RADIOACTIVE 

SOURCES

Opportunities Exist for 

Federal Agencies to 

Strengthen 

Transportation 

Security

Report to Congressional Requesters

February 2017

GAO-17-58

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-58, a report to 

congressional requesters

February 2017

RADIOACTIVE SOURCES

Opportunities Exist for Federal Agencies to 

Strengthen Transportation Security

What GAO Found

Since September 11, 2001, the three federal agencies responsible for securing 

risk-significant radioactive sources (those considered most dangerous) during 

ground transport have taken steps to strengthen the security of these sources. 

The Nuclear Regulatory Commission (NRC) requires source licensees to ensure 

that motor carriers transporting these sources have security measures, such as 

24-hour monitoring of shipments of potentially fatal sources. The Department of 

Transportation (DOT) updated its regulations to require security plans for these 

sources, and the Department of Homeland Security (DHS) established security 

standards for commercial drivers’ licenses. The agencies’ participation in three 

collaborative mechanisms—a task force, memorandums of understanding 

(MOU), and coordinating councils—has also facilitated security improvements. 

The figure below illustrates how the agencies divide their responsibilities.

Division of Regulatory Authority among Federal Agencies Responsible for the Security of 

Risk-significant Radioactive Sources during Ground Transport

NRC and DOT face challenges related to collecting data and ensuring 

compliance with NRC security requirements for ground transport of risksignificant radioactive sources, but opportunities exist to address them. For 

example, NRC does not directly inspect whether motor carriers contracted by 

licensees to transport risk-significant sources have implemented its security 

requirements because its regulatory authority extends only to its licensees. 

Instead, NRC requires licensees to ensure that carriers meet the requirements, 

and its inspectors are to verify that licensees do so. DOT and state officials have 

regulatory authority over carriers, but their inspectors do not enforce compliance 

with NRC security requirements because DOT does not have that authority. 

Thus, no federal or state agency directly inspects carriers for compliance with 

NRC’s security requirements. Under a 2015 MOU, the three agencies committed 

to coordinating on inspection activities to optimize available resources. By 

consulting with DOT and DHS to identify an approach to verify that carriers are 

meeting NRC’s security requirements, NRC has an opportunity to further 

strengthen the security of shipments of risk-significant sources, for example, by 

having DOT inspectors verify compliance during on-site investigations.

View GAO-17-58. For more information, 

contact Shelby S. Oakley at (202) 512-3841 or 

oakleys@gao.gov.

Why GAO Did This Study

Concerns have been raised that risksignificant sources could be stolen by 

terrorists and used to create a “dirty 

bomb.” NRC is responsible for 

licensing the possession and use of 

these sources. DOT regulates the 

transport of such sources, and DHS is 

responsible for securing all modes of 

transportation.

GAO was asked to review the security 

of these sources during ground 

transport. This report examines (1) the 

steps that NRC, DOT, and DHS have 

taken since September 11, 2001, to 

strengthen the security of these 

sources; and (2) the challenges that 

exist to further strengthening the 

security of these sources during

ground transport and opportunities to 

address them. 

GAO reviewed relevant laws and 

regulations, analyzed information on 

source shipments, and interviewed 

federal agency officials, officials from 

four motor carriers identified through 

interviews and research, and officials 

from two of the largest source 

manufacturers.

What GAO Recommends

GAO is making three 

recommendations, including that NRC, 

in consultation with DOT and DHS, 

identify an approach to verify that 

carriers meet NRC requirements. NRC 

agreed with the recommendation. DOT 

agreed to consult with NRC and DHS, 

but did not fully concur, citing a lack of 

authority. GAO clarified the 

recommendation in response to DOT’s 

concern. 
Page i GAO-17-58 Radioactive Sources

Letter 1

Background 8

Agencies Have Taken Steps Since 2001 to Strengthen the 

Security of Risk-Significant Radioactive Sources during Ground 

Transport 17

Agencies Face Challenges to Strengthening the Security of 

Radioactive Sources during Ground Transport, but 

Opportunities Exist to Address Them 32

Conclusions 40

Recommendations for Executive Action 41

Agency Comments and Our Evaluation 41

Appendix I Objectives, Scope, and Methodology 47

Appendix II List of Additional Transportation-related Radiation Source 

Protection and Security Task Force Recommendations 52

Appendix III Comments from NRC 56

Appendix IV Comments from DOT 61

Appendix V GAO Contact and Staff Acknowledgments 63

Tables

Table 1: Nuclear Regulatory Commission (NRC) Thresholds for 

Classifying Quantities of Radionuclides as Category 1 and 

Category 2 (Risk-Significant) 10

Table 2: Transportation-related Radiation Source Protection and 

Security Task Force Recommendations to the Department 

of Transportation (DOT), Nuclear Regulatory Commission 

(NRC), and Other Government Entities, 2006-2014 52

Contents
Page ii GAO-17-58 Radioactive Sources

Figures

Figure 1: Division of Regulatory Authority among Federal 

Agencies Responsible for the Security of Risk-Significant 

Radioactive Sources during Ground Transport 5

Figure 2: Radioactive Source for Well Logging 9

Abbreviations

Ci curie

CVSA Commercial Vehicle Safety Alliance

DHS Department of Homeland Security 

DOT Department of Transportation

FMCSA Federal Motor Carrier Safety Administration

GAO Government Accountability Office

HRCQ Highway Route Controlled Quantity

IAEA International Atomic Energy Agency

MOU memorandum of understanding

mSv millisievert

NGCC Nuclear Government Coordinating Council 

NRC Nuclear Regulatory Commission

NSCC Nuclear Sector Coordinating Council

NSTS National Source Tracking System

PHMSA Pipeline and Hazardous Materials Safety Administration

RAMQC radioactive material in quantities of concern

RDD radiological dispersal device

RED radiological exposure device

SAVE Systematic Alien Verification for Entitlements

SI International System of Units

TBq terabecquerel

TSA Transportation Security Administration

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-17-58 Radioactive Sources

441 G St. N.W.

Washington, DC 20548

February 7, 2017

The Honorable Claire McCaskill

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Thomas R. Carper

Ranking Member

Permanent Subcommittee on Investigations

Committee on Homeland Security and Governmental Affairs

United States Senate

Radioactive sources are commonly used in thousands of locations in the 

United States and many other countries for medical, industrial, and 

research purposes. These sources are used to, among other things, treat 

cancer, sterilize food and medical instruments, and detect flaws in 

pipelines and other types of metal welds. Since terrorists attacked the 

United States in 2001, concerns have grown that they could obtain and 

use radioactive materials to build a “dirty bomb”—a type of radiological 

dispersal device that uses conventional explosives to disperse radioactive 

material. Recent terrorist activity in the United States, Europe, and the 

Middle East has heightened such concerns, and protecting radioactive 

materials from being stolen and misused is a significant concern in the 

United States and other parts of the world. Most experts agree that the 

radioactive material dispersed by a dirty bomb would have few short-term 

health effects for exposed individuals and that the explosives, not the 

radioactive material, would likely cause the greatest immediate injuries, 

fatalities, and property damage. However, a dirty bomb—depending on 

the type, form, amount, and concentration of radioactive material used—

could cause radiation exposure in individuals in close proximity to the 

material for an extended time and potentially increase the long-term risks 

of cancer for those contaminated. In addition, the evacuation and cleanup 

of contaminated areas after such an explosion could lead to panic and 

serious economic costs for the affected population as individuals with 

homes or businesses in that area may not be able to return for an 

extended period of time because of actual or feared contamination.

We have previously identified serious problems with controlling and 

securing radioactive sources in the United States. In July 2016, we 

reported that, in some cases, licenses for radioactive sources could be 

counterfeited and that licensees could obtain sources containing 

Letter
Page 2 GAO-17-58 Radioactive Sources

radionuclides in quantities greater than what is allowed by their license.1

For example, during covert testing for our July 2016 review, we were able 

to obtain a license and secure commitments to purchase, in multiple small 

quantities, enough radioactive material to be considered attractive for use 

in a dirty bomb. As a result, we recommended that the Nuclear 

Regulatory Commission (NRC) take action to better control radioactive 

sources. NRC neither agreed nor disagreed with the recommendation but 

noted that the agency had formal evaluations underway considering all 

three recommendations included in our report. We also found security 

concerns related to radioactive sources used at industrial facilities and 

medical facilities in June 2014 and September 2012, respectively. In June 

2014, we reported that entities licensed by NRC to use industrial 

radioactive sources faced challenges securing and protecting the sources 

against insider threats (e.g., theft by individuals authorized to have 

unescorted access to the material).2 In September 2012, we reported that 

NRC’s requirements were broadly written and did not prescribe specific 

measures that medical facilities should take to ensure the security of 

equipment containing radioactive sources.3

 1

GAO, Nuclear Security: NRC Has Enhanced the Controls of Dangerous Radioactive 

Materials, but Vulnerabilities Remain, GAO-16-330 (Washington, D.C.: July 1, 2016). A 

radionuclide is an unstable, radiation-emitting nuclide. A nuclide is a particular atomic form 

of an element distinguished from other nuclides by its number of neutrons and protons, as 

well as by its energy states.

2

GAO, Nuclear Nonproliferation: Additional Actions Needed to Increase the Security of 

U.S. Industrial Radiological Sources, GAO-14-293 (Washington, D.C.: June 6, 2014). We 

recommended, among other things, that NRC conduct an assessment of the 

trustworthiness and reliability review process—a process by which licensees approve 

employees for unescorted access—to determine if it provides reasonable assurance 

against insider threats. This recommendation remains open, and GAO reported that as of 

October 2016, NRC was conducting a review of its security requirements for radioactive 

sources and that review is expected to provide additional insights into both the 

trustworthiness and reliability review to mitigate insider threats and the specificity 

associated with NRC’s guidance for conducting trustworthiness and reliability 

assessments.

3

GAO, Nuclear Nonproliferation: Additional Actions Needed to Improve Security of 

Radiological Sources at U.S. Medical Facilities, GAO-12-925 (Washington, D.C.: Sept. 10, 

2012). We recommended, among other things, that NRC strengthen security requirements 

by providing hospitals and medical facilities with specific measures they must take to 

develop and sustain a more effective security program, ensure inspectors receive 

additional training, and provide additional guidance to facility officials about how to 

adequately secure equipment containing high-risk radioactive sources. NRC did not 

implement the recommendation to provide specific measures to hospitals and medical 

facilities, but did take steps to ensure inspectors receive additional training and to provide 

additional guidance to facility officials.
Page 3 GAO-17-58 Radioactive Sources

The specific threat to human health posed by a radioactive source 

depends primarily on the radionuclide it contains, its chemical form, and 

its level of radioactivity. The International Atomic Energy Agency’s 

(IAEA)4 Code of Conduct on the Safety and Security of Radioactive 

Sources serves as a guide to define the 16 radionuclides used in 

radioactive sources that—in specific quantities—warrant enhanced 

security and protection measures beyond those that were in effect before 

the terrorist attacks on the United States on September 11, 2001.5

Category 1 quantities of radioactive sources are considered the most 

dangerous because, if not managed safely and securely, they would be 

likely to cause permanent injury to a person who handled them or was 

otherwise in contact with them for more than a few minutes and would be 

potentially fatal to anyone in close contact for more than a few minutes to 

an hour. Category 2 quantities of radioactive sources could cause 

permanent injury to a person who handled them or was otherwise in 

contact with them for a period of minutes to hours and could be potentially 

fatal to a person if close to this material for a period of hours to days. 

NRC considers category 1 and 2 radioactive sources to be “risksignificant radioactive sources.” Throughout this report, we use this term 

to refer to category 1 and 2 sources.

According to an IAEA document, radioactive sources are most vulnerable 

to sabotage or diversion during transport. NRC data indicate that from 

January 2010 through September 2015, there were 14 incidents involving 

23 risk-significant radioactive sources that were reported lost, missing, or 

stolen during transport in the United States.6 Of these, 22 sources were 

found within the same day, and 1 was found 5 days after it was declared 

missing.

NRC, the Department of Transportation (DOT), and the Department of 

Homeland Security (DHS) are the primary federal agencies responsible 

for regulating the security of risk-significant radioactive sources. Keeping 

 4

The IAEA is an independent organization based in Vienna, Austria, that is affiliated with 

the United Nations. Its mission includes promoting the peaceful uses of nuclear energy 

and verifying that nuclear materials intended for peaceful purposes are not diverted to 

military purposes. 

5

International Atomic Energy Agency, Code of Conduct on the Safety and Security of 

Radioactive Sources, IAEA/CODEOC/2004 (Vienna, Austria: January 2004).

6

Lost or missing licensed material means licensed material whose location is unknown. It 

includes material that has been shipped but has not reached its destination and whose 

location cannot be readily traced in the transportation system.
Page 4 GAO-17-58 Radioactive Sources

radioactive material out of the hands of terrorists is a stated top priority for 

NRC. NRC issues licenses to possess, use, transfer, and dispose of 

radioactive material, including radioactive sources, and has established 

security requirements for their protection. It also promulgates standards 

for packaging used to transport certain radioactive materials and 

conducts oversight of facilities—such as hospitals, industrial sites, and 

research facilities—that use and store radioactive sources. DOT, through 

its Pipeline and Hazardous Materials Safety Administration (PHMSA), 

issues and enforces regulations for all modes of transport (i.e., air, 

ground, rail, and water) of hazardous materials,7 including safety and 

security regulations for the transport of risk-significant radioactive 

sources.8 DOT also oversees the safe and secure operation of motor 

carriers—such as large trucks—through its Federal Motor Carrier Safety 

Administration (FMCSA). DHS, through its Transportation Security 

Administration (TSA), has broad responsibility for ensuring the security of 

all modes of transport.9 In addition to these federal agencies, as will be 

discussed further in this report, state officials play a significant role in 

implementing NRC and DOT regulations. Figure 1 demonstrates how the 

federal agencies divide these responsibilities for ground transport.

 7

DOT is required to designate materials as hazardous when the Secretary of 

Transportation determines that transporting the material in commerce in a particular 

amount and form may pose an unreasonable risk to health and safety or property. 49 

U.S.C. § 5103. Such substances and materials include explosives, flammable liquids, and 

radioactive materials.

8

49 C.F.R. § 1.97.

9

Aviation and Transportation Security Act, Pub. L. No. 107-71, §101 (2001), codified at 49 

U.S.C. §114, and DHS Delegation Number 7060.2.
Page 5 GAO-17-58 Radioactive Sources

Figure 1: Division of Regulatory Authority among Federal Agencies Responsible for the Security of Risk-Significant 

Radioactive Sources during Ground Transport

In 2006, an NRC-led task force on radioactive source security evaluated 

federal transport programs for radioactive material, including risksignificant sources, and concluded that safety regulations provided a 

“level of protection” from the security risks associated with the transport of 

these materials.10 The task force report stated that considerable progress 

had been made to include security provisions in the safety standards or 

as companion documents, but that additional efforts were necessary to 

enhance transportation security. In response to a task force 

recommendation to enhance transportation security, NRC took action to 

strengthen regulations related to the security of ground and rail shipments 

of risk-significant radioactive sources.

