented the agency’s extensive use of the 

decision-making framework to evaluate the security vulnerability of 

various material and research and test reactor licensees. The staff 

reported that: 

“the security measures already taken by the Commission are 

sufficient to ensure adequate protection of the public and 

promote common defense and security.” 

Essentially, the staff expressed confidence in their security 

measures without the benefit of knowing all of the potential 

vulnerabilities that would have resulted from a comprehensive look 

inwards at its own business and regulatory processes. Had 

consequences of a dirty bomb other than prompt fatalities been 

considered—including the technical, socioeconomic, psychological, 

environmental, and other effects—the results of the decisionmaking framework might have been different and required different 

or possibly additional security measures to secure byproduct 
Summary Report and Perspectives on Byproduct Material Security and Controls 

17

material. Conversely, measuring dirty bomb consequences without 

consideration of these additional consequences causes the NRC to 

understate the risk these weapons pose to national security. For 

example, when asked about the socioeconomic effects of 

accounting for radioactive sources in NRC’s security decisionmaking, an NMSS manager stated that NRC is a scientific agency 

and really cannot take the socioeconomic impacts into account. 

In addition, the “prompt fatalities” policy, as written, does not accord 

with DHS’ draft Sector-Specific Plan Nuclear Reactors, Materials 

and Waste for Critical Infrastructure Protection as Input to the 

National Infrastructure Protection Plan, published in July 2004 and 

updated on June 8, 2006. According to the draft plan, DHS uses 

several processes to analyze the consequences of potential 

terrorist attacks across the various parts of the nuclear sector. 

These include health, governance, economic, and psychological 

impacts. The draft plan states that the use of radioactive material 

in an unconventional attack via a dirty bomb is widely recognized to 

have a greater likelihood of physical and social disruption than of 

lethal radiological consequences; however, the psychological and 

economic consequences of dispersal could be high. As an NSIR 

senior manager concluded in December 2004, the prompt fatalities 

framework “does not appear to meet these objectives.” 

Staff Approach Does Not Reflect a Post-September 11 Stance

During its recent review of NRC’s oversight of byproduct material 

and sealed sources, OIG found that staff holds a reactive rather 

than proactive approach to material security. The position of some 

NRC material licensing officials reflects a wait-and-see approach to 

implementing additional security measures. When questioned 

about potential security gaps in NRC’s own license application and 

review process, an NRC senior manager stated that NRC has not 

systematically tried to look at the holes in the process. He added 

that if NRC license reviewers and inspectors came across such 

vulnerabilities or holes, either “through their experience or a flash of 

insight,” they would address the holes. 

NRC officials have also expressed confidence in their procedures 

based on the fact that terrorists have not used a dirty bomb. A 

senior manager told OIG that "until I'm convinced" somebody is 

trying to obtain material for malevolent use, "I don't see putting 

more resources in closing the potential vulnerabilities." Another 

senior manager said that “we have the time” to implement securityrelated measures for byproduct material and perform reviews of the 

measures to see if any gaps remain. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

18

The agency also downplays the likelihood of the fraudulent use of 

NRC documents. A manager stated that the fraudulent use of NRC 

documents was not a likelihood because the agency had never 

actually seen this occur. However, OIG found a documented case 

of such fraudulent use from 1998 in NRC’s records and, as noted 

earlier, the GAO used a fraudulent NRC document during a 2006 

investigation. 

The implication of these staff perspectives is that NRC has not 

proactively identified and closed security gaps associated with the 

malevolent use of radioactive material. Specifically, the agency has 

not acknowledged the importance of detecting unknown 

vulnerabilities in addition to addressing all known vulnerabilities. 

The only assessments the agency currently proposes in response 

to OIG’s audit reports are the “effectiveness reviews” that the 

agency intends to conduct sometime in the future to determine 

whether known vulnerabilities have been effectively closed by the 

proposed or implemented security actions. However, such 

effectiveness reviews will not help program officials become aware 

of unknown vulnerabilities. 

IV. SUMMARY AND CONCLUSION 

The events of September 11, 2001, changed the world forever. It is 

obvious that we will never live in a risk-free society. Nonetheless, 

Americans expect government institutions to adapt their 

approaches to meet the emerging threats posed by motivated and 

patient terrorists. In line with its safety and security mission, NRC 

therefore has the responsibility to take appropriate, meaningful 

steps to mitigate the dangers associated with the uses of 

radioactive material. 

