NUCLEAR 

SECURITY

NRC Has Enhanced 

the Controls of 

Dangerous 

Radioactive Materials, 

but Vulnerabilities 

Remain

Report to the Ranking Member 

Committee on Homeland Security, 

House of Representatives

July 2016

GAO-16-330

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-16-330, a report to the 

Ranking Member, Committee on Homeland 

Security, House of Representatives

July 2016

NUCLEAR SECURITY

NRC Has Enhanced the Controls of Dangerous 

Radioactive Materials, but Vulnerabilities Remain

Why GAO Did This Study

In 2007, GAO reported weaknesses in 

NRC’s licensing program as GAO 

investigators, after setting up fictitious

companies, were able to obtain an

NRC license and then alter it to obtain 

agreements to purchase devices 

containing, in aggregate, a dangerous

quantity of radioactive materials. 

GAO was asked to review and assess 

the steps NRC and agreement states 

have taken to strengthen their licensing 

processes. This report examines (1)

the steps NRC and agreement states 

have taken to ensure that radioactive 

materials licenses are granted only to 

legitimate organizations and licensees 

can obtain materials only in quantities 

allowed by their licenses; and (2) the 

results of covert vulnerability testing

designed to test the effectiveness of 

these controls. GAO reviewed relevant 

guidance documents, regulations, and

analyses of orders, and interviewed 

NRC and state officials. GAO also 

established three fictitious businesses 

and applied for a radioactive materials 

license for each.

What GAO Recommends

GAO is making three 

recommendations to NRC, including 

that NRC (1) take steps to include 

category 3 quantities of radioactive 

materials in NSTS and WBL, and (2)

require that transferors of category 3 

quantities of radioactive materials 

confirm the validity of licenses with 

regulators before selling or transferring

these materials. GAO provided a draft 

of this report to NRC for comment. 

NRC neither agreed nor disagreed with 

GAO’s recommendations, but noted 

that the agency has formal evaluations 

underway considering all three 

recommendations.

What GAO Found

The Nuclear Regulatory Commission (NRC) and the 37 states it permits to grant 

licenses for radioactive materials—called agreement states—have taken several 

steps since 2007 to help ensure that licenses are granted only to legitimate 

organizations and that licensees can only obtain such materials in quantities 

allowed by their licenses. However, NRC and agreement states have not taken 

some measures to better control some dangerous quantities of radioactive 

materials. The International Atomic Energy Agency established a system ranking

quantities of certain radioactive materials into five categories based on their 

potential to harm human health, with, in descending order of danger, categories 

1, 2, and 3 all considered dangerous. NRC developed revised guidance,

screening criteria, and a checklist, among other things, and now directs NRC 

regions and agreement states to conduct prelicensing site visits—focusing on 

questions related to the applicant’s business operations, facility, radiation safety 

operations, and personnel qualifications for all unknown applicants. NRC, 

however, has not strengthened controls for all categories of radioactive material 

considered dangerous. Unlike its process for applicants for category 1 and 2 

quantities of radioactive materials, for category 3 applicants NRC does not 

review specific security measures before a license is issued. NRC has also 

developed and deployed the National Source Tracking System (NSTS), the Webbased Licensing System (WBL), and the License Verification System to better 

control some materials. However, these systems focus on more dangerous 

category 1 and 2 quantities but not category 3 quantities. Further, NRC does not

specifically require that the validity of category 3 licenses be verified by the seller 

with NRC or the agreement states—creating risks that licenses could be 

counterfeited or that licensees could obtain radioactive materials in quantities 

greater than what is allowed by their licenses.

GAO’s covert testing of NRC requirements showed them to be effective in two

out of our three cases; in a third case, GAO was able to obtain a license and 

secure commitments to purchase, by accumulating multiple category 3 quantities

of materials, a category 2 quantity of a radioactive material considered attractive 

for use in a “dirty bomb”—which uses explosives to disperse radioactive material.

To test NRC’s prelicensing processes, GAO established three fictitious 

companies, leased vacant space for each company (two in agreement states, 

one in an NRC state), and submitted an application to the appropriate agreement 

state or NRC office for a license to possess a category 3 source only slightly 

below the threshold for category 2. GAO made no attempt to outfit the site to 

make it appear as if a legitimate business was operating there. In the two cases 

where GAO was unable to obtain a license, the scrutiny provided by NRC or 

agreement state (regulatory body) officials during the prelicensing site visit led to 

the license not being granted. In the third case, the official from the regulatory 

body accepted GAO’s assurances without scrutinizing key aspects of the

fictitious business, which led to a license being obtained. NRC is currently taking 

corrective actions to provide training to NRC and agreement state officials to 

emphasize greater scrutiny in conducting prelicensing site visits. According to 

NRC officials, NRC and agreement state working groups are currently developing 

and evaluating enhancements to (1) prelicensing guidance overall and (2) license 

verification and transfer requirements for category 3 licenses.

View GAO16-330. For more information, 

contact David C. Trimble at (202) 512-3841 or 

trimbled@gao.gov. 
Page i GAO-16-330 Nuclear Security

Letter 1

Background 7

NRC and Agreement States Have Taken Several Steps to Better 

Control Radioactive Materials, but Not Requiring Tracking and 

Agency License Verification for Category 3 Quantities Leaves 

Vulnerabilities 13

Our Testing of NRC and Agreement State Programs Showed 

Them to Be Effective in Some Cases but Not Others, Allowing 

Us to Obtain Commitments to Purchase a Dangerous Quantity 

of Radioactive Materials 21

Conclusions 25

Recommendations for Executive Action 26

Agency Comments and Our Evaluation 27

Appendix I Comments from the Nuclear Regulatory Commission 29

Appendix II GAO Contact and Staff Acknowledgments 35

Figure

Figure 1: Map of Nuclear Regulatory Commission (NRC) Regions 

and 37 Agreement States 9

Contents
Page ii GAO-16-330 Nuclear Security

Abbreviations

DOE Department of Energy

EPAct Energy Policy Act

IAEA International Atomic Energy Agency

IMPEP Integrated Materials Performance Evaluation Program

LVS License Verification System

MRB Management Review Board

NRC Nuclear Regulatory Commission

NSTS National Source Tracking System

OAS Organization of Agreement States

RDD radiological dispersal device

RED radiation exposure device

WBL Web-based Licensing System

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-16-330 Nuclear Security

441 G St. N.W.

Washington, DC 20548

July 1, 2016

The Honorable Bennie G. Thompson

Ranking Member

Committee on Homeland Security

House of Representatives

Dear Mr. Thompson:

Radioactive materials are commonly used throughout the world for a 

variety of purposes in medicine and the oil and gas, electric power, 

construction, and food industries. Radioactive materials are frequently 

sealed in a capsule or permanently bonded in solid form for use as sealed 

sources in various devices. For example, devices containing radioactive 

materials in sealed sources are used to diagnose and treat millions of 

patients each year, sterilize medical instruments and food, and detect 

flaws in the metal welds in pipelines. Since terrorists attacked the United 

States in 2001, concerns have grown that terrorists could obtain and use 

radioactive materials to build a “dirty bomb”—a type of radiological 

dispersal device (RDD) that uses conventional explosives to disperse 

radioactive material. The consequences of detonating an RDD would 

depend on the amount and type of radioactive material used and the size 

and characteristics of the area in which the material was dispersed. In 

many scenarios, an RDD would cause few deaths or injuries, but would 

likely have significant economic effects because the affected area would 

need to be decontaminated and people who live and work there might not 

return to their homes or businesses for an extended period of time 

because of actual or feared contamination.

Until 2001, oversight of radioactive sealed sources in the United States 

largely focused on ensuring that such sources were licensed as required 

and used and stored safely. The Atomic Energy Act gives the Nuclear 

Regulatory Commission (NRC) regulatory authority over domestic 

industrial, medical, and research uses of radioactive materials. The act 

also authorizes NRC to enter into agreements with states (called 

agreement states) so they assume, and NRC relinquishes, regulatory 

Letter
Page 2 GAO-16-330 Nuclear Security

authority over specified radioactive materials.1 NRC and agreement 

states license, monitor, track, and require security for radioactive 

materials in order to protect both workers and the public from exposure to 

hazardous levels of radiation generated by the activities of licensees. To 

date, NRC has relinquished authority to 37 agreement states to grant 

licenses to possess and use radioactive materials and sealed sources 

and to conduct regular inspections of licensees.2 NRC retains its mandate 

to regulate the use of radioactive materials in the remaining 13 states 

(NRC states). Given their mandate to regulate the radioactive material 

covered by their licenses, NRC and state regulators focused on the 

dangers posed by day-to-day occupational exposure to radiation and the 

direct health effects from industrial accidents.