You asked us to review the security of risk-significant radioactive sources 

during ground transport. This report examines (1) the steps that NRC, 

DOT, and DHS have taken since September 11, 2001, to strengthen the 

 10Nuclear Regulatory Commission, Radiation Source Protection and Security Task Force, 

The Radiation Source Protection and Security Task Force Report (Washington, D.C.: 

August 2006). The report further stated that the safety regulations are widely 

implemented, and the level of compliance is high.
Page 6 GAO-17-58 Radioactive Sources

security of risk-significant radioactive sources during ground transport and 

(2) the challenges, if any, that exist to further strengthening the security of 

these sources during ground transport and the potential opportunities to

address them.

To identify what steps NRC, DOT, and DHS have taken to increase the 

security of risk-significant radioactive sources during ground transport, we 

reviewed relevant laws, regulations, and agency guidance and 

interviewed officials responsible for transportation and hazardous material 

security at NRC, DOT, and DHS. To identify steps that NRC has taken, 

we reviewed the agency’s orders and regulations for the physical 

protection of category 1 and 2 radioactive material, as well as packaging 

and transfer reporting regulations. We also interviewed NRC officials with 

oversight over risk-significant radioactive sources to understand how 

NRC imposes and enforces Part 37 requirements. To identify steps DOT 

has taken, we reviewed PHMSA and FMCSA regulations and guidance, 

including those related to motor carrier transportation security plans. We 

also interviewed officials from PHMSA and FMCSA to determine how 

their regulatory programs have been implemented. We used data from 

FMCSA’s Motor Carrier Management Information System to determine 

how many on-site investigations of motor carriers federal and state 

officials conducted in 2015, the most recent year for which complete data 

were available at the time of our review. We assessed the reliability of the 

Motor Carrier Management Information System data by reviewing 

relevant documentation and Inspector General reports, and interviewing 

knowledgeable officials. For DHS, we reviewed regulations and guidance 

issued by TSA and interviewed officials from the Office of Security Policy 

and Industry Engagement. In addition, we reviewed IAEA documents, 

including the Code of Conduct on the Safety and Security of Radioactive 

Sources, the Categorization of Radioactive Sources, and Regulations for 

the Safe Transport of Radioactive Material.

11 We also identified several 

mechanisms for inter-agency collaboration designed to improve the 

security of risk-significant radioactive sources—such as the Radiation 

Source Protection and Security Task Force—and examined whether 

these collaborations have resulted in security improvements. We also 

reviewed three memorandums of understanding (MOU) among NRC, 

DOT, and DHS that are related to the security of risk-significant 

radioactive sources.

 11International Atomic Energy Agency, Code of Conduct; Categorization of Radioactive 

Sources, No. RS-G-1.9 (Vienna, Austria: July 2005); and Regulations for the Safe 

Transport of Radioactive Material, 2012 Edition, No. SSR-6 (Vienna, Austria: 2012).
Page 7 GAO-17-58 Radioactive Sources

To determine what challenges, if any, exist to further strengthening the 

security of risk-significant radioactive sources during ground transport and 

opportunities to address them, we reviewed NRC, DOT, and DHS laws, 

regulations, and procedures and interviewed officials from these agencies 

involved in inspecting risk-significant sources to determine how these 

laws, regulations, and procedures are implemented. We also interviewed 

representatives from four motor carrier companies that transport risksignificant radioactive sources, which we identified through interviews and 

research and which responded to our request for an interview, and two 

source manufacturing licensees that NRC officials identified as the largest 

manufacturers to obtain their perspectives on how relevant regulations 

are implemented. We visited one of these manufacturers to observe how 

radioactive sources are manufactured and packaged and observed a 

safety inspection for a shipment of radioactive material. During this visit, 

we also met with federal and state law enforcement officials, as well as 

state officials responsible for securing risk-significant sources to 

understand how NRC and DOT regulations are implemented at the state 

level.12 We also interviewed officials from the Commercial Vehicle Safety 

Alliance (CVSA), to determine how the motor carrier inspection program 

is implemented.13 While the views of these individuals provided relevant 

insights, they are not representative of the universe of licensee, motor 

carrier, or law enforcement representatives with responsibility for the 

security of radioactive sources during transport and therefore do not 

represent all views on the topic. Additionally, we reviewed a nongeneralizable sample of inspection records provided by NRC for 21 

separate inspections of risk-significant source licensees to obtain 

examples of how NRC inspectors are inspecting for compliance with Part 

37 requirements.

14 We also analyzed data from NRC’s National Source 

Tracking System (NSTS) database for 2013 through 2014, the 2 most 

recent years for which complete data were available at the time of our 

review, to determine the extent to which NRC has information about the 

number of sources transported annually, and the mode by which they are 

 12We selected officials from the state in which the manufacturer was located. 

13The CVSA is a nonprofit association comprised of local, state, provincial, territorial and 

federal commercial motor vehicle safety officials and industry representatives that 

promotes motor carrier safety.

14NRC provided these 21 inspection records based on our request for examples of 3-4 

inspection records for each NRC region. Because this was a non-generalizable sample, 

the information collected cannot be generalized to all inspection records of risk-significant 

source licensees, although it provides examples of how NRC inspectors are inspecting for 

compliance with the agency’s security regulations.
Page 8 GAO-17-58 Radioactive Sources

transported. To assess the reliability of data from the NSTS database, we 

reviewed relevant documentation and interviewed NRC officials. We 

found NSTS data to be sufficiently reliable to report on the number of risksignificant source transfers from 2013 through 2014. We also obtained 

and analyzed data from NRC’s radioactive material in quantities of 

concern (RAMQC) database from 2013 through 2014, the 2 most recent 

years for which complete data were available at the time of our review, to 

determine the extent to which NRC has information about the number of 

domestic category 1 shipments. To assess the reliability of data from the 

RAMQC database, we reviewed relevant documentation, interviewed 

NRC officials, and reviewed the data for errors. While NRC officials stated

that manual data entry may result in errors in the database, we 

determined these data to be sufficiently reliable to report on the number 

records it contained for domestic category 1 shipments and shipments

that occurred from 2013 through 2014. Further, we also reviewed federal 

regulations and interviewed NRC and DOT agency officials to determine 

the extent to which DOT and NRC had assessed whether additional level 

VI safety inspections could enhance the security of shipments of risksignificant radioactive sources that would not otherwise undergo such 

inspections. Appendix I presents a more detailed description of our scope 

and methodology.

We conducted this performance audit from April 2015 to February 2017, 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Radioactive sources are used throughout the world for medical, industrial, 

and research purposes. Sources containing radioactive material—such as 

cesium-137, cobalt-60, and iridium-192—are produced artificially in 

nuclear reactors and accelerators, and are available in the United States 

and other countries. To prevent their dispersal, radioactive materials are 

typically sealed in a metal capsule made of stainless steel, titanium, or 

platinum. The radioactive material used in sealed sources can be found in 

various forms, such as metals or powders, and is measured by its level of 

radioactivity. Radioactive sources vary in size from a grain of rice to rods 

several inches in length. Figure 2 provides an image of a radioactive 

source.

Background
Page 9 GAO-17-58 Radioactive Sources

Figure 2: Radioactive Source for Well Logging

Note: Well logging is a process that uses sealed sources and/or unsealed radioactive materials to 

determine whether a well, drilled deep into the ground, contains minerals, such as coal, oil, and 

natural gas.

The United States has endorsed IAEA’s Code of Conduct, which 

established thresholds for classifying the quantities of 16 radionuclides 

used in radioactive sources into categories 1 and 2, which NRC considers 

to be risk-significant. NRC uses these thresholds as a basis for requiring 

licensees to implement additional security protections for risk-significant 

radioactive sources. These radionuclides and the quantities that qualify 

them as category 1 or 2 radioactive sources are shown in table 1.
Page 10 GAO-17-58 Radioactive Sources

Table 1: Nuclear Regulatory Commission (NRC) Thresholds for Classifying 

Quantities of Radionuclides as Category 1 and Category 2 (Risk-Significant)

Radionuclides

Category 1 

quantities (in 

terabecquerels)

Category 2 

quantities (in 

terabecquerels)

Americium-241 60 0.6

Americium-241/ Beryllium 60 0.6

Californium-252 20 0.2

Cesium-137 100 1.0

Cobalt-60 30 0.3

Curium-244 50 0.5

Gadolinium-153 1,000 10.0

Iridium-192 80 0.8

Plutonium-238 60 0.6

Plutonium-239/ Beryllium 60 0.6

Promethium-147 40,000 400.0

Radium-226 40 0.4

Selenium-75 200 2.0

Strontium-90 1,000 10.0

Thulium-170 20,000 200.0

Ytterbium-169 300 3.0

Source: NRC | GAO-17-58.

Note: The greater the activity level of radioactive decay—measured in terabecquerels (TBq)—the 

more radiation emitted, which increases the potential risk to the public if the radioactive materials are 

lost or stolen. The becquerel is a unit of measurement of radioactivity under the International System 

of Units (SI), and represents one disintegration per second. A TBq is the equivalent of one trillion 

(1012) becquerels and is NRC’s regulatory standard. The curie (Ci) is a non-SI unit still in wide use. 

One becquerel equals 2.7 x 10-11 curies.

The Atomic Energy Act of 1954 gives NRC primary responsibility for 

regulating most domestic industrial, medical, and research uses of 

radioactive materials to protect public health and safety. NRC issues 

licenses to companies, organizations, institutions, and other entities to 

possess, use, transfer, and dispose of radioactive sources for these 

purposes; NRC refers to these entities as licensees. NRC conducts 

typically unannounced, periodic inspections to ensure that licensees meet 

NRC’s regulatory requirements. The type and frequency of inspections 

vary on the basis of the type and amount of material the licensee 

possesses, according to NRC inspectors. The act authorizes NRC to 

relinquish primary regulatory authority over radioactive materials to states 
Page 11 GAO-17-58 Radioactive Sources

(called “agreement” states) that agree to certain conditions. To date, NRC 

has relinquished regulatory authority to 37 states.15

DHS and DOT share responsibility for the security of the transportation 

sector. DHS is broadly responsible for protecting the nation from 

terrorism.16 Within DHS, TSA has responsibility for securing the nation’s 

transportation systems and is the lead agency responsible for the security 

of commercial vehicles.17 DOT—through PHMSA and FMCSA—

maintains a prominent regulatory role with respect to the transportation of 

hazardous materials by motor carriers, including risk-significant 

radioactive sources, and has multiple sets of regulations pertaining to 

highway transportation of hazardous materials.18 Specifically, PHMSA is 

responsible for issuing and enforcing regulations governing the safe 

transportation of hazardous materials.19 PHMSA has also issued 

regulations for the packaging and transportation of radioactive 

materials.

20

• Packaging Regulations. PHMSA regulations generally govern the 

type of packaging that is to be used to transport radioactive material. 

PHMSA has established thresholds to determine the type of 

packaging that should be used to transport radioactive sources that 

are based on the quantity of radioactivity contained in each source. 

According to PHMSA, these thresholds are based on IAEA safety 

standards.21

 1542 U.S.C. § 2021(b). These states have entered into an agreement with NRC to adopt 

and ensure licensee compliance with state regulations that are generally compatible with, 

and at least as stringent as, NRC regulations. The states have assumed regulatory 

authority over certain types and quantities of radioactive material. Agreement states 

typically oversee radioactive security through their state health or environment 

departments.

16Pub. L. No. 107-296, § 2135 (2002). 

17See Pub. L. No. 110-53, § 1310, (2007); Pub. L. No. 107-71 (2001); HSPD-7; Exec. 

Order No. 13,416, 71 Fed. Reg. 71,033 (2006).

1849 U.S.C. § 5103. 

1949 C.F.R. § 1.97(b).

2049 C.F.R. Part 173, Subpart I.

21International Atomic Energy Agency, Regulations for the Safe Transport of Radioactive 

Material, 2009 Edition, Safety Requirements, No. TS-R-1 (Vienna, Austria: 2009).
Page 12 GAO-17-58 Radioactive Sources

• Type A package. Radioactive material in quantities that are below 

PHMSA’s threshold, including some category 2 sources, are 

authorized for shipment in a Type A package. PHMSA requires 

these packages to maintain their integrity under conditions of 

normal transport and meet certain design requirements.22

• Type B package. Radioactive material in quantities that meet or 

exceed PHMSA’s threshold, including all category 1 quantities of 

radioactive sources and most quantities of category 2 radioactive 

sources, must be transported in a Type B package.23 NRC defines 

the performance requirements that Type B packages must be 

designed to meet. NRC requires that these packages be able to 

survive serious accident tests and prevent dispersal of radioactive 

material. NRC also specifies the tests that these packages must 

undergo to demonstrate that they meet NRC performance 

requirements, which include withstanding (1) a free fall drop of 30 

feet, (2) a puncture test drop of 40 inches onto a 6-inch diameter 

vertical steel peg at least 8 inches long, (3) immersion in a fire 

burning at least 1,475 degrees Fahrenheit for 30 minutes, and (4) 

water immersion at a depth of at least 50 feet.24 Type B packaging 

must be designed and constructed to meet NRC requirements.25

• Transport Control Regulations. According to PHMSA 

documentation, proper packaging is the primary means of ensuring 

the safety of transported radioactive materials, but transport controls 

provide additional levels of safety. Transport controls include limits on 

the amount of radiation that can be emitted from Type A or B 

packages that may be safely aggregated on a single vehicle or in a 

storage area—PHMSA refers to these limits as the transport index. 

The transport index is based on the largest measure of radioactivity at 

 22See 49 C.F.R. §§ 173.410 and 173.412. For example, Type A packaging must be 

designed so that the outside of the packaging incorporates a feature, such as a seal, that 

is not readily breakable, and that, while intact, is evidence that the package has not been 

opened.

23Under the regulations, Type B packaging is required to transport greater than A1 or A2

quantities of radioactive material. See 49 C.F.R. § 173.416.

2410 C.F.R. § 71.73.

2549 C.F.R. § 173.413.
Page 13 GAO-17-58 Radioactive Sources

1 meter from the surface of a package.26 For motor carriers 

transporting multiple packages, no single package may exceed a 

transport index of 10, and a single vehicle may not exceed a 

combined transport index of 50 (e.g., five packages each with a 

transport index of 10). In cases where an individual package has a 

transport index greater than 10 or the combined index is greater than 

50, the vehicle must be used exclusively to transport only those 

packages. There is no limit on the transport index for a vehicle used 

exclusively to transport packages of radioactive material.

• Highway Route Controlled Quantity (HRCQ). PHMSA has 

established a threshold to determine which shipments of radioactive 

material transported in a single package warrant additional safety 

measures. Shipments of radioactive material that exceed this 

threshold are defined as HRCQ. For example, a shipment of a 

radioactive source containing 1,000 TBq or more of cobalt-60 would 

exceed the threshold and would be considered an HRCQ shipment. 

As discussed below, FMCSA has established additional safety 

measures that apply to HRCQ shipments.

