STATEMENT SUBMITTED

BY THE

UNITED STATES NUCLEAR REGULATORY COMMISSION

TO THE 

COMMITTEE ON GOVERNMENT REFORM

SUBCOMMITTEE ON NATIONAL SECURITY, EMERGING THREATS AND

INTERNATIONAL RELATIONS

UNITED STATES HOUSE OF REPRESENTATIVES

CONCERNING

NUCLEAR SECURITY

PRESENTED BY

NILS J. DIAZ

CHAIRMAN

SUBMITTED: APRIL 4, 2006
2

Introduction

Mr. Chairman and Members of the Subcommittee, it is a pleasure to appear before you

today to discuss the efforts and accomplishments by the U.S. Nuclear Regulatory Commission

(NRC) and its licensees with respect to security at nuclear power plants. The NRC appreciated

the opportunity to testify before this Subcommittee on September 14, 2004, regarding nuclear

power plant security. The testimony today provides an update of our prior testimony, with a

special focus on the Government Accountability Office’s (GAO) recent report, GAO-06-388,

“Nuclear Power Plants: Efforts Made to Upgrade Security, but the Nuclear Regulatory

Commission’s Design Basis Threat Process Should Be Improved.” 

Overview

The NRC's mission is to regulate the Nation's civilian use of byproduct, source, and

special nuclear materials to ensure adequate protection of public health and safety, to promote

the common defense and security and to protect the environment. On behalf of the entire U.S.

Nuclear Regulatory Commission, I am pleased to report that the NRC continues to discharge its

responsibilities well, ensuring that the commercial use of radioactive and nuclear materials

including nuclear power plants remain safe and secure.

As we have previously reported, nuclear power plants have built-in features that

strengthen their ability to withstand externally initiated events. They were designed to withstand

catastrophic events including, but not limited to, fire, flood, earthquakes, and tornadoes. These

plants were also designed to employ a defense-in-depth strategy, with redundant safety
3

systems and are operated and protected by highly trained staff. Multiple barriers protect the

nuclear fuel and the reactor and help prevent or mitigate off-site releases of radioactive

materials. The original design features of the reactor facilities, as well as subsequent

enhancements, provide substantial inherent protection against a malevolent attack. The NRC

and its licensees continue to develop additional protective strategies necessary to complement

the facilities capabilities to prevent, detect, and mitigate potential events.

 

Security at nuclear facilities across the country has long been the subject of NRC, and

its predecessor, the Atomic Energy Commission (AEC), regulatory oversight. These security

programs are designed, implemented and verified to defend against violent assaults by wellarmed, well-trained adversaries. The sites employ sophisticated surveillance equipment,

stringent access controls, physical barriers, and well-qualified and trained armed response

forces to implement a site-specific defense strategy. Integrated with State, local and Federal

law enforcement, we believe the sites are the best protected and tested commercial facilities in

the Nation.

Summary of Security Performance

The NRC has a long history of ensuring the safety and security of civilian uses of

nuclear power and materials. The NRC’s process for reviewing and updating security

requirements is based on decades of assessments and lessons learned. These have been

integrated into a comprehensive protective scheme of regulatory requirements that are fully

executed by our licensees; these requirements to be assessed, and when necessary enhanced.
4

Security, while clearly receiving added focus following the events of September 11, has

long been an intrinsic component of NRC’s regulatory framework and was originally addressed

in the Atomic Energy Act of 1954, as amended. This Act created the AEC and outlined the

essential requirements of a regulatory program to oversee the civilian use of nuclear material. 

It also provided the basis for regulations designed to guard against theft or diversion of special

nuclear material, which included, but was not limited to, materials used in nuclear reactors. In

the decade that followed its founding, the AEC required careful maintenance of inventories of

special nuclear material and that specific consideration be given to the threat of theft or 

diversion when considering licensing approvals and actions. 

In 1974, the Energy Reorganization Act established the NRC and addressed

international terrorism and the need to secure increasing numbers of nuclear facilities and

increasing inventories of potentially weapons-usable material in the private sector. The Act

required the NRC to review all existing safeguards and security requirements and recommend

upgrades where necessary. 