In the years after 2001, security concerns surrounding radioactive 

materials received greater attention nationally and internationally. For 

example, in May 2003, NRC and the Department of Energy (DOE) 

identified several radionuclides—particular types of radioactive 

material3

—that are most commonly used in the United States and that 

pose the greatest risk of being used by terrorists to make an RDD.4 That 

same year, the International Atomic Energy Agency (IAEA) published a 

system that ranked quantities of individual radionuclides into one of five 

 1

42 U.S.C. § 2021(b) (2015). NRC is authorized to enter into agreements to allow states 

to assume regulatory authority over source, by-product, and special nuclear materials in 

quantities insufficient to form a critical mass. NRC must find a state program adequate to 

protect public health and safety and compatible with NRC’s program for regulating such 

materials before entering into these agreements. According to NRC staff, NRC also 

retains authority over Federal entities, in areas of exclusive Federal jurisdiction and for the 

protection of common defense and security.

2

According to NRC, agreement states typically oversee radiological security through their 

health or environment departments, which inspect licensees to ensure compliance with 

state regulations, orders, or license conditions, and NRC reviews the state requirements 

to ensure that they are compatible with the NRC regulatory program. The standards for 

general compatibility vary by program area. Some areas of agreement state programs 

must be “essentially identical” to those of NRC; in other areas, states have the flexibility to 

incorporate similar or more stringent requirements provided that the requirements of 

adequacy and compatibility are still met.

3

A radionuclide is an unstable, radiation-emitting nuclide. A nuclide is a particular atomic 

form of an element distinguished from other nuclides by its number of neutrons and 

protons, as well as by the amount of energy it contains. 

4

Department of Energy and Nuclear Regulatory Commission, Radiological Dispersal 

Devices: An Initial Study to Identify Radiological Materials of Greatest Concern and 

Approaches to Their Tracking, Tagging and Disposition (May 2003).
Page 3 GAO-16-330 Nuclear Security

categories on the basis of their potential to harm human health.5 Under 

IAEA’s system, a given radionuclide is considered dangerous when 

gathered in close proximity to people in sufficient quantity to cause direct 

human health effects.6 A category 1 quantity of a radionuclide, the most 

dangerous, is defined as an amount 1,000 times or more than the amount 

necessary to cause permanent human injury. A category 2 quantity is 

defined as an amount at least 10 times, but less than 1,000 times, the 

amount necessary to cause permanent human injury. A category 3 

quantity of a given radionuclide is defined as at least the minimum 

amount, but less than 10 times the amount sufficient to cause permanent 

injury. Category 4 and 5 quantities of radioactive materials are unlikely to 

cause permanent injury.

In September 2003, the United States and other nations endorsed IAEA’s 

Code of Conduct that set forth basic principles and guidance to promote 

the safe and secure use of radioactive sources containing dangerous 

quantities of radioactive materials and that countries should take 

appropriate measures to ensure that such radioactive sources are safely 

managed and securely protected. The Code of Conduct applies to 

category 1, 2, and 3 radioactive materials—all of which are potentially 

dangerous to human health and could, if not properly controlled, cause 

permanent injuries or death to a person who handled or was otherwise in 

contact with them. Category 1 and 2 quantities of radioactive sources 

listed in the Code of Conduct are considered the highest risk and most 

dangerous and have been the focus of federal and state efforts to place 

tighter controls on their licensing and use. Specifically, NRC, working with 

agreement states, issued security orders beginning in 2003 requiring 

several additional security measures. Subsequently, NRC issued 

increased control orders in 2005 to protect certain radionuclides from 

theft, diversion, or other unauthorized access when they are gathered in 

quantities at or above a particular threshold. According to NRC officials, 

agreement states also issued legally binding requirements at the same 

time that required their licensees to take the same actions required in the 

NRC increased controls orders. Additional security measures include 24-

 5

IAEA Safety Guide #RS-G-1.9, Categorization of Radioactive Sources, details the 

underlying methodology for the five-category scheme. According to NRC officials, NRC 

and DOE participated in efforts to develop this guide.

6

Direct, deterministic, or nonprobabilistic, human health effects are readily observable, 

may be acute, and may cause death or permanent injury and are, accordingly, more 

severe than the elevated risk of a future health effect, such as cancer. 
Page 4 GAO-16-330 Nuclear Security

hour surveillance, multiple layers of physical security, and measures to 

request assistance from local law enforcement agencies in the event of 

any actual or attempted breach in security.7 These additional security 

requirements have been incorporated into NRC regulations, including 10 

C.F.R. Part 37, Physical Protection of Category 1 and Category 2 

Quantities of Radioactive Material. Part 37 was promulgated on March 

19, 2013. According to NRC, its regional offices have fully implemented 

this rule. According to NRC officials, all agreement states have fully 

implemented compatible requirements to Part 37 as of March 19, 2016; 

state licensees operated under orders or other legally binding 

requirements in the interim.

In addition, in 2005, Congress passed the Energy Policy Act (EPAct) 

establishing a radiation source protection and security task force (Task 

Force) to make recommendations relating to the security of radiation 

sources in the United States from potential terrorist threats. The EPAct 

requires that at least once every 4 years, the Task Force submit to 

Congress and the President a report providing its recommendations, 

including possible legislative and regulatory changes on a variety of 

topics that include the protection and security of radiation sources. 

Accordingly, in 2007, the Task Force directed the Radiation Sources 

Subgroup to reevaluate the list of radioactive sources that warrant 

enhanced security and protection, among other things. In 2009, the 

subgroup found that the IAEA Code of Conduct category 1 and 2 

quantities for sealed and unsealed radiological sources remained valid as 

these could result in a significant RDD event and therefore warrant 

enhanced security and protection.8

 7

NRC issued security orders beginning in 2003 to certain NRC and agreement state 

licensees under its common defense and security authority, and in 2005, NRC and 

agreement states issued security orders (commonly known as increased controls) under 

their public health and safety authority to certain NRC and agreement state licensees. To 

effect nationwide implementation of the increased control orders, each agreement state 

issued legally binding requirements to impose enhanced security measures identical to 

the increased controls for licensees under that state’s regulatory jurisdiction. 

8

The subgroup sought to obtain common federal definitions of a significant radiation 

exposure device (RED) as well as a significant RDD. An RED is an object used to 

maliciously expose people, equipment, the environment, or a combination of these to 

ionizing radiation without the dispersal of radioactive material. See Chairman of the U.S. 

Nuclear Regulatory Commission, The 2010 Radiation Source Protection and Security 

Task Force Report, Report to the President and U.S. Congress Under Public Law 109-58, 

The Energy Policy Act of 2005 (Washington, D.C.: Aug. 11, 2010).
Page 5 GAO-16-330 Nuclear Security

We first reported that there were potential weaknesses in NRC and 

agreement state licensing processes in 2003, and we made 

recommendations to correct the problems at that time.9 By 2006, NRC 

and agreement states had taken steps to improve their licensing 

processes, and we later found that NRC had implemented three of our 

recommendations to address weaknesses in NRC and agreement state 

licensing processes made in GAO’s 2003 report.10 In 2007, however, a 

GAO covert vulnerability testing effort revealed that weaknesses 

persisted as GAO investigators, after setting up a fictitious company, 

were able to obtain a genuine NRC license and then alter it to obtain 

agreements to purchase devices containing, in aggregate, a dangerous 

(category 3) quantity of radioactive materials.11 In 2008, we found that

NRC had worked with the agreement states and others to (1) identify 

sealed sources of greatest concern, (2) enhance requirements to secure 

radioactive sources, and (3) ensure that security requirements were 

implemented. In addition, we found that NRC had made progress toward 

implementing recommendations to (1) modify its process for issuing 

licenses to ensure that radioactive materials cannot be purchased by 

those with no legitimate need for them and (2) examine whether certain 

radioactive sources should be subject to more stringent regulations. Our 

2008 work also found that NRC could do more to ensure the security of 

radioactive materials. Specifically, we recommended that among other 

things NRC take steps to develop and implement the systems it was then 

planning to better track, secure, and control radioactive materials.