DOT’s FMCSA regulates motor carrier safety, including vehicles and 

drivers. FMCSA’s regulations address, among other things (1) standards 

for commercial drivers’ licenses; (2) proper use and operation of 

commercial motor vehicles; (3) adequate inspection, repair, and 

maintenance of vehicles; (4) the transportation of hazardous materials, 

including HRCQ shipments; and (5) hazardous materials safety permits.27

For HRCQ shipments of radioactive materials, FMCSA regulations 

require that carriers apply the following safety measures:

• undergo a level VI vehicle safety inspection;28

 26The transport index is calculated by multiplying the maximum radiation level in 

millisieverts (mSv) per hour at 1 meter (3.3 feet) from the external surface of a package by 

100—equivalent to the maximum radiation level in millirem per hour at 1 meter (3.3 feet). 

An mSv is one thousandth of a sievert. The sievert is the SI unit for dose, and it is defined 

as 1 joule/kilogram. One mSv is approximately 32 percent of the average accumulated 

background dose an individual in the United States receives over 1 year.

2749 C.F.R. Part 383, 49 C.F.R. Part 392, 49 C.F.R. Part 396, 49 C.F.R. Part 397, 49 

C.F.R. Part 385.

2849 C.F.R. § 385.415(b).
Page 14 GAO-17-58 Radioactive Sources

• operate the vehicle over state-designated routes, interstate system 

highways and bypasses or beltways around cities, and select the 

most expedient preferred routes; 29

• prepare a written route plan that must be provided to both the driver 

and licensee and submitted to FMCSA, along with other 

documentation, within 90 days following the acceptance of a package 

for shipment by the motor carrier;30 and

• require drivers to carry proof that, within the preceding 2 years, the 

driver has received training on handling and transporting hazardous 

materials, the properties and hazards of the material being 

transported, and relevant emergency procedures.31

FMCSA enforces regulations through on-site investigations and roadside 

vehicle inspections, which are primarily conducted by state law 

enforcement agencies. Investigations are conducted to review identified 

areas of noncompliance and safety concerns, with a focus on carriers 

previously identified by FMCSA as high-risk; to investigate complaints; or 

in response to other safety and compliance concerns. A FMCSA on-site 

investigation is conducted by either federal or state officials according to 

federal safety fitness standards and takes place at a carrier’s place of 

business.32 These investigations involve reviewing records, interviewing 

personnel, analyzing practices, and identifying any necessary corrective 

actions. According to FMCSA officials, FMCSA employs a risk-based 

approach to identify carriers for investigation. In 2015, according to 

FMCSA’s Pocket Guide to Large Truck and Bus Statistics, there were 

84,741 hazardous materials motor carriers operating in the United 

States.33 FMCSA and state inspectors conducted 617 on-site 

investigations of these motor carriers, according to FMCSA data.

 2949 C.F.R. § 397.101(b).

3049 C.F.R. § 397.101(d),(g). The route plan must contain, among other things, origin and 

destination points; the route selected, including planned stops and estimated departure 

and arrival times; and emergency telephone numbers for responsible officials in each 

state through which the shipment will be transported.

3149 C.F.R. § 397.101(e).

3249 C.F.R. § 385.

33Federal Motor Carrier Safety Administration, Pocket Guide to Large Truck and Bus 

Statistics (Washington, D.C.: May 2016).
Page 15 GAO-17-58 Radioactive Sources

FMCSA also provides grants to state transportation and law enforcement 

officials to conduct vehicle inspections of drivers and motor vehicles, the 

majority of which are conducted roadside or at weigh stations during 

transit. A roadside inspection is an examination of a commercial motor 

vehicle and/or driver by an authorized safety inspector. According to a 

FMCSA’s Pocket Guide, state inspectors conduct approximately 95 

percent of inspections, with the remainder conducted by federal 

inspectors. The inspection is to determine whether the vehicle and/or the 

driver is in compliance with federal safety regulations and, if applicable, 

hazardous material regulations.

The procedures for these inspections were developed by CVSA and are 

updated periodically, according to DOT officials. There are seven levels of 

inspections—starting with the most comprehensive, level I, which 

evaluates both the driver and vehicle, to inspection levels that are 

focused on specific areas, such as the level VI inspection for hazardous 

materials or dangerous goods. A level I inspection examines, among 

other things, the driver’s license; medical examiner’s certificate; record of 

duty status; hours of service; and a check of the vehicle for the presence 

of alcohol or drugs. A level I inspection also includes an examination of 

the vehicle’s inspection report, brake system, coupling devices, exhaust 

system, frame, fuel system, turn signals, brake and head lamps, steering 

mechanism, suspension, tires, wheels and rims, and windshield wipers. 

The inspection also calls for an examination of hazardous material and 

dangerous goods requirements, as applicable.34 If a critical violation of 

the operating criteria for the driver, vehicle, or cargo is identified, the 

inspector is to place the driver or vehicle out-of-service until the violation 

is addressed. Levels II, III, IV, V, and VII are inspections that examine a 

limited set of inspection topics, such as vehicle safety and driver 

credentials. A level VI inspection applies to carriers transporting 

shipments of HRCQ and transuranic waste.35 FMCSA requires that all 

vehicles transporting HRCQ shipments undergo a level VI safety 

inspection prior to departure.36 In addition, officials in other states may 

 34These requirements include verification of shipping papers, vehicle placarding, marking, 

and labels, as well as inspection for any leaks or spills, or unsecured cargo.

35Transuranic waste is a specific type of nuclear waste that is generated by the 

Department of Energy’s nuclear weapons research, production, and cleanup activities at 

sites across the country.

3649 C.F.R. § 385.415.
Page 16 GAO-17-58 Radioactive Sources

choose to conduct an additional en route inspection.37 A level VI safety 

inspection consists of a level I inspection with more stringent vehicle 

safety standards, and a radiation survey of the vehicle and package. One 

example of the stricter standard is that under the level I inspection 

standard, if 20 percent or more of the brakes on a vehicle are out of 

adjustment, an inspector is to place the vehicle out of service, but under 

the level VI inspection standard, the inspector places the vehicle out of 

service if any of its brakes are out of adjustment.

According to FMCSA’s Pocket Guide, in 2015, federal and state officials 

conducted a total of 3,378,172 roadside inspections, of which 191,355 

were of carriers transporting hazardous materials. Of the total roadside 

inspections, violations serious enough to place a driver out-of-service 

occurred in approximately 5 percent of inspections, and violations serious 

enough to place a vehicle out of service occurred in approximately 20 

percent of inspections. Violations serious enough to take a vehicle 

transporting hazardous materials out of service occurred in about 4 

percent of inspections. During this same period, according to FMCSA’s 

Pocket Guide, state officials conducted 226 level VI inspections of HRCQ 

and transuranic shipments.38 Of these 226 inspections, 2 inspections 

found vehicle or driver violations serious enough to take the vehicle or 

driver out of service.

In 1979, NRC and DOT signed an MOU delineating each agency’s 

respective responsibilities to regulate the safe transport of radioactive 

materials.39 One of the general principles of the MOU is that the agencies 

will strive to avoid duplication of inspection and enforcement actions 

regarding shippers and carriers of radioactive material. The MOU 

delineates responsibilities between NRC and DOT in several areas, 

including the following.

• Development of safety standards. Among other things, DOT is 

responsible for the design specifications and safety standards for 

 37States may also choose to require a security escort for these shipments.

38FMCSA officials we interviewed said that DOT data on HRCQ inspections did not 

distinguish between inspections of carriers transporting risk-significant radioactive sources 

and carriers transporting other types of radioactive materials, such as radioactive waste.

39Transportation of Radioactive Materials; Memorandum of Understanding between the 

U.S. Nuclear Regulatory Commission and the Department of Transportation, 44 FR 38690 

(Washington, D.C.: July 2, 1979).
Page 17 GAO-17-58 Radioactive Sources

Type A packages and NRC is responsible for the specifications and 

standards for Type B packages.

• Package review. Among other things, NRC is responsible for 

approving designs for Type B packages.

• Inspection and enforcement. NRC will assist DOT, as appropriate, 

in inspecting shippers of, among other things, radioactive materials in 

quantities that require the use of Type B packages, and NRC and 

DOT will consult each other on the results of their respective 

inspections in areas where the results are related to the other 

agency’s requirements, and each will take enforcement action as it 

deems appropriate within the limits of its authority.

• Accidents and incidents. Among other things, consistent with its 

jurisdiction, DOT will require all carriers to promptly notify it of 

accidents, incidents, and instances of actual or suspected leakage 

involving radioactive material packages if such an event occurs during 

transit, and DOT will promptly notify NRC of such events. NRC will 

require its licensees to notify it of accidents, incidents, and instances 

of actual or suspected leakage involving radioactive material 

packages if such an event occurs prior to delivery or after receipt of 

the package.

Since September 11, 2001, NRC, DOT, and DHS have taken steps to 

strengthen the security of risk-significant radioactive sources during 

ground transport by, among other things, issuing or updating their 

respective regulations. The agencies have also worked to strengthen 

security through participation in a congressionally mandated task force, 

additional MOUs, and coordinating councils to facilitate interagency 

collaboration.

Agencies Have Taken 

Steps Since 2001 to 

Strengthen the 

Security of RiskSignificant 

Radioactive Sources 

during Ground 

Transport
Page 18 GAO-17-58 Radioactive Sources

All three agencies have taken steps to increase the security for the 

ground transport of risk-significant radioactive sources since 2001.

NRC has taken steps to increase the security of risk-significant 

radioactive sources by issuing security orders that were ultimately 

codified in security regulations and by establishing new information 

management systems.

Security Orders Codified in New Security Regulations

Following the terrorist attacks on September 11, 2001, NRC determined 

that certain licensed radioactive materials, including risk-significant 

radioactive sources, should be subject to additional security 

requirements. As a result, NRC issued a series of orders and guidance 

documents directing licensees that manufacture or possess certain 

materials, including risk-significant radioactive sources, to implement 

enhanced security measures. In 2013, NRC replaced most of the orders 

and guidance documents applicable to risk-significant sources by 

amending Title 10 of the U.S. Code of Federal Regulations to add Part 

37.40 Part 37 established physical security requirements for the use and 

transport of risk-significant sources with the intent of providing reasonable 

assurance of preventing theft or diversion of these sources.41

Under NRC Part 37 security requirements, licensees are to implement 

access controls, including fingerprint and background checks for 

personnel with unescorted access to risk-significant radioactive sources, 

and adopt measures to ensure the physical protection of such sources 

 40One order issued to licensees regarding trustworthiness and reliability requirements for 

unescorted access to radioactive materials for service providers that are not 

manufacturers or distributors was not rescinded pending further outreach by NRC 

regarding the applicability of 10 C.F.R. Part 37 requirements to service providers.

41Physical Protection of Byproduct Material, 78 Fed. Reg. 16922 (2013). NRC’s security 

requirements for risk-significant sources went into effect on May 20, 2013 and compliance 

with the final rule was required on March 19, 2014 for states where NRC retains regulatory 

authority. According to NRC, it confirmed the Agreement States’ adoption of adequate and 

compatible Part 37 requirements by the deadline of March 19, 2016. 

NRC, DOT, and DHS 

Have Taken Steps to 

Increase Security for RiskSignificant Radioactive 

Sources during Ground 

Transport

NRC
Page 19 GAO-17-58 Radioactive Sources

during their use and transport via motor carrier or rail. In addition, 

licensees must establish, implement, and maintain a security program 

that includes a written security plan for the protection of risk-significant 

sources. This plan must include, among other things, the measures and 

strategies used to implement NRC Part 37 security requirements and 

must identify the security resources being used to meet the requirements. 

The licensees’ overall security program must also include measures and 

procedures to train employees, the establishment of security zones, 

protection of sensitive information, coordination with local law 

enforcement authorities, testing and maintenance of security equipment, 

and periodic program reviews.

NRC Part 37 security requirements also require licensees to undertake 

specific preplanning and coordination measures for shipments of risksignificant sources. For example, before they can ship category 1 

sources, shipping licensees must pre-plan and coordinate expected 

departure and arrival times of a shipment with the receiving licensee. The 

shipping licensee must also pre-plan and coordinate shipment information 

with relevant officials from each state through which the shipment will 

pass. This planning and coordination must include a discussion of 

whether the state intends to provide law enforcement escorts and the 

identification of safe havens, which are readily recognizable and 

accessible sites at which security is present or from which, in the event of 

an emergency, the driver(s) can notify and wait for law enforcement. 

Representatives of motor carriers we interviewed identified truck stops, 

weigh stations, and police or military barracks as potential safe havens. 

Before the shipping licensees can ship category 2 sources, they must, 

among other things, coordinate with the receiving licensee regarding an 

expected arrival time and a “no-later-than” arrival time.

In addition, NRC Part 37 requires that licensees who transport sources 

using their own vehicles, or deliver sources to a carrier for transport, take 

specific measures to ensure that category 1 radioactive sources are 

adequately protected while being transported. Specifically, licensees 

shipping category 1 quantities of radioactive sources by road must

• ensure that movement control centers are established with 24-hour 

position monitoring and the ability to immediately contact law 

enforcement in an emergency;

• ensure that shipments are continuously and actively monitored by a 

telemetric position monitoring system or an alternative tracking 

system (such as, but not limited to, a global positioning system);
Page 20 GAO-17-58 Radioactive Sources

• ensure that redundant communications are established between the 

vehicle driver and the movement control center (and escort vehicle, 

when used);

• develop contingency procedures, including protocols for the loss of 

communications, and responses to an actual or attempted theft or 

diversion of a shipment; and

• provide an individual—such as a second driver—to accompany the 

primary driver for shipments exceeding the maximum number of 

driving service hours as established by FMCSA.

For shipments of category 2 quantities of radioactive sources, licensees 

must use carriers that have established

• a package tracking system (e.g., a system that requires an authorized 

signature prior to package release); and

• a means to maintain constant control and/or surveillance during 

transit, including the ability for the carrier to immediately summon the 

appropriate law enforcement response or emergency assistance.

While the shipping licensee is generally responsible for ensuring these 

measures are implemented by the carrier, the receiving licensee may 

choose to accept the coordination and protection responsibilities of the 

shipping licensee.

In December 2014, Congress enacted legislation directing NRC to 

evaluate the effectiveness of the Part 37 regulations and determine 

whether the regulations are adequate to protect “high-risk radiological 

material.”42 In response to this mandate, the agency implemented a 

retrospective program review to provide an objective assessment of the 

Part 37 security requirements and associated implementation guidance 

related to risk-significant sources. NRC provided Congress a report based 

on their review in December 2016.