During this same period, a Security Agency Study was undertaken. Completed in

August 1976, the study focused on the possible establishment of a Federal protective security

force to provide protection at commercial power reactors. The study found that the “...creation

of a Federal guard force would not result in a higher degree of guard force effectiveness than

can be achieved by the use of private guards, properly trained, qualified, trained and certified by

the NRC.” Shortly after September 11, this issue was again raised. The NRC continues to

support the concept that a private security guard force, with special emphasis on performancebased training and full accountability, is the best approach to securing our Nation’s commercial

nuclear facilities. 
5

In 1977, following the completion of multiple interagency working groups and fact-finding

efforts, the NRC amended its regulations to specify physical security measures for nuclear

power reactors and special nuclear material . By 1979, additional concerns arose regarding

arms proliferation, industrial sabotage and global terrorism. In response, the Commission

issued new regulations to incorporate a range of physical security upgrades, including finalizing

the DBTs. The use and review of the DBT is an ongoing process; for example, in 1994, the

NRC revised the DBT for radiological sabotage to incorporate threat lessons-learned from the

1993 World Trade Center bombing, the Three Mile Island vehicular intrusion in 1993, and

terrorist attacks on a variety of foreign facilities. The NRC maintains a deliberate process for

reviewing current threat information on an ongoing basis. For almost three decades, the NRC's

threat assessment staff has reviewed domestic and international events on a daily basis to

determine significance and appropriate NRC actions. Threat assessment and security staff

from NRC Headquarters and Regions are available as part of the Information Assessment

Team to conduct timely coordination with licensees, law enforcement and the intelligence

community to respond to potential threats. 

Nuclear Power Plant Defensive Strategies

While nuclear power plants have been required for decades to maintain physical

security programs, the terrorist attacks on September 11, 2001, reaffirmed the need for

additional collective vigilance, the need for enhanced security, and improved emergency

preparedness and incident response capabilities across the Nation’s critical infrastructure. As a

result, the NRC conducted a comprehensive review of licensees’ security programs 
6

and made further enhancements to security at a wide range of NRC-regulated activities and

facilities. 

Immediately following the September 11 attacks, the NRC placed nuclear power plants

and other facilities at the highest level of alert using established procedures. On February 25,

2002, the NRC supplemented its security regulations through Orders to power reactor licensees

imposing Interim Compensatory Measures, coordinating with law enforcement and intelligence

agencies. These measures required power reactor licensees to enhance security and improve

their capabilities to respond to a terrorist attack. These Orders constituted a de facto

supplement to the DBT, by adding appropriate security enhancements that the NRC deemed

necessary in light of the heightened threat environment. Many of these changes, arrived at with

no industry input, were among the basis for the subsequent Orders. These enhancements to

security included significantly increasing the number of dedicated security guards with threat

response duties, increased vehicle standoff distances, consideration of water-borne threats,

and improved coordination with law enforcement and intelligence communities, as well as

strengthened safety-related mitigation procedures and strategies. Subsequently, on January 7,

2003, the NRC issued additional Orders to licensees to enhance background investigations of

persons applying for and holding unescorted access to power reactor facilities. 

Furthermore, on April 29, 2003, the NRC, after soliciting and receiving comments from

appropriate Federal, State, and industry stakeholders, issued Orders supplementing the DBTs, 

providing additional details regarding specific adversary characteristics against which power

reactors and Category I fuel cycle facilities (facilities that process highly enriched uranium),

need to protect. While the specifics of these changes are sensitive or classified, in general

these supplements to the existing threat resulted in enhancements such as increased patrols,
7

augmented security forces and capabilities, additional security posts, additional physical

barriers, vehicle checks at greater standoff distances, enhanced coordination with law

enforcement and military authorities, augmented security and emergency response training,

equipment, and communication, and more restrictive site access controls for personnel,

including expanded, expedited, and more thorough employee background checks. 

Concurrently, additional Orders required nuclear power plant licensees to impose enforceable

work-hour limits on security force personnel and procedures to evaluate security force fatigue

and to enhance training and qualification programs to ensure that armed security personnel are

fit, properly trained, and qualified. 

The NRC’s process for reviewing and updating the specific attributes of the design basis

threat is deliberate, thorough, and well-informed. The NRC maintains a competent and

dedicated staff that routinely interacts with the intelligence community to gather and review all

relevant threat information. Thus, the Commission’s decisions and direction to the staff

regarding supplementing the DBT, the issuance of security-related Orders, and the subsequent

follow-on rulemaking are informed by a variety of sources, including input from NRC staff and

external stakeholders. 