This report provides our first review of NRC and agreement state 

materials licensing programs since our 2007 covert vulnerability testing 

and our 2008 report. You asked us to review and assess the steps NRC 

and agreement states have taken to strengthen their licensing processes. 

This report (1) examines what steps NRC and agreement states have 

taken since 2007 to ensure that radioactive materials licenses are granted 

only to legitimate organizations, and licensees can obtain materials only 

 9

GAO, Nuclear Security: Federal and State Action Needed to Improve Security of Sealed 

Radioactive Sources, GAO-03-804 (Washington, D.C.: Aug. 6, 2003).

10GAO, Nuclear Security: NRC and DHS Need to Take Additional Steps to Better Track 

and Detect Radioactive Materials, GAO-08-598 (Washington, D.C.: June 19, 2008).

11GAO, Nuclear Security: Actions Taken by NRC to Strengthen Its Licensing Process for 

Sealed Radioactive Sources Are Not Effective, GAO-07-1038T (Washington, D.C.: July 

12, 2007).
Page 6 GAO-16-330 Nuclear Security

in quantities allowed by their licenses, and (2) presents the results of our 

covert vulnerability testing designed to test the effectiveness of these 

controls.

In conducting our work, we reviewed planning documents, 

memorandums, and analyses of orders describing changes NRC made to 

its licensing process since 2007. We also reviewed regulations, guidance 

documents, and directives describing NRC and agreement states’

licensing processes. To examine what steps NRC and agreement states 

have taken since 2007 to ensure that radioactive materials licenses are 

granted only to legitimate organizations, and that licensees can obtain 

such materials only in quantities allowed by their licenses, we reviewed 

GAO reports as well as reports and recommendations made by the 

Senate Permanent Subcommittee on Investigations, the Independent 

External Review Panel,12 the Materials Program Working Group,13 as well 

as the radiation source protection and security task force. We also 

examined NRC documents on the use of NRC’s key data systems—the 

National Source Tracking System, Web-based Licensing System, and 

License Verification System. Finally, we gathered testimonial evidence 

through telephone and in-person interviews with NRC officials in 

headquarters and regional offices, Organization of Agreement States 

(OAS) officials, and officials from a nonprobability sample of agreement 

states selected on the basis of an Integrated Materials Performance 

Evaluation Program (IMPEP) review and periodic meeting findings, 

number of licenses issued by the state, and geographic diversity. We also 

obtained written responses to some of our questions from NRC officials. 

We also reviewed documents describing NRC’s IMPEP and IMPEP 

policy, guidance, and criteria, including NRC management directives and 

regulatory guides, and IMPEP reports that document NRC’s reviews of 

agreement states and NRC regional offices’ radioactive materials 

licensing programs. In addition, we reviewed a 2009 report by NRC’s 

 12The Independent External Review Panel was formed to identify vulnerabilities in NRC’s 

materials licensing program. According to the panel’s charter, the principal objective of the 

panel is to respond to the NRC Office of Inspector General recommendation (OIG-07-A12) that the “executive director of operations convene an independent panel of experts 

external to the agency to identify agency vulnerabilities concerning the NRC’s materials 

licensing and tracking programs and validate the agency’s ongoing by-product material 

security efforts.”

13The Materials Program Working Group is comprised of NRC and agreement state 

officials. It was chartered by NRC to assess specific and potential security vulnerabilities 

in the program and to provide recommendations to address these vulnerabilities.
Page 7 GAO-16-330 Nuclear Security

Office of Inspector General that revealed weaknesses in IMPEP. We 

obtained documents from NRC and agreement states that describe 

measures taken to ensure compliance with guidance, rules, orders, and 

other criteria outside of IMPEP reviews, including periodic selfassessments and other supplemental oversight processes.

Finally, we tested the effectiveness of these controls through the use of 

covert investigative techniques. Specifically, we established fictitious 

businesses and applied for radioactive materials licenses in three 

states—two agreement states and one NRC state. In all three states, we 

leased vacant space in an industrial or office park. We used these spaces 

as the physical addresses of fictitious businesses, and these locations 

were later the subject of prelicensing site visits by agreement state or 

NRC officials as part their prelicensing reviews of our applications. We 

selected these states based on a nongeneralizable sampling strategy 

focusing on states with a history of issuing the largest numbers of 

radioactive materials licenses for the type of devices we sought for our 

fictitious businesses, and in one case, a state that was also known to 

have a history of weaknesses in its radioactive materials regulatory 

program.

We conducted this performance audit from April 2014 to July 2016 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. We conducted our related 

investigative work in accordance with investigation standards prescribed 

by the Council of the Inspectors General on Integrity and Efficiency.

The human health risks posed by any given type of radioactive material 

depend on its activity level, or intensity; how long exposure lasts; and the 

way in which the body is exposed to it—via inhalation, ingestion, or 

external exposure. The different types of radiation—including alpha, beta, 

gamma, and neutron—vary in how easy or difficult they are to block or 

shield, which, in turn, affects the health threat posed by a particular type 

of radiation. Depending on the radioactive material’s intensity and the 

length and manner of exposure to it, health effects range from death, to 

severe injury, to the development of cancer, to no discernable damage. 

For example, alpha radiation poses little threat to human health from 

external exposure, but poses considerable health risks if inhaled or 

Background
Page 8 GAO-16-330 Nuclear Security

ingested. Gamma radiation is more penetrating and, if not properly 

shielded, can cause injury or death through external exposure. Neutron 

radiation, like gamma radiation, if not shielded, can also cause injury or 

death through external exposure. Although sources of neutron radiation 

are less common, neutron radiation is emitted from some materials that 

are used to make nuclear weapons.

NRC oversees licensees of radiological material through three regional 

offices located in Illinois, Pennsylvania, and Texas; radiological material 

licensing responsibilities for the region II office in Georgia are handled by 

the region I office in Pennsylvania. NRC has relinquished regulatory 

authority for licensing and regulating certain radioactive material to 37 

states that have entered into an agreement with NRC (agreement 

states).14 Figure 1 shows which states are agreement states and in which 

states NRC has maintained all regulatory authority (NRC states).

 14Specifically, NRC has relinquished regulatory authority for licensing and regulating byproduct, source, and certain quantities of special nuclear materials.
Page 9 GAO-16-330 Nuclear Security

Figure 1: Map of Nuclear Regulatory Commission (NRC) Regions and 37 Agreement States

Note: Although the figure depicts NRC’s four regions, three of the four regions oversee licensees with 

radiological sources. Region I, located in Pennsylvania, also oversees facilities within region II that 

have radiological sources. Regions III and IV oversee such facilities within their respective regions. 

Also, NRC maintains regulatory authority over Washington, D.C.

NRC and agreement states issue two types of licenses authorizing the 

possession and use of radioactive materials: specific licenses and 

general licenses. Specific licenses, which are the focus of this report, are 

issued for devices that contain relatively larger sealed radioactive 

sources. These devices, such as medical equipment used to treat cancer, 
Page 10 GAO-16-330 Nuclear Security

cameras used for industrial radiography, and moisture and density 

gauges used in construction, generally require training to be used safely 

and may also need to be properly secured to avoid misuse. An 

organization or individual seeking to obtain a specific license must submit 

an application and gain the approval of either NRC or the appropriate 

agreement state prior to receiving and using licensed radioactive 

materials.15 According to NRC, of the approximately 21,000 specific 

radioactive materials licenses in the United States, NRC administers 

about 2,900, and agreement states administer the rest.

Our prior work on security of radioactive materials found that NRC could 

do more to ensure the security of these materials. Specifically, we 

recommended in 2008 that among other things NRC take steps to 

develop and implement the systems it was then planning to better track, 

secure, and control radioactive materials. These systems are the National 

Source Tracking System (NSTS), the Web-based Licensing System 

(WBL), and the License Verification System (LVS).

NSTS, deployed in January 2009, tracks category 1 and 2 sources of the 

20 radionuclides that NRC determined are sufficiently attractive for use in 

an RDD or for other malicious purposes and warrant national tracking.16

NSTS is a transaction-based system that tracks each major step that 

each tracked radioactive source takes within the United States from 

“cradle to grave.” Licensees are responsible for reporting the 

manufacture, shipment, arrival, disassembly, and disposal of all nationally 

tracked sources. A nationally tracked source is a source containing a 

category 1 or 2 quantity of certain radioactive materials specified in 

NRC’s regulations.17 More specifically, NSTS includes the radionuclide, 

 15Devices approved for use under a general license, by contrast, such as luminous exit 

signs, normally contain relatively small radioactive sources. Such devices are designed 

with inherent safety features, are widely commercially available, and do not require NRC 

or agreement state approval to possess.