Information Management Systems

NRC established several information management systems to improve 

the security of risk-significant radioactive sources by verifying licenses 

and tracking radioactive source transactions. Specifically, NRC 

established the Integrated Source Management Portfolio which consists 

 42Consolidated and Further Continuing Appropriations Act, 2015, Pub. L. No. 113-235, 

div. D, tit. IV, § 403 (2014).
Page 21 GAO-17-58 Radioactive Sources

of three systems: the NSTS, the Web-Based Licensing System, and the 

License Verification System. In 2009, in response to IAEA guidance in its 

Code of Conduct and requirements of NRC in the Energy Policy Act of 

2005, NRC implemented the NSTS to provide an accounting function for 

risk-significant radioactive sources. Under NRC regulations, licensees are 

required to enter a transaction report into the NSTS, or provide a 

transaction report to NRC for entry into the NSTS, no later than 1 

business day following manufacturing, transferring, receiving, 

disassembling, or disposing of a risk-significant radioactive source.43

Transaction reports include information such as shipping and receiving 

licensee numbers, the radioactive material in the source, and the activity 

level of the source being transferred. In 2012, NRC implemented the 

Web-Based Licensing System to allow NRC and agreement states to 

manage license applications, issuances, amendments, reports, and 

terminations. In 2013, NRC implemented the License Verification System, 

which allows a shipping licensee to verify that a receiving licensee is 

authorized to receive the type, form, and quantity of radioactive material 

being transferred.

In addition to its Integrated Source Management Portfolio, in 2003, NRC 

created the RAMQC database. According to NRC, the original purpose of 

the RAMQC database was to have an awareness of shipments of large 

quantities of radioactive material transiting the United States. NRC 

regulations require that licensees provide NRC, and the governor of any 

state through which the shipment travels, with advance notification of any 

domestic shipments of category 1 sources.44 NRC uses the RAMQC 

database to document information on these advance notices of category 

1 sources—such as the name of the motor carrier transporting the 

shipment, locations through which the shipment will be routed, and 

whether the shipment is classified as HRCQ. NRC officials with 

responsibility for the RAMQC database explained that it may contain

errors stemming from a lack of controls over manual data entry. 

Specifically, these officials explained that there may be errors in the total 

radioactivity of a shipment and variances in company names. According 

to these officials, while they conduct a weekly audit of information in the 

system, the agency is not required to maintain data in the RAMQC 

 4310 C.F.R. § 20.2207.

4410 C.F.R. § 37.77. The Part 37 requirements related to transporting category 1 and 2 

sources, including the advance notification requirement, also apply to imports and exports 

of radioactive material during the domestic portion of the transport. 10 C.F.R. § 37.3(b)(2).
Page 22 GAO-17-58 Radioactive Sources

database as a historical record. NRC uses information from the database 

to generate daily reports of planned and active shipments. According to 

NRC officials, NRC also sends the reports to other federal agencies, 

including PHMSA, U.S. Customs and Border Protection, and the Federal 

Bureau of Investigation. Customs and Border Protection officials that we 

interviewed stated that RAMQC database reports are a critical part of 

their efforts to determine the legitimacy of risk-significant radioactive 

material shipments crossing the border to enter or leave the United 

States, or transiting through the United States.

Since 2001, DOT’s PHMSA and FMCSA have taken actions to improve 

how motor carriers ensure the security of hazardous materials—including 

shipments of risk-significant radioactive sources—by updating 

transportation security regulations and establishing new oversight and 

enforcement activities, respectively.

PHMSA

PHMSA has taken steps to improve the security of risk-significant 

radioactive sources by requiring motor carriers that transport such 

material to have transportation security plans and security training for 

motor carrier employees. Specifically, in March 2003, DOT began 

requiring carriers of certain types and quantities of hazardous materials to 

have a transportation security plan.45 Hazardous materials covered under 

the requirement included, among other things, certain types and 

quantities of explosive materials, flammable materials, and HRCQ 

shipments, which included only those shipments of risk-significant 

sources that met or exceeded HRCQ thresholds. In March 2010, 

PHMSA—in consultation with TSA—revised its requirement for which 

shipments require a transportation security plan to include all shipments 

of risk-significant sources rather than just those that met or exceeded the 

 45Hazardous Materials: Security Requirements for Offerors and Transporters of 

Hazardous Materials, 68 Fed. Reg. 14510 (2003) (codified at 49 C.F.R. Part 172). The 

regulation was issued by DOT’s Research and Special Program Administration. The 

Norman Y. Mineta Research and Special Programs Improvement Act of 2004 established

PHMSA and transferred regulatory authority for hazardous materials safety to PHMSA. 

Pub. L. No. 108-426, § 2 (2004). 

DOT
Page 23 GAO-17-58 Radioactive Sources

HRCQ threshold.46 Under PHMSA regulations, a transportation security 

plan must address, at a minimum, the following elements.47

• Personnel security. Measures to confirm information provided by job 

applicants hired for positions that involve access to and handling of 

the hazardous materials covered by the security plan.

• Unauthorized access. Measures to address the risk that 

unauthorized persons may gain access to the hazardous materials or 

the vehicles being used to transport the hazardous materials covered 

by the plan.

• En route security. Measures to address the security risks of 

shipments of hazardous materials covered by the security plan during 

transportation from the shipment’s origin to its final destination.

According to DOT officials, PHMSA provides motor carriers with a booklet 

that outlines general security elements they should include in a 

transportation security plan. To encourage motor carriers to adopt carrierspecific plans that address the distinct risks associated with their 

operations, as identified by the motor carriers, PHMSA does not provide 

specific guidance for developing the individual components of a plan. 

Under PHMSA regulations, transportation security plans must be in 

writing and must be retained by the motor carrier company for as long as 

the plan remains in effect. Copies of the most recent transportation 

security plans, or portions thereof, must be available to the motor carrier 

employees who are responsible for implementing the plan, consistent with 

personnel security clearance or background investigation restrictions and 

a demonstrated need to know. Transportation security plans must be 

revised and updated by the motor carrier as necessary to reflect changing 

circumstances. When a security plan is updated or revised, all copies of 

the plan must be maintained as of the date of the most recent revision. 

According to an interagency report, PHMSA does not approve 

transportation security plans. However, a FMCSA official we interviewed 

stated that FMCSA officials review the transportation security plans as 

part of FMCSA’s on-site investigations.

 46Hazardous Materials: Risk-Based Adjustment of Transportation Security Plan 

Requirements, 75 Fed. Reg. 10974 (2010); 49 C.F.R. Part 172.800(b)(15). 

4749 CFR § 172.802(a)(1)-(3). According to PHMSA regulations, specific measures may 

vary commensurate with the level of threat at a particular time. See 49 C.F.R. §§ 173.403, 

173.22(c).
Page 24 GAO-17-58 Radioactive Sources

As part of PHMSA’s transportation security plan requirements, PHMSA 

regulations also require that all employees who directly affect hazardous 

materials transportation safety receive safety training, function-specific 

training, and security awareness training.48 Safety training must include 

training concerning methods and procedures for avoiding accidents, such 

as proper procedures for handling packages containing hazardous 

materials. Security awareness training must provide an awareness of 

security risks associated with hazardous material transportation and 

methods to enhance transportation security; it must also include a 

component on how to recognize and respond to security threats. Certain 

employees, including those who handle hazardous materials or who are 

responsible for the implementation of transportation security plans, must 

receive additional, in-depth security training on their company’s security 

procedures and employee responsibilities for security.49 Employees must 

receive the required training at least once every 3 years.50

FMCSA

FMCSA has taken steps to enhance the security of radioactive materials 

shipments by implementing a security review program and requiring that 

motor carriers obtain a permit to transport certain highly hazardous 

materials. Specifically, in 2003, FMCSA established the Security Contact 

Review Program as a stand-alone visit to evaluate the security posture of 

a motor carrier company that transports hazardous materials. According 

to FMCSA officials, these security contact reviews are performed only 

when a carrier has not undergone a FMCSA on-site investigation in 

several years.

In addition, in January 2005, at the direction of Congress, FMCSA 

established the Hazardous Materials Safety Permit Program, which 

requires motor carriers to obtain a permit to transport certain types of 

highly hazardous materials, such as explosives, methane, and HRCQ 

shipments.51 According to a FMCSA guide, 1,394 motor carriers 

 4849 C.F.R. § 172.704(a)((1)-(4).

4949 C.F.R. § 172.704(a)(5). 

5049 C.F.R. § 17.704(c). 

5149 U.S.C. § 5109. FMCSA’s Hazardous Materials Safety Permit regulations are codified 

at 49 C.F.R. Part 385, Subpart E. 
Page 25 GAO-17-58 Radioactive Sources

maintained a safety permit in 2015. To obtain a safety permit, motor 

carriers must have, among other things,

• a vehicle crash rate under a certain threshold—currently 0.136 

crashes per vehicle;

• driver, vehicle, and hazardous material out-of-service rates below the 

respective threshold for each area—9.68 percent, 33.33 percent, and 

6.82 percent;

• a satisfactory transportation security program—including a 

transportation security plan—and associated training, as required by 

PHMSA;

• a communication system that enables drivers to contact their motor 

carrier company during the course of transportation and that 

maintains records of any such communication; and

• a written route plan for HRCQ shipments and certain types of 

explosives.

For transportation of hazardous material for which a permit is required, 

FMCSA requires that

• the vehicle carry a copy of the safety permit, a copy of the route plan, 

and the telephone number of the motor carrier or its representative 

who is familiar with the routing of the material and is available at all 

times while the material is in transit52 and

• drivers communicate with their carrier company when the driver 

begins and ends work each day and when the driver picks up and 

delivers a shipment that requires a safety permit.53

As previously discussed, additional protections are added to shipments 

designated as HRCQ, such as the need for a level VI safety inspection.

DHS’s TSA has broad responsibility for ensuring the security of all modes 

of transport, though DOT continues to issue and enforce regulations 

governing the safe transportation of hazardous material, such as 

radioactive sources.54 However, TSA has established a regulatory 

 5249 C.F.R. § 385.415(a).

5349 C.F.R. § 385.415(c).

54Aviation and Transportation Security Act, Pub.L. No. 107-71, § 101 (2001), codified at 

49 U.S.C. §114) and DHS Delegation Number 7060.2.

DHS
Page 26 GAO-17-58 Radioactive Sources

program to ensure that commercial drivers transporting hazardous 

materials, including risk-significant radioactive sources, undergo security 

threat assessments and has issued guidance on voluntary security 

measures for motor carriers. Specifically, in May 2003, TSA amended its 

transportation security regulations to establish security threat assessment 

standards for determining whether an individual poses a security threat 

that warrants the denial of a commercial driver’s license that includes an 

authorization for the driver to transport hazardous materials.55 These 

regulations implemented a provision in the USA PATRIOT Act that 

prohibits states from issuing a license to operate a motor vehicle 

transporting a hazardous material unless the Secretary of Transportation 

has first determined that the individual does not pose a security risk that 

warrants denial of the license.56 Under TSA’s regulations, generally, 

individuals pose a security threat and cannot receive an authorization to 

operate a motor vehicle transporting hazardous materials if they (1) have 

committed a disqualifying criminal offense; (2) do not meet immigration 

status requirements; (3) do not satisfy TSA analyses of particular 

databases, such as Interpol and terrorist watch lists; or (4) have been 

adjudicated as lacking mental capacity or have been committed to a 

mental hospital.57 These TSA regulations require a fingerprint-based 

criminal history records check, an intelligence-related background check, 

and a final disposition.58

Additionally, in June 2008, TSA provided motor carriers with voluntary 

security measures—referred to by the agency as security action items—

for certain especially-hazardous materials that have the potential to cause 

significant fatalities and injuries or significant economic damage if 

released or detonated during a transportation incident.59 In 2012, TSA 

expanded these voluntary measures to include risk-significant radioactive 

sources to align with DOT’s list of materials requiring a transportation 

 55Security Threat Assessment for Individuals Applying for a Hazardous Materials 

Endorsement for a Commercial Driver’s License, 68 Fed. Reg. 23,852, (May 5, 2003) 

(codified at 49 C.F.R. Parts 1570 and 1572).

56Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept 

and Obstruct Terrorism Act of 2001 (USA Patriot Act) Pub. L. No. 107-56, § 1012 (2001).

5749 C.F.R. § 1572.5(a). 

5849 C.F.R. § 1572.15(a). 

59These hazardous materials include certain types of explosives, flammable gases, toxic 

gases, flammable liquids, and corrosive materials. 
Page 27 GAO-17-58 Radioactive Sources

security plan. In a letter to motor carriers, TSA stated that these 

measures were developed in consultation with PHMSA and FMCSA, and, 

while similar, are not intended to supersede any existing regulatory 

requirements. TSA has also recommended measures beyond NRC Part 

37 security requirements for shipments of risk-significant radioactive 

sources, such as having a means for the driver to transmit an emergency 

alert notification via a “panic button” and requiring driver identification by 

login and password or biometric data to operate a vehicle. According to 

TSA officials, these voluntary measures are printed in pamphlets and 

promoted to motor carriers through major professional associations. TSA 

officials we interviewed stated that many of their agency’s 

recommendations and voluntary measures have been adopted by motor 

carriers.

Since September 11, 2001, NRC, DOT, and DHS have participated in 

three mechanisms for collaboration—an interagency task force, MOUs, 

and coordinating councils—that are intended to facilitate, and in some 

cases have facilitated, security improvements for risk-significant 

sources.60

The 2005 Energy Policy Act directed NRC, along with DOT, DHS, nine 

other federal agencies, and an organization representing agreement 

states, among others, to form a task force to evaluate and provide 

recommendations related to the security of risk-significant sources every 

4 years.61 Since 2006, the task force has issued three reports—in 2006, 

2010, and 2014—and has made 19 recommendations related to 

improving the security of risk-significant radioactive sources during 

 60We have previously reported that agencies frequently use more than one collaboration 

mechanism to address an issue. See Managing for Results: Key Considerations for 

Implementing Interagency Collaborative Mechanisms, GAO-12-1022 (Washington, D.C.: 

Sept. 27, 2012).

61Pub. L. No. 109-58, § 651(d) (2005). NRC also invited the Department of Health and 

Human Services and the Office of Science and Technology Policy to participate.

Agencies’ Participation in 

Interagency Collaboration 

Mechanisms Has Helped 

Strengthen the Security of 

Risk-Significant Sources

Radiation Source Protection 

and Security Task Force
Page 28 GAO-17-58 Radioactive Sources

ground transport.62 According to the 2014 task force report, 15 of the 19 

recommendations were completed; we determined that 1 additional 

recommendation was completed in 2015.

In general, the 19 recommendations related to the ground transport of 

risk-significant radioactive sources have resulted in direct enhancements 

and changes to the security of these sources. Specifically, the task force 

made five recommendations to NRC in 2006, all of which the task force 

reported as completed by 2014, and one additional recommendation was 

made in 2014. For example, the 2006 task force report recommended 

that NRC implement fingerprint and background checks and consider 

additional measures to verify the validity of licenses. NRC addressed this 

recommendation by requiring fingerprint and background checks in its 

Part 37 security requirements and adopted the License Verification 

System to verify the validity of licenses. The agency evaluated, but 

ultimately decided not to fully implement, other recommendations—such 

as for NRC to consider establishing a database of individuals granted 

unescorted access to material—because of privacy concerns or industry 

opposition, according to the 2010 and 2014 task force reports. The task 

force made two recommendations related to the security of risk-significant 

sources during ground transport to DOT in 2006 and reported in the 2010 

report that both were complete. For example, one recommendation 

directed DOT to consider the use of thresholds from IAEA’s Code of 

Conduct in its domestic transportation regulations. As previously 

discussed, PHMSA implemented this recommendation as part of its 

March 2010 transportation security plan regulations requiring a security 

plan for risk-significant sources. The task force also directed 11 

recommendations to the U.S. government, multiple agencies, and states 

related to the security of risk-significant sources, and, according to the 

2014 report, 8 were complete; since this report was issued, an additional 

recommendation has been completed. The 2006 report, for example, 

recommended that NRC, DOT, and DHS develop an MOU to serve as a 

foundation for a transport security program for risk-significant sources. 