The NRC conducts security inspection programs to ensure compliance with its

requirements, including a baseline inspection program and force-on-force exercises. The NRC

conducted force-on-force testing at nuclear power plants since well before the events of

September 11 and has since enhanced the program significantly. The NRC, nuclear industry,

and certain other stakeholders have leveraged technology, increased funding, and committed

additional personnel toward the continual improvement of this effort. The force-on-force
8

exercises test a nuclear power plant’s ability to meet requirements that the licensee must

defend with a high degree of assurance. 

The force-on-force program is a performance-based NRC program to physically test and

evaluate the sites’ defensive strategies concerning the DBT. The GAO report recognized its

value to the continual improvement of security at NRC-regulated nuclear facilities. The NRC

continues to enhance the program through the integration of lessons learned from previous

exercises. Additionally, the NRC emphasizes use of advanced technology to minimize exercise

artificialities, some of which have been identified in the report by GAO. The NRC concurs fully

with the report’s recommendation that “the NRC continue to evaluate and implement measures

to further strengthen the force-on-force inspection program.” 

The force-on-force inspections at nuclear power plants involve significant preparation on

the part of the NRC both in the weeks leading up to and during the on-site visit. NRC employs

multiple mock adversary teams whose members possess comprehensive and complementary

skill sets. Using proven operational security principles and state-of-the-art equipment, the

teams develop, execute, and test threat scenarios through a series of exercises. As reflected in

its report to the Committee, the GAO team observed a total of nine such exercises. 

Safety is the NRC’s first priority in the conduct of each force-on-force exercise. While

every participant in the planning and execution of the exercise works to minimize the effects of

necessary “artificialities”, there are personnel and plant safety limits that must be maintained. 

Safety briefings and plant-wide notifications of the general schedule must be disclosed, and an

increased presence of non-plant personnel will be evident. With that in mind, NRC staff and 
9

other participants are not allowed to share any information with the site regarding attack

methodologies or tactics that will be employed during the exercise. 

GAO Recommendations from its September 14, 2004 Testimony

I would like to take this opportunity to clarify the NRC’s response to previous GAO 

recommendations on nuclear power plant security. GAO’s September 2003 report and

September 2004 testimony on nuclear power plant security made certain accountability-related

recommendations. The first recommendation involved requiring inspectors to conduct follow-up

visits to verify that corrective actions have been taken, even when a violation does not reach the

threshold for being “cited.” Licensees are required to address violations through their

Corrective Action Program and the NRC does complete a follow-up visit on specific categories

of cited violations. 

GAO also recommended collecting and sharing lessons learned among the NRC

Regions and licensees. As I have mentioned, there are multiple methods for collecting and

sharing information. In addition to generic communications, such as the Regulatory Issue

Summaries and Information Notices, the NRC headquarters security staff conducts weekly

teleconferences with Regional Security Inspectors, Deputy Regional Administrators and

Regional Inspectors. The NRC fully concurs that such communication and information sharing

needs to be enhanced continually and is doing so. In addition, the NRC is committed to sharing

security best practices among its licensees.

The last 2004 recommendation focused on ensuring the NRC’s policy of submitting the

results of force-on-force exercises within 45 calendar days was followed. The NRC agrees that
10

reports need to be submitted in a timely manner. The NRC remains committed to improving in

this area, as evidenced by a recent review indicating that of the seven most recent reports, only

one went beyond the 45 day time line. 

GAO Report Regarding Nuclear Power Plant Security and the DBT Revision Process

The GAO report indicates that it reviewed the NRC’s documented findings from 27

baseline inspection and force-on-force reports. The findings identified by NRC were the result

of good inspection practices on the part of NRC inspectors and good self-assessments by the

licensees. In each case, the issue was identified and resolved. Depending on the severity of

the finding, inspectors remained on-site until the licensee implemented appropriate

compensatory measures. The NRC continues to inspect and licensees continue to be

responsive when deficiencies are identified.

In its report, GAO recommended that “NRC improve its process for making changes to

the DBT.” Additionally, GAO recommended that the NRC should separate the responsibility of

receiving and considering external stakeholder feedback from the process of developing the

specific threat characteristics in the DBT.