16The 20 radionuclides include the 16 radionuclides of concern plus 4 additional 

radionuclides: actinium-227, polonium-210, and thorium-228 and -229. NRC opted to 

include these four additional radionuclides, which NRC deems of concern for RDD or 

other malicious purposes, in NSTS at DOE’s request. Although NRC and agreement state 

licensees do not possess large numbers of sources containing these radionuclides, and 

none with category 2 or higher quantities, DOE might possess such quantities.

17NSTS does not, however, track shipments in real time by providing, for example, 

information about shipping, route, modes of transport, and so forth. Instead, it tracks, 

according to NRC, the transfer of sources from one authorized licensee to another.
Page 11 GAO-16-330 Nuclear Security

quantity (activity),18 manufacturer, manufacture date, model number, 

serial number, and site address. The licensee has until the close of the 

next business day after a transaction—such as the sale of a source from 

a vendor to a customer—takes place to enter it into the system. As a 

result, the location of all such sources are accounted for and closely 

tracked.

While NSTS is presently configured to track larger and potentially more 

dangerous radioactive sources, NRC’s WBL—deployed in August 2012—

provides quick access to up-to-date information on all NRC and four 

agreement states’ specific licenses for all radioactive materials and 

sources in all five IAEA categories, enabling the user to enter, maintain, 

track, and search radioactive material licensing and inspection 

information.19 WBL also includes pdf images of all paper copies of 

category 1 and 2 licenses for both NRC and agreement state licensees. 

NRC also developed a third system—LVS, deployed in May 2013—which 

draws on the information in NSTS and WBL and provides information to 

regulators and vendors and other would-be transferors on whether those 

applicants seeking to acquire category 1 and 2 sources are legitimately 

licensed to do so.20 This is particularly important because paper licenses 

issued by NRC and agreement states can be altered or counterfeited. 

LVS provides a means to mitigate the risks of using paper licenses.

While NRC and agreement states have taken steps to improve their 

licensing programs and better ensure that radiological materials are safe 

and secure, concerns about the theft of radioactive materials and the 

possible consequences of a dirty bomb attack persist. In 2012, for 

example, we identified security weaknesses at some U.S. medical 

 18The activity data for a given source may be reported based on the manufacture date or 

assay date. Because all radioactive materials decay over time, an up-to-date estimation of 

a source’s activity level is calculated, if needed, by the system.

19Thirty-three agreement states do not include category 3-5 license information in WBL. 

According to NRC officials, they do, however, include all category 1 and 2 licenses in WBL 

to facilitate the verification of these licenses as required by 10 C.F.R. § 37.71.

20According to NRC officials, because of the complexity of licenses, it is not yet practical 

to implement a fully automated license verification system at this time. A fully automated 

system would require a computer program that could calculate whether a licensee has 

sufficient margin between what is currently possessed and possession limits.
Page 12 GAO-16-330 Nuclear Security

facilities that use high-risk radioactive materials, such as cesium-137,21

and in 2014, we found that challenges exist in reducing the security risks 

faced by licensees using high-risk radioactive materials for industrial

purposes.22

NRC periodically evaluates NRC regional offices’ and agreement states’

programs for licensing radioactive materials through its Integrated 

Materials Performance Evaluation Program (IMPEP). NRC implemented 

IMPEP in 1995 to periodically review NRC regional office and agreement 

state radioactive materials programs to ensure that they are adequately 

protecting public health and safety from the potential hazards associated 

with the use of radioactive materials, and that agreement state programs 

are compatible with NRC’s program. As part of IMPEP, each NRC 

regional office and agreement state regulatory program is typically 

expected to undergo a program review every 4 years; reviews may occur 

more or less frequently depending on a program’s past performance. The 

IMPEP reviewers examine a regional office’s or an agreement state’s 

performance in areas such as licensing and inspections to determine if 

the regional office’s program is adequate to protect public health and 

safety and if the agreement state’s program is adequate to protect public 

health and safety and compatible with NRC requirements.

NRC also has the option to employ greater oversight of agreement state 

programs if it discovers performance issues. Specifically, if performance 

problems are found, a Management Review Board (MRB)—comprised of 

NRC officials and an agreement state liaison—may decide to (in 

ascending order of seriousness) institute Monitoring, Heightened 

Oversight, Probation, Suspension, or Termination.23 The MRB may 

decide to place an agreement state on Monitoring if weaknesses in the 

program have resulted in or could result in less than satisfactory 

performance in one or more performance areas. If an agreement state 

 21GAO, Nuclear Nonproliferation: Additional Actions Needed to Improve Security of 

Radiological Sources at U.S. Medical Facilities, GAO-12-925 (Washington, D.C.: Sept. 10, 

2012).

22GAO, Nuclear Nonproliferation: Additional Actions Needed to Increase the Security of 

U.S. Industrial Radiological Sources, GAO-14-293 (Washington, D.C.: June 6, 2014). 

23These heightened oversight options are not applicable to regional programs. NRC must 

implement immediate action to correct regional program deficiencies that are similar to 

those that would warrant probation, suspension, or termination actions for an agreement 

state.
Page 13 GAO-16-330 Nuclear Security

program is found to have more serious problems (i.e., one or more 

performance indicators are found to be unsatisfactory), the MRB may opt 

to place a program on Heightened Oversight. Under Heightened 

Oversight, a program may be requested to submit a program 

improvement plan, which involves establishing a plan to address all 

recommendations to eliminate unsatisfactory performance as well as 

frequent contact with NRC to closely monitor progress. If the program 

under IMPEP review does not correct performance weaknesses under 

Heightened Oversight the MRB/NRC may place the program on 

Probation or even suspend or terminate the agreement and reassert 

regulatory authority. Probation is a formal process and requires approval 

of the Commission and notification of the state’s governor, congressional 

delegation, and public.

NRC and agreement states have taken several steps since 2007 to help 

ensure that radioactive materials licenses are granted only to legitimate 

organizations and that licensees can only obtain such materials in 

quantities allowed by their licenses, but have not taken some measures 

for better controlling category 3 quantities of radioactive materials. In 

2008, NRC developed revised screening criteria and a checklist covering 

all five IAEA categories of radioactive materials and now directs regions 

and agreement states to conduct prelicensing site visits for all unknown

applicants. NRC and agreement states performed IMPEP reviews to 

assess whether licensing guidance was being met and took corrective 

actions when it was not. NRC also developed and deployed NSTS, WBL, 

and LVS to better control such materials, although these systems are 

focused on category 1 and 2 quantities. NRC does not require that 

category 3 quantities be tracked in NSTS nor does it require all category 

3 licenses be included in WBL. LVS, which queries NSTS and WBL, 

provides information to regulators and vendors on whether a license is 

valid. By not including category 3 materials in NSTS nor most agreement 

state licenses in WBL, NRC has not taken an important step that could 

better track and control these materials. Further, including all category 3 

materials in these systems could help address the risk that paper licenses 

issued by NRC and agreement states could be altered or counterfeited or 

that a licensee could obtain radioactive materials in quantities greater 

than what is allowed by their license.

NRC and Agreement 

States Have Taken 

Several Steps to 

Better Control 

Radioactive 

Materials, but Not 

Requiring Tracking 

and Agency License 

Verification for 

Category 3 Quantities 

Leaves Vulnerabilities
Page 14 GAO-16-330 Nuclear Security

NRC has taken a number of steps to address the vulnerabilities in its 

licensing process identified by GAO and others. Specifically, in 

September 2007, NRC approved its Action Plan to respond to 

recommendations to address security issues its and agreement states’

radioactive materials programs raised in NRC Inspector General, Senate 

subcommittee,24 and GAO reports. NRC also established prelicensing 

and materials working groups and the Independent External Review 

Panel to assess the security of NRC and agreement programs and 

develop recommendations to address any vulnerabilities identified. 