This MOU was completed by the agencies in January 2015. The 2014 

 62Radiation Source Protection and Security Task Force, The Radiation Source Protection 

and Security Task Force Report, (Washington, D.C.: August 2006); The 2010 Radiation 

Source Protection and Security Task Force Report (Washington, D.C.: August 2010); The 

2014 Radiation Source Protection and Security Task Force Report (Washington, D.C.: 

August 2014). The 2006 report included both recommendations and action items. 

However, starting with the 2010 report, the task force began referring to all actions to be 

taken as recommendations. Consequently, we refer to the 2006 action items as 

recommendations. 
Page 29 GAO-17-58 Radioactive Sources

report noted that two recommendations to agencies and the U.S. 

government were not yet complete and that actions to implement them 

were ongoing. See appendix II for a description of each of the 19 

recommendations and the status of implementation for each.

Federal agencies have signed two interagency MOUs since 2001 that 

include provisions to address the security of risk-significant radioactive 

sources during ground transport—one was signed in 2004 by DOT and 

DHS,63 and the other was signed in 2015 by NRC, DOT, and DHS.64

The 2004 MOU between DOT and DHS was intended to facilitate the 

development and deployment of transportation security measures, and to 

develop procedures by which the two departments could continue to 

improve their cooperation and coordination in promoting the safety, 

security, and efficiency of the transportation system. For example, the 

MOU stated that DOT will take steps to secure its critical infrastructure 

and key resources, such as DOT facilities, personnel, operations, and 

information systems. DHS will establish transportation security 

performance goals, in consultation with DOT and affected stakeholders, 

and will identify, prioritize, and coordinate the protection of critical 

infrastructure related to transportation security. DHS, among other things, 

will set appropriate transportation security standards, taking DOT 

comments into consideration, and ensure the execution of those 

standards. DOT will collaborate with DHS in the implementation of such 

standards.

The 2015 MOU signed by NRC, DOT, and DHS established a framework 

to allow the agencies to coordinate their respective responsibilities and 

activities related to the secure transportation of radioactive materials 

within the United States and across U.S. borders. The goals of the MOU 

are to, among other things, enhance collaborative exchanges, reduce 

duplication of effort, and promote the standardization of approach and 

 63Roles and Responsibilities; Memorandum of Understanding between the Department of 

Homeland Security and the Department of Transportation, (Washington, D.C.: Sept. 28, 

2004).

64Cooperation on Radioactive Materials Transportation Security, Memorandum of 

Understanding among the Department of Homeland Security, the Department of 

Transportation, and the U.S. Nuclear Regulatory Commission, 80 FR 41097 (Washington, 

D.C.: July 14, 2015). As previously discussed, a 1979 MOU between NRC and DOT 

delineated the respective responsibilities of these agencies for the regulation of safety in 

transportation of radioactive materials. This 1979 MOU remains in effect.

MOUs
Page 30 GAO-17-58 Radioactive Sources

policy. The MOU defined “risk-significant material” as any radioactive 

material that requires security measures to be applied to it above prudent 

management practices. An enclosure to the MOU states that the 

agencies will promote coordination among themselves and their 

component agencies regarding inspection and enforcement activities, 

with the objective of optimizing available resources and maximizing 

communications on areas of mutual interest. The MOU also specified that 

the agencies will establish the working arrangements between NRC and 

the relevant component agencies within DOT and DHS.

Consistent with the MOU, according to NRC officials, an interagency 

working group comprising over 25 staff members from the three agencies 

was formed. In January 2016, the working group presented a draft of a 

multiyear action plan that included how to address the 12 topical areas 

described in the MOU, including risk assessments, strategic planning, 

inspections and enforcement, and intelligence and information sharing. 

According to an NRC official, the plan was approved by the working group 

in September 2016. The plan describes the implementation strategy for 

the 12 topical areas. For example, the strategy for the inspections and

enforcement area is to develop working arrangements among the three 

agencies to coordinate inspection activities and communication protocols. 

These arrangements will allow the agencies to inform each other of 

inspection events and findings—and may allow them to identify systemic 

deficiencies. According to the multi-year action plan, the initial draft of the 

working arrangements for this topical area is to be developed by April 

2017, approved by December 2017, and implemented by April 2018.

Beginning in 2006, DHS established two councils—one consisting of 

federal agencies and one consisting of industry stakeholders—to facilitate 

interaction between governmental entities and industry representatives of 

critical infrastructure owners and operators of nuclear reactors, materials, 

and waste management firms.65 The federal council—the Nuclear 

Government Coordinating Council (NGCC)—is chaired by DHS, and its 

agency membership includes NRC, DOT, and the Department of Energy. 

The industry stakeholder council—the Nuclear Sector Coordinating 

Council (NSCC)—is chaired by the Nuclear Energy Institute, and has a 

membership that includes companies operating commercial nuclear 

power plants in the United States, radioisotope manufacturers and 

 65Homeland Security Presidential Directive-7. This directive was replaced in 2013 by 

Presidential Policy Directive-21 Critical Infrastructure Security and Resilience. 

Nuclear Government 

Coordinating Council and 

Nuclear Sector Coordinating 

Council
Page 31 GAO-17-58 Radioactive Sources

suppliers, and nuclear waste management and transportation firms.66 The 

NGCC and NSCC both meet four times annually. NRC officials told us 

that NRC has benefitted from participation in the NGCC and the NSCC, 

which has helped to identify and resolve areas of regulatory overlap and 

duplication of effort and provided a forum for industry input. According to 

one DHS official we interviewed, the NGCC meetings touched on a range 

of issues and were often used by NRC to gain early input from the 

members on proposed regulations—including its Part 37 security 

requirements.

In 2009, the NGCC and NSCC jointly established the Transportation of 

Radioactive Materials Focus Group to, among other things, clarify the 

potential national security concerns from transporting risk-significant 

radioactive sources and analyze the overlaps, gaps, and inconsistencies 

identified during a public and private sector sealed source security 

workshop.67 Issued in November 2010, this focus group’s report found 

that, among other things, overlaps and gaps in federal transportation 

security regulations exist in some areas.68 For example, the report found 

that NRC, DOT, and TSA all require that personnel responsible for 

implementing transportation security receive in-depth training on 

developing and implementing transportation security plans, but only NRC 

requires that personnel with access to these plans be screened by 

measures such as a background and fingerprint check. The report stated 

that regulations should be consistent and mutually reinforcing without 

placing undue burden on the private sector. Additionally, the report stated 

that efficiencies should be sought where doing so would not negatively 

impact overall regulatory objectives. The report further stated that the 

Radiation Source Protection and Security Task Force is a viable forum to 

continue efforts to synchronize transportation security requirements.

 66The Nuclear Energy Institute represents the commercial nuclear industry and promotes 

the beneficial uses of nuclear energy.

67In addition to the Transportation of Radioactive Materials Focus Group, the NGCC and 

NSCC established focus groups to study the tracking of radioactive materials and the 

removal and disposition of disused sources.

68Transportation of Radioactive Materials, Transportation of Radioactive Materials Focus 

Group, Radioisotopes Subcouncil of the Nuclear Government and Sector Coordinating 

Councils (Washington, D.C.: Nov. 22, 2010).
Page 32 GAO-17-58 Radioactive Sources

NRC and DOT face challenges to strengthening the security of the 

ground transport of risk-significant radioactive sources, but opportunities 

exist to address these challenges. Specifically, one challenge is that NRC 

does not directly inspect whether motor carriers have implemented the 

agency’s Part 37 security requirements. In addition, NRC does not collect 

information about the number of shipments of risk-significant radioactive 

sources and the modes of transportation for all such shipments. 

Furthermore, differences between NRC and DOT security and safety 

thresholds allow many shipments of category 1 sources to be transported 

without the benefit of the additional protections that result from an HRCQ 

designation.

NRC does not directly inspect whether motor carriers contracted by 

licensees to transport risk-significant sources have implemented Part 37 

requirements. NRC Part 37 regulations require that licensees shipping 

risk-significant radioactive sources ensure that they use carriers that have 

implemented specific security measures for risk-significant sources. As 

previously discussed, these security measures include establishing 24-

hour movement control centers for category 1 shipments and maintaining 

constant control and surveillance during transit for category 2 shipments. 

However, because NRC’s regulatory authority extends only to its 

licensees, NRC does not have the authority to inspect whether motor 

carriers that are not licensees meet Part 37 security requirements. In 

addition, according to DOT officials, DOT and state inspectors with 

regulatory authority for carriers do not currently inspect for compliance 

with NRC’s Part 37 requirements because NRC requirements are not a 

part of DOT inspections. As a result, no federal or state agency directly 

inspects motor carriers to ensure that they meet these requirements.

To determine whether motor carriers are complying with its Part 37 

requirements, NRC requires licensees to ensure that the motor carriers 

they use to transport risk-significant radioactive sources meet Part 37 

requirements, and its inspectors are to verify that licensees are in 

compliance. NRC officials stated that NRC regional offices have asked 

carriers, as part of their security inspections of licensees, to provide 

information about the security of their shipments. Because NRC has no 

authority to inspect motor carriers, motor carriers that are not licensees 

are under no obligation to respond to these requests, and NRC officials 

told us these requests are rare and seldom generate a useable response. 

Agencies Face 

Challenges to 

Strengthening the 

Security of 

Radioactive Sources 

during Ground 

Transport, but 

Opportunities Exist to 

Address Them

NRC Does Not Directly 

Inspect Whether Carriers 

Have Implemented NRC 

Security Requirements
Page 33 GAO-17-58 Radioactive Sources

NRC inspectors we interviewed stated that they review licensee 

documentation and conduct interviews with selected licensees to 

determine whether carriers used by licensees meet Part 37 requirements. 

These inspectors provided some examples of how they try to make these 

determinations. According to two NRC inspectors we interviewed, some 

licensees have incorporated Part 37 requirements into their contracts with 

motor carriers, and these inspectors reviewed these contracts for 

evidence of whether these carriers meet Part 37 requirements. Another 

NRC inspector told us that one carrier was sufficiently well known that 

inspectors did not always assess whether the licensee had documented 

that the carrier had measures in place to meet Part 37 requirements. This 

inspector explained that the carrier had provided sufficient evidence in the 

form of a letter to NRC asserting that its processes and procedures 

complied with Part 37. NRC headquarters officials told us that they also 

viewed the letter as sufficient evidence of compliance. These 

headquarters officials provided us with a copy of a letter from a carrier 

that they viewed as evidence of how the carrier met NRC’s Part 37 

requirements. However, our review of the letter found that it was a 

generic letter from the carrier addressed to its customers that stated it 

had developed policies and programs to comply with all applicable federal 

and state laws, but it did not provide details about the specific measures 

the motor carrier had in place to meet NRC Part 37 security requirements. 

In addition, our review of a non generalizable sample of inspection 

records for 21 inspections from 2014 through 2015 found that NRC 

inspectors did not consistently document whether they had reviewed 

evidence that licensees had taken measures to ensure carriers met Part 

37 security requirements. One NRC official stated that inspection records 

in his region were intended to serve as representative documentation of 

an inspector’s efforts and may not always reflect all of the requirements 

that were inspected.

Some licensees, motor carrier representatives, and an industry 

stakeholder we interviewed told us that licensees may face challenges in 

gathering documentation to determine whether motor carriers meet Part 

37 security requirements. For example, according to an industry 

stakeholder with expertise in how motor carriers comply with radioactive 

source regulations and representatives from two motor carrier companies, 

some licensees may be permitted to visit a motor carrier’s facility to 

assess whether the motor carrier meets Part 37 security requirements. 

One motor carrier company representative and an industry stakeholder 

we interviewed told us that the willingness of a motor carrier to allow a 

licensee inspection largely depends on the relative value of the licensee’s 

business to the carrier. For example, a valued customer may be allowed 
Page 34 GAO-17-58 Radioactive Sources

to tour a motor carrier’s facility and discuss how the motor carrier meets 

Part 37 requirements, but a less valued customer may not be given the 

same opportunity. Representatives from three motor carrier companies 

told us that they allowed their major customers to conduct on-site 

inspections, and representatives from one of the motor carrier companies 

said that, upon request, they had completed a checklist provided by the 

licensee to certify that the carrier met Part 37 requirements. 

Representatives from a licensee stated that they conducted biennial 

inspections of their motor carriers to ensure that they were in compliance 

with all applicable regulations, including Part 37 requirements. 

Representatives of a motor carrier stated that, during NRC’s most recent 

inspection, the licensee invited the motor carrier to participate via 

telephone to discuss how it meets Part 37 security requirements.

DOT is the federal entity tasked with statutory oversight of motor carriers. 

FMCSA and state officials inspect motor carriers during on-site 

investigations and roadside inspections; however, FMCSA does not have 

the authority to enforce motor carriers’ compliance with NRC’s Part 37 

security requirements. NRC’s Part 37 security requirements are not a part 

of FMCSA’s regulations or procedures, according to FMCSA officials. 

Because no federal or state entity directly inspects motor carriers to verify 

whether motor carriers are meeting Part 37 requirements, NRC cannot be 

assured that carriers are meeting Part 37 requirements. NRC and DOT 

may have an opportunity to work together to identify an approach to verify 

that carriers are meeting NRC requirements and further strengthen the 

security of shipments of risk-significant sources. Such an approach could 

allow NRC to save resources by leveraging DOT’s existing processes and 

would be consistent with the 1979 MOU between NRC and DOT and the 

2015 MOU between DOT, NRC, and DHS. The 1979 MOU states that 

NRC and DOT will conduct an inspection and enforcement program 

within each agency’s jurisdiction to assure compliance with that agency’s 

requirements, consult with each other on the results of inspections, and 

take enforcement actions as appropriate within the limits of each agency’s 

authority. The 2015 MOU built on the foundation of the 1979 MOU, and

states that NRC, DOT, and DHS will promote coordination on 

enforcement and inspection activities with the objective of optimizing 

available resources and maximizing communications on areas of mutual 

interest. By identifying the extent of each agency’s jurisdiction, areas of 

overlap as well as any gaps, the agencies may be able to develop an 

approach to verify that carriers are meeting NRC’s Part 37 security 

requirements. DOT officials we interviewed stated that they would be 

willing to explore the feasibility of working with NRC to consider ways to 

incorporate Part 37 security requirements into their inspections or 
Page 35 GAO-17-58 Radioactive Sources

investigations. According to DOT officials, however, DOT would likely 

need to revise PHMSA regulations setting forth safety and security 

requirements. NRC officials we interviewed stated that on occasion the 

Department of Energy inspects NRC licensees on NRC’s behalf, and 

provides the agency with information that it uses to determine whether the 

licensee is in compliance with NRC regulations. These officials said that 

they would be willing to explore the option of having DOT verify whether 

carriers are meeting NRC’s Part 37 security requirements.