Recently, NRC’s efforts to take such appropriate and meaningful 

steps to address the security of radioactive material have come 

under closer review. Certainly, NRC has taken a number of steps 

to improve the security of byproduct material. Nonetheless, the 

work published by OIG and GAO, as a whole, paints a picture of 

NRC efforts that are incomplete, especially with regard to taking a 

comprehensive look inwards at its own business and regulatory 

processes, which would include conducting a vulnerability 

assessment of the agency’s material licensing and tracking 

programs. Such an assessment should necessarily include 

examination of the management, operational, and technical security 

controls and the extent to which these controls are (1) implemented 
Summary Report and Perspectives on Byproduct Material Security and Controls 

19

correctly, (2) operating as intended, and (3) producing the desired 

outcome with respect to mitigating security vulnerabilities. 

As the Nation’s authority on radioactive material, NRC may face 

continued difficulties in convincing critics and concerned onlookers 

of the appropriateness of its approach towards byproduct material 

security. However, OIG has not found any evidence that the 

agency has sought an independent assessment of the technical, 

socioeconomic, psychological, environmental, and other risks and 

consequences associated with the malevolent use of byproduct 

material. Lacking such an independent assessment of its 

byproduct material security approach, NRC is faced with the need 

to continually justify that it is in accord with the potential threat and 

consequences posed by a dirty bomb. Further, the agency also 

risks not being aware of potential weaknesses and vulnerabilities in 

its byproduct material security efforts. 

Recommendation

The Office of the Inspector General recommends that the Executive 

Director for Operations: 

1. Convene an independent panel of experts external to the 

agency to identify agency vulnerabilities concerning NRC’s 

material licensing and tracking programs and validate the 

agency’s ongoing byproduct material security efforts. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

20

[Page intentionally left blank] 
Summary Report and Perspectives on Byproduct Material Security and Controls 

21

Appendix A

SCOPE AND METHODOLOGY 

The overall purpose of this report was to synthesize recent findings 

related to byproduct material tracking and licensing in order to 

provide a more complete perspective of NRC’s approach to 

byproduct material security and control. The specific objective for 

this report was to discuss whether NRC has adequately adapted its 

approach to byproduct material security in the post-September 11 

era in accordance with the expectations of congressional and 

executive policymakers and the American people. To address the 

objective, OIG incorporated findings from previous OIG and GAO 

reports, and conducted follow-on work to include reviews of 

updated regulations and guidance, congressional correspondence 

and legislation, and Government activities related to material 

tracking and security. 

OIG incorporated findings from three OIG reports published in 

2006, as follows: 

3⁄4 Audit of the Development of the National Source Tracking 

System, OIG-06-A-10, February 23, 2006. 

3⁄4 Audit of the NRC Byproduct Materials License Application and 

Review Process, OIG-06-A-11, March 10, 2006. 

3⁄4 Audit of NRC’s Process for Releasing Commission Decision 

Documents, OIG-06-A-22, September 8, 2006. 

During these audits, OIG met with and interviewed NRC and other 

Federal agency staff, as well as experts from agencies and 

organizations external to the Federal Government. OIG conducted 

analyses and/or performed data reviews of NRC methodologies, 
Summary Report and Perspectives on Byproduct Material Security and Controls 

22

databases, and management controls. Collectively, OIG conducted 

these audits from February 2005 to March 2006 in accordance with 

generally accepted Government auditing standards. 

OIG also incorporated findings from GAO reports and testimony, as 

follows: 

3⁄4 Nuclear Security: Federal and State Action Needed to Improve 

Security of Sealed Radioactive Sources, GAO-03-804, August 

6, 2003. 

3⁄4 Nuclear Regulatory Commission: Challenges Facing NRC in 

Effectively Carrying Out Its Mission, Testimony Before the 

Subcommittee on Clean Air, Climate Change, and Nuclear 

Safety, Committee on Environment and Public Works, U.S. 

Senate, GAO-05-754T, May 26, 2005. 

3⁄4 Nuclear Security: DOE Needs Better Information to Guide Its 

Expanded Recovery of Sealed Radiological Sources, GAO-05-

967, September 22, 2005. 

3⁄4 Border Security: Investigators Transported Radioactive Sources 

Across Our Nation’s Borders at Two Locations, Testimony 

Before the Permanent Subcommittee on Investigations, 

Committee on Homeland Security and Governmental Affairs, 

U.S. Senate, GAO-06-583T, March 28, 2006. 

3⁄4 Border Security: Investigators Transported Radioactive Sources 

Across Our Nation’s Borders at Two Locations, Testimony 

Before the Subcommittee on International Terrorism and 

Nonproliferation, Committee on International Relations, House 

of Representatives, GAO-06-939T, July 5, 2006. 