Among the outcomes of the working groups and panel was the 

September 2008 issuance of revised prelicensing guidance, which, 

among other things, according to NRC officials suspended the “good faith 

presumption.”25 Prior to this change, NRC and agreement states were to 

maintain a good faith presumption that assumed that applicants and 

licensees did not have malicious intentions and that they would be honest 

and truthful in providing information to regulators. The revised guidance 

suspended this presumption, and directed regions and agreement states 

to conduct prelicensing site visits for all unknown applicants. Prior to June 

2007, such visits were optional except in cases where the proposed use 

of radioactive materials involved unusually complex technical, safety, or 

unprecedented issues, or were otherwise judged to be high risk. The 

revised guidance directed NRC regions to conduct prelicensing site visits 

for unknown applicants for specific licenses starting in September 2008, 

and as a matter of compatibility for agreement states since March 2009. 

Taken together, according to NRC officials, the suspension of the 

presumption of good faith was intended to provide greater scrutiny of both 

license applications and prelicensing site visits for unknown applicants.

In addition to suspending the good faith presumption for previously 

unknown applicants, NRC developed screening criteria to determine 

whether a prelicensing site visit should be conducted. Specifically, among 

other things, these criteria focus on whether the applicant may already

have a license elsewhere with NRC or agreement states. If the applicant 

is known to NRC or an agreement state, a site visit may not need to be 

conducted. Nonetheless, some agreement states conduct prelicensing 

 24Senate Committee on Homeland Security and Governmental Affairs, Permanent 

Subcommittee on Investigations, Dirty Bomb Vulnerabilities, (July 12, 2007).

25A revised checklist and screening criteria were also developed to provide greater 

confidence that radioactive materials will be used as specified on a license.

NRC Revised Guidance 

Provides Greater Scrutiny 

of Radioactive Materials 

License Applications

New Screening Criteria, Site 

Visit Checklist, and Guidance
Page 15 GAO-16-330 Nuclear Security

site visits for all applicants, regardless of whether they are known to NRC 

or other agreement states, according to NRC officials. According to NRC, 

the purpose of the site visit is to have a face-to-face meeting with the 

applicant to determine whether there is a basis for confidence that the 

sought radioactive materials will be used as represented in the application 

when the applicant receives the license. NRC also established a 14-point 

checklist to guide prelicensing site visits and developed a list of questions 

and activities related to the applicant’s business operations, facility, 

radiation safety operations, and personnel qualifications, to scrutinize the 

applicant and provide a basis for confidence that the applicant will use the 

radioactive material as specified in the license.26

In 2008, NRC also adopted revised prelicensing guidance. Under this 

guidance, according to NRC officials, for any specific license (category 1-

5) to be granted, unknown applicants must demonstrate during the 

prelicensing site visit that they are aware of, capable of, and committed to 

complying with all applicable (health, safety, and security) guidance 

before they take possession of licensed radioactive materials. In general, 

according to NRC officials, applicants must demonstrate that they are 

constructing facilities, establishing procedures, and have sufficient 

qualified staff to support the size and scope of the program described in 

the application. In addition, NRC officials told us that new applicants for 

category 1 and 2 quantities also undergo an on-site security review 

performed by NRC or agreement state officials. These security reviews 

verify that the applicant is prepared to implement the required security 

measures before the applicant takes possession of licensed radioactive 

materials, according to NRC officials. (On-site security reviews are not 

conducted for applicants for category 3-5 licenses.) According to NRC 

staff, those conducting on-site security reviews determine whether the 

applicant has the staff, processes, procedures, facilities, and equipment 

to be ready to comply with all applicable additional security requirements. 

NRC officials told us that they inspect each licensee for compliance with 

health, safety, and security requirements for all licenses (category 1-5) 

during an inspection after a licensee takes possession of the materials 

and that this inspection occurs within 12 months of the issuance of a new 

 26A prelicensing site visit is different from an inspection, the purpose of which is to 

determine whether the licensee is using radioactive material safely and in compliance with 

established standards after a license has been issued and the licensee has taken 

possession of and is using the licensed radioactive materials.

Prelicensing Guidance
Page 16 GAO-16-330 Nuclear Security

or amended license. NRC officials we spoke with, however, say that the 

initial postlicensing inspection may, and typically does, take place sooner.

Through IMPEP reviews, NRC identified instances where agreement 

state programs did not follow NRC licensing guidance and took steps to 

ensure that corrective actions are taken. For example, according to NRC 

officials, from 2009 to 2013, IMPEP reviews found that three agreement 

state programs did not consistently apply the 2008 prelicensing guidance. 

As a result, NRC reminded all agreement state programs to follow 

prelicensing guidance, to ensure that the problem would not continue. 

According to NRC officials, NRC regional offices and agreement state 

agencies follow essentially the same guidance and procedures when 

reviewing license applications.

NRC also took steps to improve IMPEP by, among other things, 

addressing program weaknesses. For example, in 2008, the NRCchartered Materials Program Working Group recommended that NRC 

incorporate new security policies and foster an enhanced security culture 

as part of IMPEP reviews. In 2007, GAO recommended that NRC should 

conduct periodic oversight of the license application examiners to ensure 

that the new guidance is being appropriately applied. In response to this 

recommendation, NRC officials told us that they started working to 

incorporate enhanced security measures into the review process. For 

example, according to NRC officials, IMPEP review teams now evaluate 

programs on items such as their implementation of the prelicensing 

checklist, control of sensitive information, and amending of licenses to 

include new security requirements. In addition, the Commission directed 

NRC staff to develop options, among other things, to revise IMPEP 

metrics. According to NRC officials, the Commission approved the staff’s 

plan to improve IMPEP consistency by updating guidance and training, 

and the staff have started implementing plans to enhance the IMPEP 

process and expects these activities to be completed by the end of 2017.

NRC and Agreement 

States Took Steps to 

Assess Whether Licensing 

Guidance Is Properly 

Implemented
Page 17 GAO-16-330 Nuclear Security

To help ensure that licensees can obtain radioactive materials only in 

quantities allowed by their licenses, NRC developed and deployed NSTS 

and WBL to track category 1 and 2 quantities of radioactive materials and 

record specific license information, respectively.27 It also deployed LVS, 

which queries WBL and NSTS, to better enable regulators, vendors, and 

other licensees to ensure that those seeking category 1 and 2 quantities 

of radioactive materials are properly licensed to do so. Specifically, prior 

to transferring category 1 and 2 quantities of radioactive materials, 

licensees are required to verify with the appropriate regulatory body that 

the transferee is licensed to have material of the type, form, and quantity 

specified on the license and, in the case of category 1, to receive material 

at the location specified on the license.28 Verification can be done 

electronically using LVS or by the vendor or other seller (licensee) 

contacting the appropriate regulatory body (specifically, NRC or the 

agreement state that issued the license) directly to confirm the validity of 

the license.29 LVS queries WBL and NSTS and enables users to confirm 

that

1. a category 1 or 2 license is valid and accurate,

2. a licensee is authorized to acquire quantities and types of radioactive 

materials, and

3. the licensee’s current category 1 or 2 inventories in NSTS do not 

exceed the possession limits.

 27NRC published a final rule in the Federal Register in 2006, establishing a national 

system for source tracking, whereby specific licensees who possess IAEA category 1 and 

2 sources are required to report information on the manufacture, transfer, receipt, 

disassembly, and disposal of nationally tracked sources. National Source Tracking of 

Sealed Sources, 71 Fed. Reg. 65,686 (Nov. 8, 2006). Licensees were required to report 

their initial inventories by January 31, 2009. National Source Tracking of Sealed Sources; 

Revised Compliance Dates, 72 Fed. Reg. 59,162 (Oct. 19, 2007).

2810 C.F.R. § 37.71 (2016).

29In the case of an emergency, where the vendor or other seller (licensee) cannot reach 

the license-issuing authority and LVS is not operational, the vendor or other seller may 

accept a written certification by the purchaser (transferee) that it is authorized by license 

to receive the type, form, and quantity of radioactive materials to be transferred. The 

certification must include the license number; current revision number; issuing agency; 

expiration date; and, for a category 1 shipment, the authorized address. The licensee is 

required to keep a copy of the certification. The certification must be confirmed through 

NRC’s LVS or by contacting the license-issuing authority by the end of the next business 

day.