NRC does not collect information on the number of all shipments of risksignificant sources (i.e., category 1 and 2 radioactive sources) and the 

mode by which they are transported. As previously discussed, NRC 

requires licensees to record transfers between licensees of category 1 

and 2 sources in NRC’s NSTS database. However, this database 

includes no information on the number of shipments or the mode of 

transport involved in completing these transfers, according to NRC 

officials. Also, as previously discussed, NRC requires licensees to provide 

advance notification for shipments of category 1 sources, including 

information that would indicate the mode of transport, which NRC 

documents in its RAMQC database. As a result, NRC collects information 

on transfers of category 1 and 2 sources in NSTS and on the number of 

shipments and mode of transport for category 1 sources in the RAMQC 

database, but it does not collect information on shipments of category 2 

sources or the mode by which these sources are transported. Our 

analysis of NSTS data from 2013 through 2014 identified 54,855 transfers 

of risk-significant radioactive sources between NRC licensees, nearly all 

of which were cobalt-60 or iridium-192.69 Of these transfers, 5,768 

involved category 1 sources, and 49,087 involved category 2 sources. 

However, the number of transfers does not equate to the number of 

shipments, since a shipment may include one or more sources. Our 

analysis of RAMQC data from 2013 through 2014 identified 351 

shipments of category 1 material for all domestic licensees and an NRC 

licensee based in Canada.70 As a result, while NRC has information about 

 69Cobalt and iridium are radioactive sources commonly used in a variety of industries. 

Cobalt-60 is commonly used for irradiating food, sterilizing medical products, and 

measuring thickness and density in industrial processes. Iridium-192 is used in industrial 

radiography.

70According to NRC officials, this Canadian licensee is the sole NRC licensee outside the 

United States and it ships and receives a significant number of category 1 radioactive 

sources to and from the United States.

NRC Does Not Collect 

Information about the 

Number and Mode of 

Transport for All 

Shipments of RiskSignificant Sources
Page 36 GAO-17-58 Radioactive Sources

the number of transfers of sources between licensees that occur each 

year through NSTS and information about the number of category 1 

shipments that occur each year through the RAMQC database, it does 

not have information on the number of category 2 shipments that occur 

each year or the mode by which these sources are transported.

Not having information on all shipments of risk-significant sources or the 

mode by which they were transported could, in certain situations, 

complicate NRC’s efforts to secure risk-significant sources and efforts to 

have an awareness of shipments of large quantities of radioactive 

material being transported in the United States. For example, it is 

possible that a motor carrier could make multiple stops and aggregate 

multiple category 2 shipments on a single truck in quantities that exceed 

the category 1 threshold. In this scenario, according to NRC 

documentation, licensees cannot be expected to know that the separate 

shipments have been aggregated to category 1 amounts by the motor 

carrier and would therefore not be responsible for ensuring that category

1 security requirements were implemented by the motor carrier. However, 

according to NRC documentation, because NRC does not regulate motor 

carriers, the motor carrier is also not responsible for ensuring that 

category 2 sources that are aggregated into category 1 quantities are 

protected in accordance with category 1 security requirements. NRC 

officials we interviewed stated that they believe this scenario is of a low 

probability and that the security risks to such shipments are low because 

of the transient nature of the aggregation by the motor carrier and the 

anonymity of the packages. NRC officials also explained that DOT 

transport index regulations help to limit the potential for aggregation by 

restricting the total amount of radioactivity in any one package and the 

total amount of radioactivity in any one vehicle. However, because NRC 

does not have information on shipments of category 2 sources, NRC 

officials acknowledged that they do not have the data to support their 

view that the likelihood of a single motor carrier collecting and 

aggregating multiple category 2 sources in quantities that exceed 

category 1 thresholds is of low probability.

We learned through our discussions with NRC officials that the NSTS 

database would be the best of NRC’s databases for tracking shipment 

and mode of transportation information. However, NRC headquarters 

officials we interviewed stated that they did not see any regulatory or 

oversight benefit to collecting information on the total number of 

shipments or the modes by which these shipments are transported within 

the United States. These officials also stated that any change to the 

reporting requirements for information included in the NSTS database 
Page 37 GAO-17-58 Radioactive Sources

would require going through the federal rule-making process, which is 

time-consuming, and that NRC has been hesitant to add additional 

information requirements without a strong justification. NRC officials also 

stated that the agency has other priorities for improving its databases, 

such as adding additional capabilities to NRC’s Web Based Licensing 

System to support NRC’s import and export licensing process.71

We understand NRC’s concerns about the difficulty of adding information 

reporting requirements. However, without collecting and maintaining 

information on the total number of shipments of category 1 and category 

2 sources and the mode by which they are transported, it is unclear how 

the agency can determine whether it is meeting its goal of providing 

reasonable assurance that it is preventing the theft or diversion of these

dangerous materials. In addition, according to NRC officials, the NSTS 

database currently includes data fields related to transport that would 

allow licensees to document the shipment, which the agency could use to 

collect the number of shipments, but the use of these fields is optional. In 

addition, NSTS could be modified to include the shipment and routing 

information currently entered into the RAMQC database, and these 

modifications could provide NRC with more post shipment information 

that could allow NRC to address potential vulnerabilities and allocate 

resources if necessary. These officials also said, however, that these 

modifications to NSTS would be expensive and could raise security 

concerns because they could broaden the number of users that would 

need security credentials to access NSTS. By collecting information on 

the number of shipments and mode of transport for risk-significant 

sources, NRC could improve its awareness of the volume of shipments of 

this material and how it is transported, such as whether the majority of 

shipments are transported via ground, air transport, or some combination 

thereof. This information could allow NRC to better understand where 

potential vulnerabilities may exist while this material is being transported 

and whether and where additional resources may be needed to protect 

this material. This information could also give NRC greater confidence 

that it is achieving its goal of having reasonable assurance of preventing 

theft or diversion of these sources.

 71Additional planned improvements to the Web-Based Licensing System include adding 

the Transportation Approval Package Information System, Reciprocity Tracking System, 

National Sealed Source and Device Registry System, and General License Tracking 

System.
Page 38 GAO-17-58 Radioactive Sources

NRC’s threshold for determining which sources are category 1 risksignificant radioactive sources that require additional security protections 

is generally lower than DOT’s HRCQ thresholds for determining which 

shipments of radioactive material require additional safety protections. As 

a result, many shipments of category 1 sources are transported without 

the benefit of the additional protections provided by an HRCQ 

designation. For example, NRC’s category 1 threshold for cobalt-60 is 30 

TBq, and DOT’s HRCQ threshold for cobalt-60 is 1,000 TBq. As a result, 

a single package of cobalt-60 that exceeds NRC’s category 1 threshold—

such as a shipment with 900 TBq, or 30 times the amount deemed of 

concern from NRC’s perspective—would not be designated as an HRCQ 

shipment and thus would not require additional HRCQ protections. As 

previously discussed, our analysis of RAMQC’s database identified 351 

shipments of domestic category 1 sources from 2013 through 2014. Of 

these, 130 were classified as HRCQ, and 221 fell below the HRCQ 

threshold. That is, more than half of category 1 sources transported from 

2013 through 2014 did not meet or exceed the HRCQ threshold and thus 

were not required to be transported with the additional safety protections 

provided by the HRCQ designation.

As previously discussed, an HRCQ shipment requires additional safety 

protections, including requiring carriers to undergo a level VI safety 

inspection; select the most expedient preferred route; prepare a written 

route plan; and require drivers to carry proof of having received training 

on, among other things, handling and transporting hazardous material. 

For example, as previously discussed, the level VI safety inspection of an 

HRCQ shipment includes a review of the driver and the vehicle according 

to more stringent criteria, and if a critical violation of the operating criteria 

for the driver, vehicle, or cargo is identified, the inspector is to place the 

vehicle out of service until the violation is addressed. Any violations found 

regarding the driver or the vehicle could prevent a situation where a 

shipment is in transit with a driver and/or vehicle that may have a defect 

that could prevent the vehicle from meeting its planned schedule and 

create an opportunity for theft or diversion.

In addition to the differences between NRC and DOT thresholds, these 

agencies also differ in how they calculate the aggregation of radioactive 

material that can trigger NRC security thresholds and DOT safety 

thresholds. NRC security thresholds calculate the aggregation of material 

by the total radioactivity of radioactive material stored collectively in one 

location behind a single physical barrier or transported on a vehicle. In 

contrast, DOT package safety thresholds calculate the aggregation of 

material by the total radioactivity of the radioactive material accumulated 

Differences between NRC 

and DOT Thresholds Allow 

Many Shipments of 

Category 1 Sources to Be 

Transported without the 

Benefit of the Additional 

Protections That Result 

from an HRCQ 

Designation
Page 39 GAO-17-58 Radioactive Sources

in a single package, according to DOT officials. For example, a shipment 

of one package holding 1,500 TBq of cobalt-60 sources is considered 

both a category 1 source by NRC and an HRCQ amount of material by 

DOT and would be subject to the additional HRCQ protections. However, 

a vehicle carrying two packages—each holding 750 TBq of cobalt-60—

would be considered a category 1 amount by NRC but not an HRCQ 

amount of material by DOT. Therefore, the additional HRCQ protections 

would not apply in such a situation.

While motor carriers transporting category 1 amounts of material below 

DOT’s HRCQ threshold are not required to comply with the additional 

HRCQ protections, we found instances where some states took actions to 

provide additional protections for such shipments. According to a guide 

provided by the Council of State Governments, in some cases, states use 

additional security and safety measures for some shipments of category 1 

quantities of radioactive sources.72 For example, some states may require 

that HRCQ shipments, and category 1 shipments below the HRCQ 

threshold, be accompanied by a security escort— ranging from a single 

unmarked car to a tactical team in an armored car with helicopter 

surveillance. In addition, a state may choose to conduct an en route 

inspection for any shipments transported on its roads, according to the 

guide. Whether states provide escorts or perform en route inspections of 

shipments below the HRCQ thresholds varies and—according to CVSA 

officials we interviewed—is up to the discretion of the individual states. 

States may choose to cover the costs of these escorts or pass the costs 

along to the carrier or licensee, according to state officials we interviewed.

Some NRC, DOT, and CVSA officials we interviewed stated that it was 

possible that additional HRCQ protections, such as level VI safety 

inspections, might make the driver and vehicle safer, but would not 

necessarily provide a security benefit. NRC and DOT officials said, 

however, that they had not studied the issue and did not provide 

additional details on the potential costs and security benefits from 

additional HRCQ protections. DOT and CVSA officials also stated that 

any increase in vehicle inspections would likely require DOT to provide 

significantly more funding to the states, since the states, according to 

DOT data, conduct all level VI safety inspections. One state official we 

interviewed said that one border state does not have any inspectors 

 72Planning Guide for Shipments of Radioactive Material through the Midwestern States, 

Council of State Governments Midwestern Office and the Midwestern Radioactive 

Materials Transportation Committee, (Lombard, IL: 2015).
Page 40 GAO-17-58 Radioactive Sources

certified to perform a level VI safety inspection, and must borrow an 

inspector from a neighboring state when needed. As previously 

discussed, our analysis of NRC’s RAMQC database identified 130 

category 1 shipments that were HRCQ shipments, and 221 category 1 

shipments that were non-HRCQ shipments from 2013 through 2014. 

Given NRC’s emphasis on securing risk-significant sources, an 

examination by NRC and DOT of the potential costs and security benefits 

associated with lowering the HRCQ threshold so that more or all category 

1 shipments are designated as HRCQ shipments and thus receive 

additional HRCQ protections, could provide an opportunity to determine 

whether the benefits of increasing the security of such shipments would 

outweigh the costs. These additional protections—if applied to category 1 

shipments that fall below the HRCQ threshold—could enhance the 

security of these shipments because the additional protections could help 

ensure that a shipment reaches its destination without delay, thereby 

lessening the potential for theft or diversion. NRC and DOT working 

together to examine the costs and benefits of this approach would be 

consistent with the stated goal in the 2015 MOU between NRC, DOT, and 

DHS of leveraging mutual interests.

Detonation of a dirty bomb by terrorists in the United States would have 

significant impacts on the nation’s economy and could impact the health 

and sense of security of citizens. Protecting the risk-significant radioactive 

sources that could arm terrorists with the material to accomplish such 

disruption is a stated priority of NRC. Following the terrorist attacks on

September 11, 2001, areas of potential vulnerability were identified 

surrounding the security of such sources. Over the last 15 years, NRC, 

DOT, and DHS have worked together to address such vulnerabilities and 

tighten the security of risk-significant radioactive sources, including during 

ground transport. Such efforts focused on enhancing security during 

ground transport are important because, according to IAEA documents, it 

is while in transit that these sources are most vulnerable to theft or 

sabotage by terrorists. Seizing opportunities to further enhance such 

security, however, may be warranted given the significant effects that 

even one dirty bomb incident in the United States could have on its 

citizens. For example, by collecting information from licensees on the 

number of shipments and mode of transport, by working together to 

identify an approach to verify that carriers are meeting NRC’s Part 37 

security requirements, and by considering an examination of the potential 

costs and security benefits associated with lowering the HRCQ threshold, 

NRC, DOT, and DHS may be in a better position to enhance the security 

of such sources, if it is determined to be warranted. This information could 

Conclusions
Page 41 GAO-17-58 Radioactive Sources

provide the opportunity for these agencies to have greater assurance that 

risk-significant radioactive sources that travel around the United States on 

a daily basis are secure.

We are making the following three recommendations:

• To improve the awareness of how risk-significant radioactive sources 

are transported within the United States and to better determine 

whether Nuclear Regulatory Commission (NRC) is meeting its goal of 

providing reasonable assurance for preventing the theft or diversion of 

these dangerous materials, we recommend that the Chairman of NRC

take actions to collect information from licensees on the number of 

shipments and mode of transport for such sources—for example, by 

identifying the extent to which an existing NRC database (e.g., NSTS) 

may be used to capture this information.

• To further enhance the security of radioactive sources during ground 

transport, we recommend that the Chairman of NRC, in consultation 

with the Secretary of Transportation and the Secretary of Homeland 

Security, identify an approach to verify that motor carriers are meeting 

NRC’s Part 37 security requirements applicable to transportation, for 

example by having DOT inspectors verify compliance with NRC Part 

37 security requirements during their on-site investigations.

• To further enhance the security of radioactive sources during ground 

transport, we recommend that the Secretary of Transportation, in 

consultation with the Chairman of NRC and the Secretary of 

Homeland Security, consider examining the potential costs and 

security benefits associated with lowering the HRCQ threshold so that 

more, or all, category 1 shipments are classified as HRCQ shipments.