3⁄4 Border Security: Investigators Transported Radioactive Sources 

Across Our Nation’s Borders at Two Locations, Testimony 

Before the Subcommittee on International Terrorism and 

Nonproliferation, Committee on International Relations, House 

of Representatives, GAO-06-940T, July 7, 2006. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

23

OIG also observed Government activities related to material 

tracking and security, including activities between NRC and CBP to 

implement a radioactive material importation approval system. 

Major contributors to this report were Anthony Lipuma, Team 

Leader; Sherri Miotla, Audit Manager; Michael Cash, Senior 

Technical Advisor; R.K. Wild, Senior Analyst; and Andrea Ferkile, 

Analyst. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

24

[Page intentionally left blank.] 
Summary Report and Perspectives on Byproduct Material Security and Controls 

25

Appendix B

FORMAL AGENCY COMMENTS 
Summary Report and Perspectives on Byproduct Material Security and Controls 

26
Summary Report and Perspectives on Byproduct Material Security and Controls 

27
Summary Report and Perspectives on Byproduct Material Security and Controls 

28
Summary Report and Perspectives on Byproduct Material Security and Controls 

29
Summary Report and Perspectives on Byproduct Material Security and Controls 

30
Summary Report and Perspectives on Byproduct Material Security and Controls 

31

Appendix C

OIG ANALYSIS OF AGENCY COMMENTS 

In a January 12, 2007, letter accompanying its response to OIG’s 

report, the agency stated that it agrees with the benefits of an 

independent assessment of NRC programs such as byproduct 

material security. The agency then states that such an 

independent review was conducted through the Task Force on 

Radiation Source Protection and Security, also referred to as the 

Task Force. OIG does not accept the agency’s suggestion that the 

Task Force fulfills the intent of the OIG recommendation for two 

primary reasons, as follows: 

1. The Task Force is not independent. The overall Task Force 

is chaired by NRC. All of the Task Force issue area 

subgroups contain one or more NRC staff, and 5 of the 10 

subgroups designate NRC staff as the subgroup lead. Some 

subgroups contain as many as 5 or 6 NRC staff. With so 

many NRC staff involved, there is no way to determine what 

influence NRC may have had in Task Force proceedings 

and findings. Nor is there any way to determine if NRC’s 

participation was objective when the focus of a subgroup 

meeting was an NRC program. 

“Independence” is a key concept that OIG incorporated into 

its recommendation in order to address the agency’s 

reluctance to implement OIG’s earlier recommendation. In 

March 2006, OIG recommended that NRC conduct a 

complete vulnerability assessment of its materials program. 

With regard to that previous recommendation, however, the 

agency believes that such an effort is unnecessary. OIG 

believes that the agency may not have the objectivity to 

review its own program for vulnerabilities. 

2. The Task Force Charter does not require in-depth review 

and identification of NRC program vulnerabilities. The Task 

Force, which was established by an Act of Congress and 

was not a proactive security effort of the NRC, was primarily 

established to evaluate and provide recommendations to the 

President and Congress relating to security of radiation 

sources. But the Charter does not specifically require the 

identification of agency vulnerabilities in NRC’s licensing and 

tracking programs. 
Summary Report and Perspectives on Byproduct Material Security and Controls 

32

In its letter to OIG, NRC states that the Task Force found no 

significant gaps that are not already being addressed. Yet, 

the Task Force was not chartered to and did not perform a 

comprehensive vulnerability assessment of NRC material 

programs, and there is no discussion of or results from any 

such assessment in the Task Force’s August 2006 report. 

Such an assessment should necessarily include examination 

of the management, operational, and technical security 

controls and the extent to which these controls are (1) 

implemented correctly, (2) operating as intended, and (3) 

producing the desired outcome with respect to mitigating 

security vulnerabilities. 

NRC provided additional comments on the OIG draft report 

pertaining to the agency’s ongoing efforts to implement security 

controls, close or address known security gaps, track materials, 

respond to Congressional concerns, and implement a risk-informed 

approach to the security of radioactive materials. OIG has revised 

portions of its report to reflect the agency’s implementation or 

stated intentions to implement some of these measures. However, 

the agency has not conducted an impartial and comprehensive look 

inwards at its own business and regulatory processes, which would 

include conducting vulnerability assessments of the agency’s 

material licensing and tracking programs. OIG has emphasized in 

its reports and in conversations with the agency the importance of 

an approach that first seeks to identify hitherto unknown 

vulnerabilities, and then take steps to address the vulnerabilities. 

NRC’s response to OIG’s reports has focused largely on the issue 

of addressing known vulnerabilities. Furthermore, the agency has 

not acknowledged the need to perform a comprehensive review as 

a measure of self-assurance with regard to unknown vulnerabilities.