NRC Developed and 

Deployed Tracking, 

Licensing, and Verification 

Systems to Better Control 

Category 1 and 2 

Quantities of Radioactive 

Material
Page 18 GAO-16-330 Nuclear Security

If the licensee is over their possession limit at the time the license 

verification request is made, the LVS user would receive an error 

message to contact the regulatory agency that issued the license for a 

manual license verification, according to NRC officials.30 For category 1 

and 2 licenses, deployment and use of these three systems, combined 

with the requirement that transferors verify the legitimacy of licenses with 

the appropriate regulatory body, serve as an impediment to those who 

would attempt to illicitly obtain radioactive materials using a counterfeit or 

altered license.

In contrast to the requirements for category 1 and 2 quantities of 

radioactive materials, NRC does not require the tracking of category 3 

materials or specifically require vendors to verify the legitimacy of 

licenses with the appropriate regulatory body for those seeking to acquire 

category 3 materials. Category 3 quantities of radioactive materials, which 

are considered dangerous by IAEA, are not tracked in NSTS, nor are 

licenses for such material issued by most agreement states in WBL.31 In 

addition, unlike transfers of category 1 and 2 quantities of radioactive 

materials, NRC regulations governing transfers of category 3 and smaller 

quantities of radioactive materials, which were last updated in 1978, do 

not specifically require transferors to contact the appropriate NRC 

regional office or agreement state regulator to verify that those wishing to 

take possession of the material are licensed to do so. Instead, transferors 

have several options, including obtaining a copy of the transferee’s 

license, for verifying that the transferee has a license. We recommended 

in 2008 that NRC include all potentially dangerous radioactive sources in 

 30However, because NSTS does not track category 3 (and lesser) quantities of radioactive 

materials, it cannot be known for certain whether a pending transfer would be within the 

licensee’s possession limits. This is also because NSTS does not track in real time the 

actual quantity/inventory a licensee possesses. According to NRC officials, it is the 

responsibility of the licensee requesting material and the regulatory agency issuing the 

license and conducting inspections to make certain that the licensee is not in violation of 

any aspect of the license, including possession limits.

31According to NRC officials, all specific licenses for category 1-5 quantities of radioactive 

materials issued by NRC, and the states of Colorado, Wisconsin, North Carolina, and 

Massachusetts are in WBL. Colorado and Wisconsin are using WBL for licensing; North 

Carolina and Massachusetts are providing copies of all licenses to WBL. Licenses for 

category 3-5 quantities of radioactive material are not included in WBL for 33 agreement 

states.

NRC Does Not Require 

Tracking or Agency 

Verification for Category 3 

Quantities, Creating Risks 

to Public Health, Safety, 

and Security
Page 19 GAO-16-330 Nuclear Security

NSTS to address risks that a licensee could obtain radioactive materials 

in quantities greater than what is allowed by their license.

In 2009, after years of study, NRC staff recommended that the 

Commission approve a final rule requiring that category 3 materials be 

tracked in NSTS. The recommendation, according to NRC staff, was 

based on several factors:32

• Category 3 sources are considered dangerous by IAEA

• The potential to accumulate category 3 sources by aggregation to a 

more dangerous category 2 level

• The additional burden to track category 3 was deemed justified given 

the benefit in improved source accountability

• NSTS could accommodate additional data for newly tracked sources

When considering the recommendation to require that category 3 

materials be tracked in NSTS, the Commission was evenly divided. 

Specifically, the Commission split two to two, and thus did not adopt the 

recommendation as Commission policy. Accordingly, it continues to be 

the case that only category 1 and 2 sources are required to be tracked in 

NSTS.

In addition to not requiring tracking of category 3 quantities of radioactive 

materials, NRC regulations governing transfers of category 3 and smaller 

quantities of radioactive materials do not specifically require transferors to 

verify the legitimacy of the license with the appropriate regulatory body. 

Instead, transferors are required to choose one of several methods to 

assure themselves that the purchaser has a license. Options include 

obtaining a copy of the transferee’s license and verifying directly with the 

appropriate regulatory body that a purchaser has a license to acquire 

 32NRC staff concluded in the discussion section of the proposed rule that although the 

NSTS could not ensure the physical protection of sources, it could in conjunction with 

WBL and prelicensing site visits, and increased controls, provide greater control of 

radioactive sources.
Page 20 GAO-16-330 Nuclear Security

sought category 3 or below radioactive materials.33 Because category 3 

licensees are not specifically required to verify licenses through LVS or 

directly with the appropriate regulatory body, most agreement state 

category 3 license information is not in WBL, and transferors cannot verify 

through LVS that a purchaser is legitimately licensed. Instead, to get 

agency verification, transferors would need to contact the appropriate 

NRC regional office or agreement state regulatory body. By contrast, 

those transferring category 1 and 2 quantities of radioactive materials to 

other parties must verify license validity either by using LVS or by 

contacting the relevant NRC regional office or agreement state regulatory 

authority.34 The NRC regulations applicable to category 3 and smaller 

quantities of radioactive materials have not been updated since 1978. 

According to NRC officials, many transferors of category 3 and smaller 

quantities of radioactive materials comply with NRC requirements by 

obtaining and keeping a copy of the transferees’ licenses for their 

records. However, there is presently no specific requirement that they do 

so. Because they do not require transferors of category 3 and smaller 

quantities of radioactive materials to verify the validity of a transferee’s 

license by contacting the appropriate regulatory body directly, and do not 

make LVS available for use by these transferors, NRC and agreement 

states do not have assurance that their systems would prevent bad actors 

from altering licenses or fraudulently reporting the details of their licenses 

to transferors, accumulating dangerous materials by aggregation to 

category 2 or larger quantities on the basis of those fraudulent licenses, 

and thereby endangering public health and safety. On this point, we 

recommended in 2007 that NRC explore options to prevent individuals 

from counterfeiting NRC licenses, especially if this counterfeiting allows 

transferees to purchase more radioactive materials than they are 

approved for under the terms of their original licenses.

 33Transferors have several other options for verifying the transferee’s license. Transferors 

may also obtain (1) a written certification that the transferee is authorized to receive the 

transfer, (2) oral certification that the transferee is authorized to receive the transfer for 

emergency shipments, or (3) information compiled by a reporting service from official 

records of the appropriate regulatory body. Only when none of these methods are 

available, or when a transferor desires to verify that information received by one of such 

methods is correct or up to date, is the transferor instructed to seek verification from the 

appropriate regulatory body itself.

34An exception to this rule can be made in some cases of emergency when verification 

may be deferred until the next business day.
Page 21 GAO-16-330 Nuclear Security

Our testing of NRC and agreement state programs showed guidance—

including the suspension of the good faith presumption, screening criteria, 

and checklists, as well as inspectors’ application of scrutiny during 

prelicensing site visits—to be effective in two out of our three cases. In a 

third case, we were able to obtain a license for a category 3 quantity of 

radioactive materials and secure commitments to purchase a category 2 

quantity of radioactive materials by aggregation by altering a paper 

license.

In order to test the effectiveness of NRC’s revised guidance, screening 

criteria, checklists, and the prelicensing site visit, we established three 

fictitious companies; leased vacant space in an industrial or office park for 

each company (two in agreement states, one in an NRC state); and 

submitted an application to the appropriate NRC regional office or 

agreement state for a specific radioactive materials license to possess a 

high-level category 3 quantity source that was only slightly below the 

threshold for a category 2 quantity source. We designed our test to fail 

the prelicensing site visit. In each case, we took no actions to prepare the 

leased space for the site visit. According to NRC officials, while the NRC 

prelicensing checklist does not require that a site have implemented all 

the requirements that apply to licensees, its purpose, among other things, 

is to establish a basis for confidence that radioactive material will be used 

as specified on the license being sought, and we made no attempt to 

improve or outfit the site to make it appear as if a legitimate business was 

operating there. In our view, a prelicensing site visit, conducted with 

adequate scrutiny, would likely reveal that our fictitious companies were 

not suitable for a license. In each case, after we submitted a license 

application, and answered some additional questions from NRC or 

agreement state officials, we scheduled a time to meet officials from the 

NRC or agreement state at the location of the fictitious business.

Two of the three fictitious companies we established were unable to 

obtain a license because NRC or agreement state officials found some 

aspects of the application, the fictitious company, the leased space, or a 

combination of these not to be credible. In these two cases, the scrutiny 

of the prelicensing site visit was an important factor in the regulatory 

bodies not granting our fictitious companies a radioactive materials 

license.