We provided a draft of this report to NRC, DOT, DHS, the Department of 

Energy, and the Department of Justice for review and comment. NRC 

provided written comments and an enclosure that included significant 

issues and technical comments. We incorporated the significant issues 

and technical comments as appropriate. DOT provided written comments 

and also provided technical comments, which we incorporated as 

appropriate. DHS and the Department of Energy provided technical 

comments, which we incorporated, as appropriate. The Department of 

Justice did not provide comments. NRC agreed with one 

recommendation, disagreed with another, and neither agreed nor 

disagreed with the third but stated that it would be willing to explore it with 

Recommendations for 

Executive Action

Agency Comments 

and Our Evaluation
Page 42 GAO-17-58 Radioactive Sources

DOT staff. DOT concurred with one recommendation concerning it and 

did not fully concur with the other, as discussed below. 

In its written comments and the enclosure’s significant issues, reproduced 

in appendix III, NRC stated that it disagreed with the draft report’s 

recommendation that collecting additional information in NSTS on the 

number of shipments and mode of transport would improve the 

awareness of how risk-significant radioactive sources are transported 

within the United States and better determine whether NRC is meeting its 

goal of providing reasonable assurance for preventing theft or diversion of 

these dangerous materials. 

NRC stated that it had taken steps following the terrorist attacks of 

September 11, 2001, to strengthen the security of risk-significant 

radioactive materials, including addressing the potential vulnerabilities 

associated with the use and transport of these materials. NRC explained 

that it had implemented a number of measures in coordination with 

federal and state agencies to ensure adequate protection of radioactive 

sources and that NSTS is only one of those measures. NRC also 

explained that the NSTS, along with the rest of the NRC and DOT 

regulatory framework, provide reasonable assurance of the safety and 

security of radioactive material in transit. Therefore, NRC stated that it 

does not believe that adopting this recommendation would result in safety 

or security improvements. In its enclosure noting significant issues, NRC 

provided a framework for transactions and shipments involving Category 

1 and 2 sources as background for the NRC staff’s disagreement. NRC’s 

framework and our evaluation is as follows.

• In significant issues 2 and 5, that under NRC regulations, licensees 

are required to report some source shipment information in NSTS for 

Category 1 and 2 source transfers (e.g., shipping date and estimated 

date of arrival), and must report transactions no later than the close of 

business the day after a source transaction occurs. This was noted in 

the draft report.

• In significant issues 3 and 4, that due to the sensitivity of the 

information, the NSTS is neither the appropriate system to track the 

mode and shipment information for transfers of risk-significant 

sources nor designed to track such information. Using it for this 

purpose would require a new security categorization evaluation, which 

would likely result in a higher security categorization for the system. 

This would result in challenges in a number of areas, such as 

measures needed to provide licensees with access to the system. 

NRC also explained that imposing a requirement for licensees to 
Page 43 GAO-17-58 Radioactive Sources

provide information in the NSTS on the mode of transport and 

shipment information would require a rulemaking. Such a rule is not 

likely to result in significant improvements in safety or security that 

would form a basis to justify a rulemaking and the additional reporting 

and recordkeeping burden. The draft report noted that NRC officials 

had expressed concern that changes to the NSTS might result in 

security issues. The draft report also noted that NRC officials stated 

that any change to the reporting requirements for information included 

in the NSTS would require a federal rule-making, and that NRC has 

been hesitant to add additional information requirements. 

• In significant issue 6, that under NRC regulations licensees must 

provide advance notification of shipments of category 1 quantities of 

material to NRC and to the governor of any state through which the 

transport travels. The advance notification report must include, among 

other things, information related to material being transported, shipper 

and receiver, and a point of contact for obtaining current information 

on the shipment. This was noted in the draft report, and we have 

amended the report to include information about notifications to state 

governors.

• In significant issues 10 and 11, that under the regulations, licensees 

shipping category 1 sources must use movement control centers to 

maintain position information from a remote location, establish 

redundant communications that allow the transport to contact the 

escort vehicle, and other measures to protect the shipment. This was 

noted in the draft report. 

• In significant issues 10 and 12, that under the regulations, licensees 

shipping category 2 sources must maintain constant control and/or 

surveillance during transit and have the capability for immediate 

communication to summon appropriate response or assistance or to 

use carriers with established package tracking systems. This was 

noted in the draft report.

• In significant issues 7 and 8, that NRC’s RAMQC database is 

maintained by NRC to track advance notifications of category 1 

shipments and that NRC provides reports from this database to other 

federal agencies as appropriate to assist in verifying transport of 

hazardous materials. This was noted in the draft report.

• In significant issues 9, that NRC has Memorandums of Understanding 

with DHS and DOT to ensure appropriate regulatory oversight of 

radioactive material shipments. This was noted in the draft report.

In NRC’s written comments, NRC stated that the NSTS provides an 

accounting function for information on risk-significant sources following 
Page 44 GAO-17-58 Radioactive Sources

their manufacture, transfer, receipt, disassembly, or disposal. We noted in 

the draft report that the NSTS was used to track transaction information, 

and have amended the report to clarify that the NSTS provides an 

accounting function for category 1 and 2 radioactive sources following 

their manufacture, transfer, receipt, disassembly, or disposal.

In its written comments and in the enclosure’s significant issues 13 and 1, 

NRC also disagreed with the statement in the draft report that stated, “Not 

having information on all shipments of risk-significant sources or the 

mode by which they were transported could, in certain situations, 

complicate NRC’s efforts to secure risk-significant sources and thereby 

inhibit the agency’s ability to meet its objective of providing reasonable 

assurance of preventing their theft or diversion.” NRC stated that it 

believes that the specific situation that we cited in support of this 

statement is not an issue that is solved by collecting post-shipment 

information but best addressed by appropriate coordination between NRC 

and DOT, as indicated by our second recommendation, with which it 

agrees. NRC suggested that we consider deleting or editing this 

statement. NRC further stated that accounting for the number of 

shipments and mode of transport for category 1 and 2 source transfers in 

NSTS would not provide any information that could be used to prevent 

the theft of diversion of category 1 and 2 materials.

We acknowledge in the report the measures that NRC has taken 

independently and in conjunction with federal agencies to improve the 

security of risk-significant sources, including while in transit. Our finding 

about the lack of information on the number of shipments and the mode 

by which these shipments are transported is premised on NRC’s stated 

interest of improving its awareness of risk-significant sources that are 

transported within the United States. As our report notes, NRC has 

information on the number of transfers of risk-significant sources between 

licensees and has some information on shipments of category 1 sources, 

but it does not have information on the number of shipments or the mode 

of these shipments for category 2 shipments, which likely comprise the 

bulk of shipments of risk-significant sources based on available data on 

transfers. It is unclear to us how collecting information on the number and 

mode of shipments would not be in NRC’s own stated interest of 

improving awareness of shipments. As it relates to our recommendation, 

we suggested using the NSTS as a mechanism for collecting this 

information based on input from NRC officials that the NSTS would be the 

NRC database most easily modified to gather this information as it 

already includes a data field for capturing shipment information. 

Furthermore, our recommendation did not suggest that the NSTS be 
Page 45 GAO-17-58 Radioactive Sources

modified in a manner that would allow it to be used to track real-time 

shipments and address ongoing issues, but rather as a source of postshipment information that could be used to determine how many 

shipments occur in the United States and how these shipments were 

transported, such as by truck, air, or some combination. Having this 

information, we believe, would provide NRC with an enhanced awareness 

of these shipments and allow for more informed decisions about where 

vulnerabilities may exist and where resources may need to be allocated 

to address any vulnerabilities. Given NRC’s concern, we have revised our 

recommendation to clarify that modifying the NSTS could be one 

mechanism that NRC could use to collect the information, which allows 

NRC the flexibility to determine the most effective and efficient approach 

for gathering such information. We also revised the statement in the draft 

report that NRC disagreed with to clarify that we are not advocating for 

real-time tracking information on these shipments, but rather collecting 

post-shipment information that could allow NRC to address potential 

vulnerabilities and allocate resources if necessary.

In its written comments, reproduced in appendix IV, DOT stated that it did 

not fully concur with the recommendation that DOT identify an approach 

to verify that motor carriers are meeting NRC’s Part 37 security 

requirements. DOT stated that, while it agreed conceptually with the 

intent of the recommendation, it has no authority to address NRC’s Part 

37 requirements. We acknowledged in our report that Part 37 

requirements are the responsibility of NRC. Our report also discussed 

that while DOT is not responsible for assessing motor carrier compliance 

with Part 37, it is the federal entity with statutory oversight of motor 

carriers. As a result, any attempt by NRC to implement an approach for 

verifying motor carrier compliance with its regulations would require the 

cooperation of DOT and its inspectors. We have revised our 

recommendation and made modifications to the report to clarify that NRC, 

in consultation with DOT and DHS, identify an approach to directly verify 

that motor carriers are meeting NRC’s Part 37 requirements. We believe 

this change makes it clear that the responsibility for ensuring compliance 

Part 37 is NRC’s, but that addressing our recommendation would require 

action on the part of NRC as well as DOT, given the regulatory role of 

each agency.

As agreed with your offices, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to the appropriate 

congressional committees, the Chairman of NRC, the Secretary of 

Transportation, the Secretary of Homeland Security, the Secretary of 
Page 46 GAO-17-58 Radioactive Sources

Energy, the Attorney General, and other interested parties. In addition, 

the report will be available at no charge on the GAO website at 

http://www.gao.gov.

If you or your staff members have any questions about this report, please 

contact me at (202) 512-3841 or oakleys@gao.gov. Contact points for our 

Offices of Congressional Relations and Public Affairs may be found on 

the last page of this report. Key contributors to this report are listed in 

appendix IX.

Shelby S. Oakley

Acting Director, Natural Resources and Environment
Appendix I: Objectives, Scope, and 

Methodology

Page 47 GAO-17-58 Radioactive Sources

This report addresses transportation security for risk-significant 

radioactive sources. Specifically, our objectives were to examine, (1) the 

steps that the Nuclear Regulatory Commission (NRC), Department of 

Transportation (DOT), and Department of Homeland Security (DHS) have 

taken since September 11, 2001, to strengthen the security of risksignificant radioactive sources during ground transport; and (2) the 

challenges, if any, that exist to further strengthening the security of these 

sources during ground transport and the potential opportunities to 

address them. For the purposes of this report, the term “risk-significant 

radioactive sources” refers to radioactive sources in specific quantities 

that meet category 1 and 2 thresholds, as defined by the International 

Atomic Energy Agency’s (IAEA) Code of Conduct on the Safety and 

Security of Radioactive Sources. This report considered risk-significant 

radioactive sources that were shipped between NRC licensees within the 

United States and Canada. Except in the case of an NRC licensee based 

in Canada, imports, exports, and transshipments of risk-significant 

radioactive sources were not included in the scope of this report.

To identify what steps NRC, DOT, and DHS have taken since September 

11, 2001, to strengthen the security of risk-significant radioactive sources 

during ground transport, we reviewed relevant laws, regulations, and 

agency guidance, and interviewed agency officials at NRC, DOT, DHS, 

the Department of Energy, the National Nuclear Security Administration, 

and the Federal Bureau of Investigation. To identify steps that NRC has 

taken, we reviewed the agency’s orders and regulations, including 10 

C.F.R. Part 37, for the physical protection of category 1 and 2 material, as 

well as packaging and transfer reporting regulations. We also reviewed 

IAEA documents, including the Code of Conduct on the Safety and 

Security of Radioactive Sources, the Categorization of Radioactive 

Sources, and Regulations for the Safe Transport of Radioactive Material, 

as well as information from the Incident and Trafficking Database. We 

interviewed NRC officials from the Office of Nuclear Material Safety and 

Safeguards, Office of Nuclear Security and Incident Response, and three 

NRC regional offices with oversight over NRC risk-significant radioactive 

source licensees to understand how NRC imposes and enforces Part 37 

requirements. We also interviewed officials from the Organization of 

Agreement States to identify how agreement states are incorporating the 

NRC Part 37 requirements in state regulations. We also reviewed NRC’s 

efforts in the 13 states in which Part 37 regulations were in effect during 

the time of our review.

To identify what steps DOT has taken, we reviewed Pipeline and 

Hazardous Materials Security Administration (PHMSA) and Federal Motor 

Appendix I: Objectives, Scope, and 

Methodology
Appendix I: Objectives, Scope, and 

Methodology

Page 48 GAO-17-58 Radioactive Sources

Carrier Safety Administration (FMCSA) regulations and guidance, 

including those related to motor carrier transportation security plans and 

the Hazardous Materials Safety Permit program. We also interviewed 

officials from PHMSA’s Office of Hazardous Materials Safety, FMCSA’s 

Hazardous Materials Division, and FMCSA’s Office of Enforcement and 

Compliance to determine how their regulatory programs have been 

implemented. We also used data from FMCSA’s Motor Carrier 

Management Information System to determine how many on-site 

inspections of motor carriers federal and state officials conducted in 2015, 

the most recent full year of data at the time of our review. We assessed 

the reliability of the Motor Carrier Management Information System data 

by reviewing relevant documentation and Inspector General reports, and 

interviewing knowledgeable officials. We found the data to be sufficiently 

reliable to report on the number of annual motor carrier inspections and 

the number of violations cited. We also interviewed officials from the 

Commercial Vehicle Safety Alliance (CVSA) to determine how the motor 

carrier inspection program is implemented, and how level VI inspections 

are conducted.

To identify actions taken by DHS, we reviewed regulations and guidance 

issued by TSA, such as the Hazardous Materials Assessment Program, 

and interviewed officials from the Office of Security Policy and Industry 

Engagement. We also reviewed DHS regulations and documentation 

related to initiatives such as DHS’s Critical Infrastructure Partnership 

Advisory Council and interviewed officials from the National Programs 

and Protection Directorate, Customs and Border Protection, and the 

Domestic Nuclear Detection Office to determine their role in securing 

radioactive sources.

In addition to these activities, we identified several mechanisms for 

interagency collaboration designed to improve the security of risksignificant radioactive sources—the Radiation Source Protection and 

Security, memorandums of understanding (MOU), and government and 

sector coordinating committees. Specifically, we evaluated federal 

agencies’ progress toward enhancing the security of risk-significant 

sources as detailed in Radiation Source Protection and Security Task 

Force reports from 2006, 2010, and 2014, focusing on the agencies’

progress in implementing recommendations and actions related to 

transportation security. Recommendations that we determined did not 

relate to transportation security were excluded from our analysis. We also 

reviewed the three MOUs among NRC, DOT, and DHS that are related to 

the security of risk-significant radioactive sources—specifically, the 1979 

MOU between NRC and DOT, the 2004 MOU between DOT and DHS, 
Appendix I: Objectives, Scope, and 

Methodology

Page 49 GAO-17-58 Radioactive Sources

and the 2015 MOU among NRC, DOT, and DHS. We also analyzed the 

role that the Nuclear Government Coordinating Council and Nuclear 

Sector Coordinating Council played in facilitating dialogue and 

collaboration among the agencies and nuclear sector representatives by 

reviewing the councils’ reports and documentation, and interviewing NRC, 

DOT, and DHS officials.