With regard to improving the NRC decision-making process, GAO recommended that

the Commission should develop explicit criteria for defining what is and is not reasonable for a

private security force to defend against. As stated in our January 24 and February 23, 2006,

letters to the GAO, the NRC rejects any implication that the Commissioners’ decisions

regarding final approval of the supplemented DBT were arbitrary. While additional delineation
11

of relevant considerations might be useful in some circumstances, reasoned judgment within

this and other areas of the Commission’s statutory decision-making authority does not require,

and in fact could be unduly restricted, by detailed prescriptive criteria. Moreover, consistent

with governing statutes, the Commission utilized an appropriate decision-making process by

providing for a majority Commission position on well-documented staff papers in order for

actions to proceed, and documenting individual Commissioner views and proposed

modifications for consideration by other Commissioners. The Commission’s statutory authority

under the Atomic Energy Act and the Energy Reorganization Act, coupled with broad, crosscutting policy considerations, regular briefings, documented staff papers, and a detailed

decision-making process provide the necessary and sufficient criteria for the Commission to

make informed decisions regarding the DBT. Moreover, overly-detailed, prescriptive criteria

could be detrimental to good governance. 

GAO’s second recommendation focused on the process used by the Commission to

obtain external stakeholder input while developing the supplemented DBT in 2003. The

Commission unanimously decided to seek input from all cleared stakeholders on the draft

supplemental DBT in January 2003. As noted above, much of the staff’s proposed draft DBT

derived either explicitly or implicitly from the February 25, 2002 Order on which the Commission

had consulted with law enforcement and intelligence agencies. Every State with an affected

licensee, every Federal law enforcement, security and intelligence agency, and each affected

licensee was asked to comment on the draft within a very short comment period for expeditious

deliberations and implementation. Industry input was but one factor, and not a particularly

significant one, in the Commission’s ultimate decision on the supplemental DBT issued on April

2003. In any case, now that the NRC has returned to our normal DBT review process, wherein
12

we sequentially develop a revision to the DBT then seek external stakeholder input, we believe

most of GAO’s concern will be alleviated regarding the appearance of undue influence by

industry stakeholders.

Path Forward

As the Subcommittee may recall, in its September 2004 testimony, the NRC urged that 

specific legislative enhancements be enacted. Title VI of the Energy Policy Act of 2005

provides essentially all of these enhancements that collectively will provide additional protection

to nuclear power plants. Provisions such as enhanced weaponry, broader fingerprinting and

background checks, and criminal penalties for introduction of dangerous weapons and for

sabotage of power plants were incorporated. 

In addition to and consistent with Congress’ legislative actions, the NRC initiated a

rulemaking in which it proposed to update the DBT to reflect, among other things, the

enhancements and supplementing requirements imposed in the Orders. For example,

consideration of a broad range of DBT-related threat factors are explicitly included in NRC's

current 10 CFR 73.1 rulemaking. Enhanced weaponry, more rigorous fingerprinting and 

background checks, and additional measures learned through the implementation of the post

September 11 security Orders are also part of a separate 10 CFR 73.55 rulemaking.

Looking toward the future, the NRC recognizes that as the threat environment evolves,

we must be positioned to respond decisively. Within the NRC, we must continue to attract and

retain employees with the skill sets necessary to manage the challenge. The support of
13

government agencies at the Federal, State and local levels, the legislative branch, and private

sector stakeholders must continue to be leveraged to ensure continued success. We are

confident that the NRC has the capability and commitment to continue our successful efforts in

these areas.

Summary

GAO’s audit of nuclear power plant security began in 2003. In the subsequent three

years, GAO, the NRC, and multiple nuclear power plant licensees have expended significant

resources to provide this Subcommittee and the American public with a greater understanding

of the security structure in place to protect nuclear power plants against the potential impact of

a terrorist attack. Because some security requirements have been imposed by the NRC

through Orders and licensees’ security plans, with related safeguards or classified information,

cannot be shared in a public forum without compromising security, the GAO’s public report

should not be considered a full and complete accounting of the state of nuclear power plant

security. The sum total of classified and unclassified security requirements provide a

comprehensive and appropriate defense against potential terrorist attacks. We remain

confident that nuclear power plant security plans are adequate to ensure the protection of the

American people from malevolent attempts to damage vital plant equipment and release

hazardous radioactive materials to the environment. 

We appreciate the opportunity to appear before you today and look forward to

answering any questions you might have.