• In one case, the regulatory body closed our application for several 

reasons. Based on the judgement of the officials from this regulatory 

body, they concluded that our facility and equipment were not 

Our Testing of NRC 

and Agreement State 

Programs Showed 

Them to Be Effective 

in Some Cases but 

Not Others, Allowing 

Us to Obtain 

Commitments to 

Purchase a 

Dangerous Quantity 

of Radioactive 

Materials

NRC Guidance Was 

Effective in Preventing Us 

from Obtaining Licenses 

for Our Fictitious 

Companies in Two Cases
Page 22 GAO-16-330 Nuclear Security

adequate to protect public health and safety and minimize danger to 

life and property. To reach this conclusion, they asked us numerous 

detailed questions about the nature of our business and our past 

business experience. We had difficulty answering some of these 

questions because of the fictitious nature of our business. They asked 

for key business documents that we could not provide, such as a copy 

of a business license from the state. Further, they contacted us the 

day after the site visit about not being able to verify the work history of 

the company’s radiation safety officer. (We had fabricated this 

individual’s work history.) This regulatory body performed satisfactorily 

for all performance indicators during its most recent IMPEP review 

and was rated satisfactory on all performance indicators in two 

consecutive IMPEP reviews.

• In the second case, officials from the regulatory body stated that we 

would not receive a license until the site was significantly more 

developed, consistent with operating as a genuine business, and had 

installed on-site an appropriately safe and secure storage container 

for the radiological source and posted requisite safety placards 

specified in the application, among other things. These comments are 

consistent with NRC officials’ statements that the purpose of the site 

visit is to have a face-to-face meeting with the applicant to determine 

whether there is a basis for confidence that the sought radioactive 

materials will be used as represented in the application. Moreover, the 

regulatory body stated in a follow-up e-mail that the company must 

submit additional information on several aspects of the application 

before a license could be issued: new facility drawings (as the ones 

provided were not accurate), public radiation dose calculations (as the 

proposed facility was next to an office building), descriptions of the 

security measures that would be implemented, and more specific 

information about how the company planned to transfer the source 

from the facility to the company’s truck since there was no garage 

door in the facility. In summary, the regulators stated that they wanted 

to “see everything that is in place right before you go into business.”

This regulatory body had recently been subjected to Heightened 

Oversight by NRC because of problems uncovered regarding, among 

other things, the qualifications, retention, and depth of its licensing 

staff during an earlier IMPEP review. The regulatory body’s 

performance had improved in the next IMPEP review, and its status 

was upgraded from Heightened Oversight to Monitoring by the time 

the prelicensing visit took place.

GAO Also Obtained a License for a 

Fictitious Business in 2007

In 2007, GAO tested controls on the licensing 

of radioactive materials in two states—a state 

regulated by the Nuclear Regulatory 

Commission and an agreement state. To do 

this, GAO established two fictitious businesses 

and submitted a radioactive materials 

application to the relevant regulatory body for 

each state. GAO did not rent office space for 

its fictitious businesses but instead used post 

office boxes for addresses. GAO was able to 

obtain a genuine radioactive materials license 

from one of the two regulatory bodies.

After obtaining a (paper) license, GAO 

investigators altered the license so the 

fictitious company could purchase a much 

larger quantity of radioactive material rather 

than the maximum listed on the license. GAO 

then sought to purchase, from two suppliers, 

devices containing radioactive materials. 

These suppliers gave GAO price quotes and 

commitments to ship the devices containing 

radioactive materials in an amount sufficient to 

reach the International Atomic Energy Agency 

category 3 level—considered dangerous if not 

safely managed or secured. Importantly, GAO 

could have accumulated substantially more 

radioactive material.

GAO withdrew its application from the second 

regulatory body after the license examiners 

indicated that they would visit the fictitious 

company’s office before granting the license. 

An official with the regulatory body told GAO 

that conducting a site visit was a standard 

procedure before license applications are 

approved.

Source: GAO. | GAO-16-330
Page 23 GAO-16-330 Nuclear Security

In one of the three cases, we were able to obtain a license for one of our 

fictitious companies. Specifically, our application was approved and the 

paper license was handed to our GAO investigator posing as a 

representative of our fictitious company at the end of the prelicensing site 

visit. During the application process and site visit, the regulatory official 

accepted our written and oral assurances of the steps that our fictitious 

company would take—to construct facilities, establish safety procedures, 

hire sufficient qualified staff, and construct secure storage areas—after 

receiving a license. We had taken no actions to implement any of these 

steps when regulators approved our application and awarded the 

company a license. The regulatory body in this case used a more lengthy 

and detailed application than the other two regulatory bodies from which 

we attempted to obtain licenses. However, notwithstanding NRC’s 

guidance to suspend the presumption of good faith, the official from the 

regulatory body accepted our assurances without scrutinizing key aspects 

of our fictitious business to the extent that the other regulatory bodies 

had. This regulatory body was found to have satisfactory performance in 

all performance areas in its most recent IMPEP review.

Once we obtained a license, we were able to exploit the absence of a 

requirement to verify the legitimacy of category 3 licenses with the 

appropriate regulatory body and obtained commitments to acquire, by 

accumulating multiple category 3 sources, a category 2 quantity of 

radioactive material. Importantly, this material is 1 of the 20 radionuclides 

that NRC previously determined are attractive for use in an RDD (also 

known as a dirty bomb). Once we obtained a license, we contacted a 

vendor of the category 3 radioactive source that we specified on our 

license application. We provided a copy of the license, among other 

things, to the vendor and subsequently obtained a signed commitment 

from this vendor to sell us the source. We then altered the paper license 

and contacted another vendor who also agreed to sell us a category 3 

source we specified on our altered license. When combined, these two 

high-level category 3 sources aggregate to a category 2 quantity of 

radioactive material. According to IAEA, a category 2 quantity, if not 

safely managed or securely protected, could cause permanent injury to a 

person who handled it, or was otherwise in contact with the material, for a 

short time (minutes to hours). NRC and agreement states require 

additional security measures for those seeking to acquire this quantity of 

material. Our fictitious business was not subjected to these more stringent 

The Implementation of 

NRC’s Guidance Was Not 

Effective in Preventing Us 

from Obtaining a License 

for Our Fictitious Company 

in One Case

GAO Used License to Obtain 

Vendor Commitments to Sell a 

Dangerous Quantity of 

Radioactive Material 

Considered Attractive for Use 

in a Dirty Bomb
Page 24 GAO-16-330 Nuclear Security

measures and provisions, however, because we were seeking a category 

3 quantity of material.35

It is important to note that we undertook a very similar covert testing of 

NRC and agreement state radioactive materials licensing programs in 

2007 with very similar results. In 2007, we obtained a real radioactive 

materials license for a below category 3 quantity of material and then 

altered it to obtain commitments from multiple vendors to sell us, in 

aggregate, devices containing a category 3 quantity of a radioactive 

material considered attractive for use in an RDD. This time, we were able 

to complete a similar covert vulnerability test in which we obtained a real 

license for a category 3 quantity of radioactive material and altered it to 

obtain commitments from multiple vendors to sell us, in aggregate, a 

more dangerous category 2 quantity of a type of radioactive material 

considered attractive for use in an RDD.

Once we received our license from the agreement state and secured 

commitments from vendors to sell us radiological material, we met with 

NRC officials in October 2015 to alert them to the outcomes of the 

investigative component of our work. As a result of our findings, NRC

officials told us that they are taking a number of corrective actions. 

Specifically, NRC is updating training courses for new NRC and 

agreement state inspectors to reinforce the importance of properly 

implementing the prelicensing guidance. A key part of this training is to 

reinforce the suspension of the good faith assumption during 

prelicensing—particularly during site visits. NRC also developed and 

provided a training webinar for NRC and agreement state staff to further 

emphasize prelicensing guidance and providing adequate scrutiny during 

site visits. In addition, NRC requested that NRC regional offices and 

agreement states conduct self-assessments of their implementation of the 

prelicensing guidance and site visits. Finally, according to NRC officials, 

NRC and agreement state working groups are currently developing and 

evaluating enhancements to (1) current prelicensing guidance overall, 

and (2) license verification and transfer requirements and prelicensing

 35As noted earlier, we designed our test to fail the prelicensing site visit. In each of the 

three cases, we took no actions to prepare the leased space for the site visit. While the 

NRC prelicensing checklist does not require that a site have implemented all the 

requirements that apply to licensees, its purpose is to establish a basis of confidence that 

radioactive material will be used as specified on the license being sought, and we made 

no attempt to improve or outfit the site to make it appear as if a legitimate business was 

operating there.
Page 25 GAO-16-330 Nuclear Security

guidance for category 3 licenses in particular. However, NRC officials 

informed us that since the Commission did not adopt a proposal to 

include category 3 quantities of radioactive materials in NSTS in 2009, 

NRC had no current plans to take action on requiring category 3 

quantities be included in NSTS. Because of this, NRC and the agreement 

states will continue to be very limited in their ability to track these 

dangerous quantities of radioactive material.