To determine whether any challenges exist to further strengthening the 

security of risk-significant sources during ground transport and potential 

opportunities to address any such challenges, we evaluated the extent to 

which NRC and DOT have coordinated inspection and enforcement 

activities for verifying licensee and motor carrier compliance with relevant 

laws and regulations. We reviewed NRC Part 37 requirements for risksignificant radioactive sources for motor carriers, DOT transportation 

security and inspection regulations for motor carriers and CVSA 

inspection procedures, and interviewed NRC, DOT, and CVSA officials. 

Additionally, we reviewed a non generalizable sample of inspection 

records provided by NRC for 21 separate inspections of risk-significant 

source licensees to obtain examples of how NRC inspectors are 

inspecting for compliance with Part 37 requirements. NRC provided 

records for 21 inspections based on our request for examples of 3 to 4 

inspection records for each NRC region. To determine how NRC Part 37 

transportation security requirements have been implemented, we also 

interviewed representatives from four motor carrier companies that 

transport risk-significant radioactive sources which we identified through 

interviews and research and which responded to our request for an 

interview. We interviewed two source manufacturing licensees that were 

identified as the largest manufacturers by NRC officials for their 

perspectives on how relevant regulations are implemented. We visited 

one of these manufacturers to observe how radioactive sources are 

manufactured and packaged and observed a level VI safety inspection for 

a highway route controlled quantity (HRCQ) of material. During this visit, 

we also met with federal and state law enforcement officials, as well as 

state officials responsible for securing risk-significant sources, to 

understand how NRC and DOT regulations are implemented at the state 

level.1 We also interviewed an industry stakeholder with expertise in the 

measures taken by motor carriers to comply with federal regulations 

involving radioactive materials to understand how motor carriers in 

general implement radioactive material transportation requirements. 

 1

We selected officials from the state in which the manufacturer was located. 
Appendix I: Objectives, Scope, and 

Methodology

Page 50 GAO-17-58 Radioactive Sources

While the views of these individuals provided relevant insights, they are 

not representative of the universe of licensee, motor carrier, or law 

enforcement representatives with responsibility for the security of 

radioactive sources during transport and therefore do not represent all 

views on this topic.

In addition, we analyzed information from NRC’s National Source 

Tracking System (NSTS) and interviewed responsible agency officials to 

determine what information NRC collected from licensees regarding the 

transfer of risk-significant radioactive sources. Further, we analyzed 

NSTS data to determine the extent to which the federal government had 

information on the number of risk-significant sources transported annually 

and the modes by which they were transported. To assess the reliability 

of data from the NSTS database, we reviewed relevant documentation, 

including NRC Inspector General audits, and interviewed NRC officials 

regarding the database’s development, its primary users, data entry, 

security, and accuracy and completeness of the data. We found the data 

from the NSTS to be sufficiently reliable to report on the number of risksignificant source transfers from 2013 through 2014, the 2 most recent 

years for which complete data were available at the time of our review.

We also obtained and analyzed data from NRC’s radioactive material in 

quantities of concern (RAMQC) database for 2013 through 2014, the 2 

most recent years for which complete data were available at the time of 

our review, to determine the extent to which NRC has information about 

the number of domestic category 1 shipments and shipments involving a 

licensee based in Canada, as well as shipments that are also 

documented as HRCQ shipments. To assess the reliability of data from 

the RAMQC database, we reviewed relevant documentation, interviewed 

NRC officials, and reviewed the data for errors. NRC officials with 

responsibility for the RAMQC database explained that errors in 

radioactivity totals, among other fields, may be introduced during manual 

data entry. According to these officials, while they conduct a weekly audit 

of information in the system, the agency is not required to maintain data 

in RAMQC as a historical record. As a result, we limited our analyses to 

only those records that NRC had clearly documented as category 1 

domestic shipments and category 1 imports and exports from a licensee 

based in Canada. We included the Canadian NRC licensee in our 

analysis because it is the sole NRC licensee outside the United States 

and transfers to and from it to other domestic licensees are regarded as 

domestic transfers in NSTS. Representatives from the licensee stated 

that it had been an NRC licensee for several decades. We determined 

that data from the RAMQC database were sufficiently reliable to report on 
Appendix I: Objectives, Scope, and 

Methodology

Page 51 GAO-17-58 Radioactive Sources

the number of records it contained for domestic category 1 shipments and 

shipments involving a licensee based in Canada from 2013 through 2014. 

We also reviewed federal regulations and interviewed NRC and DOT 

officials; state law enforcement officials responsible for radioactive 

sources; and officials with CVSA to determine the extent to which DOT 

and NRC had assessed whether additional level VI safety inspections 

could enhance the security of shipments of risk-significant radioactive 

sources that would not otherwise undergo such inspections. We further 

reviewed a guide from the Council of State Governments to determine 

what additional security and safety measures states may choose to take 

for shipments of radioactive material.

We conducted this performance audit from April 2015 to February 2017 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.
Appendix II: List of Additional Transportationrelated Radiation Source Protection and 

Security Task Force Recommendations

Page 52 GAO-17-58 Radioactive Sources

Table 2: Transportation-related Radiation Source Protection and Security Task Force Recommendations to the Department of 

Transportation (DOT), Nuclear Regulatory Commission (NRC), and Other Government Entities, 2006-2014

Government 

Entity Recommendationa Description

Actions Taken in Response 

and Year Reported

DOT 2006

Action 3-2

DOT should consider using risk-significant 

thresholdsb in domestic transportation regulations.

Complete (2010). DOT now 

requires motor carriers transporting 

radioactive material that meets 

risk-significant thresholds to have a 

security plan.

DOT 2006

Action 5-2

DOT should consider incorporating additional best 

practices into its security plan requirements high-risk 

radioactive material, and DOT should evaluate 

whether transportation of lower risk radioactive 

material should be subject to or exempt from some of 

these security plan requirements.

Complete (2010). DOT and 

Transportation Security 

Administration (TSA) assessed 

vulnerabilities of transporting 

hazardous materials through highthreat urban areas, resulting in 

voluntary improvements to rail 

systems.

NRC 2006

Action 3-1

NRC should evaluate the need to reissue the orders 

to the manufacturing and distribution licensees to 

make sure no security issues have been introduced 

from the use of different units of radioactivity.

Complete (2010). NRC issued an 

order in 2006 that amended some 

of the security measures imposed 

by a previous order to reflect that 

the primary values used for 

compliance with security 

requirements are in 

terabecquerels. 

NRC 2006

Action 4-1

NRC should consider additional measures to verify 

the validity of NRC licenses authorized to possess 

risk-significant radioactive material.

Complete (2014). NRC’s Part 37 

regulations require licensees 

transferring risk-significant 

radioactive sources verify the 

validity of a license either through 

the NRC’s License Verification 

System or through the licenseissuing authority.

NRC 2006

Action 6-1

NRC should implement fingerprint checks for 

applicants for and licensees with access to risksignificant radioactive sources.

Complete (2014). NRC’s Part 37 

regulations provide the 

fingerprinting requirements for 

licensees with risk-significant 

radioactive sources.

NRC 2006

Action 6-2

NRC should evaluate the feasibility of establishing a 

database for materials licensees that includes 

pending applications and information on individuals 

cleared for unescorted access.

Complete (2014). NRC established 

the Web Based Licensing system 

to manage licensing process and 

application information. NRC 

determined that establishing a 

database to contain information on 

individuals cleared for unescorted 

access was not feasible.

Appendix II: List of Additional Transportationrelated Radiation Source Protection and 

Security Task Force Recommendations
Appendix II: List of Additional Transportationrelated Radiation Source Protection and 

Security Task Force Recommendations

Page 53 GAO-17-58 Radioactive Sources

Government 

Entity Recommendationa Description

Actions Taken in Response 

and Year Reported

NRC 2006

Action 11-3

The Task Force suggests that a comprehensive 

analysis be conducted on the inclusion of category 3 

sources in the National Source Tracking System 

(NSTS).

Complete (2010). In 2008, NRC 

issued a proposed rule to include 

category 3 sources in NSTS. 

Following public comments, NRC 

decided to not publish a final rule.

NRC 2014

Recommendation 2

NRC should evaluate the need for sealed source 

licensees to address the eventual disposition/disposal 

costs of risk-significant radioactive sources through 

source disposition/disposal financial planning or other 

mechanisms. Disposition costs should include the 

cost of packaging, transport, and disposal (when 

available) of these sources.

N/A. 

Multiple 

Agencies and 

States

2006

Recommendation 4-2

Agencies and States improve coordination and 

communication of ongoing activities related to 

radiation protection and security for risk-significant 

sources.

Complete (2014). The Task Force 

found significant improvement was 

made in Federal, State, Tribal, and 

stakeholder communication and 

cooperation. Groups and forums 

continue to meet to address policy 

and programmatic issues.

Multiple 

Agencies

2006

Recommendation 5-1

Agencies develop a memorandum of understanding 

(MOU) to serve as a foundation for a transport 

security program for risk-significant sources.

Ongoing (2014).c

Multiple 

Agencies

2006

Action 5-1

Agencies determine if “high hazard” hazardous 

materials transport security measures should be 

applied to transport of risk-significant radioactive 

sources.

Complete (2014). NRC’s Part 37 

regulations provide security 

requirements for licensees who 

transport risk-significant radioactive 

sources.

Multiple 

Agencies

2006

Action 6-3

The NRC and the Department of Homeland Security 

(DHS) should enter into a MOU to cover access to 

the Systematic Alien Verification for Entitlements 

(SAVE) database for materials licensees.

Complete (2010). DHS and NRC 

signed a MOU in 2003 and 

amended it in 2008 to allow NRC 

materials licensees with a vehicle 

to access the SAVE database.

Multiple 

Agencies

2006

Action 11-1

The Task Force encourages the National Source 

Tracking System (NSTS) Interagency Coordinating 

Committee to develop a procedure/policy with 

guidelines on how to handle both government and 

non-government requests for information in the 

NSTS.

Complete (2010). A procedure for 

handling government and nongovernment requests was 

developed. 
Appendix II: List of Additional Transportationrelated Radiation Source Protection and 

Security Task Force Recommendations

Page 54 GAO-17-58 Radioactive Sources

Government 

Entity Recommendationa Description

Actions Taken in Response 

and Year Reported

Multiple 

Agencies

2010

Recommendation 1

U.S. Government agencies should use radionuclides 

and associated category 2 threshold quantities as the 

framework for considering which sources warrant 

enhanced security and adopt the definitions for 

significant Radiological Exposure Device (RED) and 

Radiological Dispersal Device (RDD) for prioritizing 

and allocating resources to eliminate, control, or 

mitigate risks of malevolent radiological incidents.

Complete (2014). While NRC does 

not use definitions of a significant 

RED or RDD in its regulatory 

policies, NRC policy uses the 

category 1 and 2 radionuclides and 

threshold quantities in security 

orders and in NRC’s Part 37 

regulations, among others. Among 

other agencies’ actions, the 

Department of State reported that 

they will urge other countries to 

establish and maintain controls for 

risk significant radionuclides in 

bilateral and multilateral meetings. 

Multiple 

Agencies

2010

Recommendation 2 

U.S. Government agencies should reevaluate 

protection and mitigation strategies to protect against 

significant RED and RDD attacks considering 

consequences to public health, safety and the 

environment. Agencies should use the Task Forceendorsed definitions, radionuclides, and thresholds 

for a significant RED and RDD and other associated 

information in the assessment of risk and 

management of homeland security activities.

Ongoing (2014).

U.S. 

Government

2006

Recommendation 3-1

The U.S. Government should periodically reevaluate 

list of radioactive sources that warrant enhanced 

security and protection.

Complete (2014). List was 

reevaluated by the Task Force in 

2009 and 2012. Future 

reevaluations are to be performed 

as directed by the Task Force.

U.S. 

Government

2006

Recommendation 5-2

U.S. Government should evaluate the feasibility of 

using new and existing technologies, such as tracking 

technologies, to detect and discourage theft of risksignificant radioactive materials during transport.

Complete (2014). Multiple 

agencies completed evaluations, 

and the National Nuclear Security 

Administration (NNSA) is 

continuing to work with device 

manufacturers.

U.S. 

Government

2006

Recommendation 5-3

The U.S. Government should develop a strategy and 

take actions to address the security of international 

shipments of risk-significant radioactive sources that 

transit or are transshipped through the land territory 

of the United States.

Complete (2014). Customs and 

Border Protection (CBP) and TSA 

addressed transshipment issues in 

several meetings in 2013. But the 

Task Force proposed that the DOT 

and CBP address security 

requirements of transshipments, 

such as adopting requirements 

similar to the NRC’s Part 37 

regulations.

U.S. 

Government

2010

Recommendation 8

The U.S. Government should enhance support for 

research and development of certain types of 

shipping containers for source recovery efforts.

Ongoing (2014). 

Source: GAO analysis of Radiation Source Protection and Security Task Force information. | GAO-17-58
Appendix II: List of Additional Transportationrelated Radiation Source Protection and 

Security Task Force Recommendations

Page 55 GAO-17-58 Radioactive Sources

a

The 2006 report included both recommendations and action items. However, starting with the 2010 

report, the task force began referring to all actions to be taken as recommendations. As such, we 

refer to the 2006 action items as recommendations.

b

The term risk-significant radioactive sources refers to radioactive sources individually or in 

aggregated quantities that meet or exceed category 1 and 2 thresholds, as defined by the 

International Atomic Energy Agency’s (IAEA) Code of Conduct on the Safety and Security of 

Radioactive Sources.

c

The participating agencies had all signed the MOU as of January 2015.
Appendix III: Comments from NRC

Page 56 GAO-17-58 Radioactive Sources

Appendix III: Comments from NRC
Appendix III: Comments from NRC

Page 57 GAO-17-58 Radioactive Sources
Appendix III: Comments from NRC

Page 58 GAO-17-58 Radioactive Sources
Appendix III: Comments from NRC

Page 59 GAO-17-58 Radioactive Sources
Appendix III: Comments from NRC

Page 60 GAO-17-58 Radioactive Sources
Appendix IV: Comments from DOT

Page 61 GAO-17-58 Radioactive Sources

Appendix IV: Comments from DOT
Appendix IV: Comments from DOT

Page 62 GAO-17-58 Radioactive Sources
Appendix V: GAO Contact and Staff 

Acknowledgments

Page 63 GAO-17-58 Radioactive Sources

Shelby S. Oakley, (202) 512-3841 or oakleys@gao.gov.

In addition to the individual named above, Daniel Feehan (Assistant 

Director), Richard Burkard, Kendall Childers, Wesley Collins, Julia 

Coulter, John Delicath, Chris Ferencik, Cindy Gilbert, Brandon Haller, 

Mitch Karpman, Dan Royer, Zachary Sivo, Amy Suntoke, Kiki 

Theodoropoulos, and Sarah Veale made significant contributions to this 

report.

Appendix V: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(361633)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.