Since 2007, NRC has taken steps to implement several of the 

recommendations made by GAO and others to enhance the control and

accountability of radioactive sources and materials. NRC has deployed 

data systems—NSTS, WBL, and LVS—that are helping to better track, 

secure, and control category 1 and 2 quantities of radioactive materials. 

NRC also developed revised guidance, screening criteria, and checklists 

covering all five IAEA categories of radioactive materials, and now directs 

regions and agreement states to conduct prelicensing site visits for all 

unknown applicants. However, NRC chose not to implement 

recommendations to better track, secure, and control category 3 

materials. GAO testing of the revised guidance, checklists, and 

prelicensing site visits showed these revised systems to be only partially 

effective in that our attempts to obtain a license using a fictitious company

was successful in one of our three cases—allowing us to obtain 

commitments from vendors to sell, in aggregate, a category 2 quantity of 

radioactive material considered attractive for use in an RDD. This 

demonstrates vulnerabilities similar to those we found in 2007.

To its credit, NRC has taken a number of corrective actions in response 

to our findings, including more training on prelicensing guidance to ensure 

that NRC and agreement state staff provide adequate scrutiny during 

prelicensing site visits. NRC has also formed working groups to consider 

enhancements to the prelicensing process. It will be important for NRC to 

continue these efforts as part of its process to ensure that its prelicensing 

guidance, including site visits, is effectively performed. Nonetheless, our 

work shows that NRC can do more to strengthen its processes of 

licensing radioactive materials. Specifically, we continue to believe that 

NRC should implement the recommendations by GAO and others for 

enhancing the ability to track, secure, and control category 3 sources by 

including such sources in both NSTS and WBL. Doing so would also 

enable LVS to query these systems and better enable transferors to verify 

the legitimacy of those seeking to purchase radioactive materials. As the 

results of our covert vulnerability testing show, it is possible for someone 

to obtain a license, which is printed on paper; make alterations to this 

Conclusions
Page 26 GAO-16-330 Nuclear Security

paper license; and use the altered license for a category 3 source to 

acquire another category 3 source and thereby accumulate more 

dangerous, high-risk category 2 quantities. Including category 3 quantities 

in NSTS and WBL, and requiring transferors to verify the legitimacy of 

licenses of those seeking to purchase radioactive materials through LVS 

or with the appropriate regulatory body, would provide greater assurance 

that a bad actor could not manipulate the system by, for example, altering 

a paper license, to acquire radioactive materials in aggregate greater than 

what they are authorized to possess.

Moreover, NRC regulations governing the steps that transferors of 

category 3 quantities of radioactive materials must take to verify that 

those wishing to take possession of the material are properly licensed to 

do so have not been updated since 1978 and may not be adequate to 

protect public health and safety. In contrast, NRC has taken several steps 

to update its licensing guidance by, among other things, directing regions 

and agreement states to conduct site visits for unknown applicants and 

suspending the good faith presumption, which fosters greater scrutiny of 

applicants. However, because paper licenses are vulnerable to being 

altered, not requiring transferors of category 3 quantities of radioactive 

materials to verify the validity of their licenses with the appropriate 

regulatory body may still allow bad actors to accumulate dangerous 

materials and in quantities that threaten public health and safety.

Finally, prior to issuing a license to a new applicant for category 1 and 2 

quantities, NRC and agreement states conduct an on-site security review 

to verify that the applicant is prepared to implement the required security 

measures before taking possession of licensed radioactive materials. 

However, such on-site security reviews are not conducted for applicants 

of category 3 quantities and below, and regulators told us that they may 

take up to a year to ensure that applicants have implemented all required 

health, safety, and security measures. Although category 3 quantities of 

materials are considered dangerous by IAEA, NRC on-site security 

reviews are not currently conducted for all prospective licensees that will 

have access to dangerous quantities of radioactive materials.

Because some quantities of radioactive materials are potentially 

dangerous to human health if not properly handled, we recommend that 

NRC take action to better track and secure these materials and verify the 

legitimacy of the licenses for those who seek to possess them. 

Specifically, we recommend that the Nuclear Regulatory Commission 

(NRC) take the following three actions:

Recommendations for 

Executive Action
Page 27 GAO-16-330 Nuclear Security

• Take the steps needed to include category 3 sources in the National 

Source Tracking System and add agreement state category 3 

licenses to the Web-based Licensing System as quickly as reasonably 

possible.

• At least until such time that category 3 licenses can be verified using 

the License Verification System, require that transferors of category 3 

quantities of radioactive materials confirm the validity of a would-be 

purchaser’s radioactive materials license with the appropriate 

regulatory authority before transferring any category 3 quantities of 

licensed materials.

• As part of the ongoing efforts of NRC working groups meeting to 

develop enhancements to the prelicensing requirements for category 

3 licenses, consider requiring that an on-site security review be 

conducted for all unknown applicants of category 3 licenses to verify 

that each applicant is prepared to implement the required security 

measures before taking possession of licensed radioactive materials.

We provided a draft of this product to NRC for comment. In its written 

comments, reproduced in appendix I, NRC neither explicitly agreed nor 

disagreed with our recommendations, but noted that the agency has 

formal evaluations underway considering all three recommendations. 

Specifically, NRC stated that the agency would consider GAO’s 

recommendations as part of the working groups the agency has

established to evaluate (1) including category 3 sources in WBL and 

NSTS, (2) license verification transfer requirements for category 3 

sources, and (3) enhancing security and safety measures as part of the 

prelicensing process. In addition, NRC recommended that we revise the

first recommendation for clarity. We modified the language in this 

recommendation to provide greater clarity. NRC also provided technical 

comments that were incorporated, as appropriate.

Agency Comments 

and Our Evaluation
Page 28 GAO-16-330 Nuclear Security

As agreed with your office, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies of this report to the 

Chairman of the Nuclear Regulatory Commission, the appropriate 

congressional committees, and other interested parties. In addition, this 

report will be available at no charge on the GAO website at 

http://www.gao.gov.

If you or your staff members have any questions concerning this report, 

please contact me at (202) 512-3841 or trimbled@gao.gov. Contact 

points for our Offices of Congressional Relations and Public Affairs may 

be found on the last page of this report. GAO staff who made significant 

contributions to this report are listed in appendix II.

Sincerely yours,

David C. Trimble

Director, Natural Resources and Environment
Appendix I: Comments from the Nuclear 

Regulatory Commission

Page 29 GAO-16-330 Nuclear Security

Appendix I: Comments from the Nuclear 

Regulatory Commission
Appendix I: Comments from the Nuclear 

Regulatory Commission

Page 30 GAO-16-330 Nuclear Security
Appendix I: Comments from the Nuclear 

Regulatory Commission

Page 31 GAO-16-330 Nuclear Security
Appendix I: Comments from the Nuclear 

Regulatory Commission

Page 32 GAO-16-330 Nuclear Security
Appendix I: Comments from the Nuclear 

Regulatory Commission

Page 33 GAO-16-330 Nuclear Security
Appendix I: Comments from the Nuclear 

Regulatory Commission

Page 34 GAO-16-330 Nuclear Security
Appendix II: GAO Contact and Staff 

Acknowledgments

Page 35 GAO-16-330 Nuclear Security

David Trimble, (202) 512-3841 or trimbled@gao.gov

In addition to the contact named above, Ned Woodward (Assistant 

Director), Antoinette Capaccio, Frederick Childers, Jenny Chow, John 

Delicath, Barbara Lewis, Steven Putansu, Brynn Rovito, Kevin Tarmann, 

and the Forensic Audits and Investigative Service team made key 

contributions to this work.

Appendix II: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(361565)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. 

Listen to our Podcasts and read The Watchblog.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.