United States Government Accountability Office

GAO Testimony 

Before the Permanent Subcommittee on 

Investigations, Committee on Homeland 

Security and Governmental Affairs, 

U.S. Senate

NUCLEAR SECURITY

Actions Taken by NRC to 

Strengthen Its Licensing 

Process for Sealed 

Radioactive Sources Are 

Not Effective 

Statement of Gregory D. Kutz, Managing Director 

Forensic Audits and Special Investigations 

Gene Aloise, Director 

Natural Resources and Environment 

John W. Cooney, Assistant Director 

Forensic Audits and Special Investigations 

For Release on Delivery

Expected at 9:00 a.m. EDT 

Thursday, July 12, 2007

 

GAO-07-1038T 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

July 12, 2007

NUCLEAR SECURITY

Actions Taken by NRC to Strengthen Its 

Licensing Process for Sealed Radioactive 

Sources Are Not Effective 

Highlights of GAO-07-1038T, a testimony 

before the Permanent Subcommittee on 

Investigations, Committee on Homeland 

Security and Governmental Affairs, U.S. 

Senate 

The Nuclear Regulatory

Commission (NRC) regulates 

domestic medical, industrial, and 

research uses of sealed radioactive

sources. Organizations or

individuals attempting to purchase

a sealed source must apply for a

license and gain the approval of

either NRC or an “agreement state.” 

To become an agreement state, a

state must demonstrate to NRC 

that its regulatory program is 

compatible with NRC regulations 

and is effective in protecting public

health and safety. NRC then

transfers portions of its authority 

to the agreement state.

In 2003, GAO reported that

weaknesses in NRC’s licensing 

program could allow terrorists to

obtain radioactive materials. NRC 

took some steps to respond to the 

GAO report, including issuing 

guidance to license examiners. To 

determine whether NRC actions to 

address GAO recommendations 

were sufficient, the Subcommittee 

asked GAO to test the licensing 

program using covert investigative

methods. 

What GAO Recommends

GAO recommends that NRC 

develop improved screening 

criteria to evaluate new license

applications, conduct periodic

reviews of license examiners to

ensure the criteria are properly

applied, and explore options to 

prevent license counterfeiting. 

By using the name of a bogus business that existed only on paper, GAO 

investigators were able to obtain a genuine radioactive materials license 

from NRC. Aside from traveling to a non-agreement state to pick up and 

send mail, GAO investigators did not need to leave their office in

Washington, D.C., to obtain the license from NRC. Further, other than 

obtaining radiation safety officer training, investigators gathered all the 

information they needed for the license from the NRC Web site. 

Excerpt from NRC License Acceptance Letter for Bogus Business 

After obtaining a license from NRC, GAO investigators altered the license so

it appeared that the bogus company could purchase an unrestricted quantity

of radioactive sealed sources rather than the maximum listed on the 

approved license. GAO then sought to purchase, from two U.S. suppliers, 

machines containing sealed radioactive material. Letters of intent to 

purchase, which included the altered NRC license as an attachment, were 

accepted by the two suppliers. These suppliers gave GAO price quotes and 

commitments to ship the machines containing radioactive materials. The 

amount of radioactive material we could have acquired from these two 

suppliers was sufficient to reach the International Atomic Energy Agency’s 

(IAEA) definition of category 3. According to IAEA, category 3 sources are 

dangerous if not safely managed or securely protected. Importantly, with 

patience and the proper financial resources, we could have accumulated 

substantially more radioactive source material.

GAO also attempted to obtain a license from an agreement state, but 

withdrew the application after state license examiners indicated they would 

visit the bogus company office before granting the license. An official with 

the licensing program told GAO that conducting a site visit is a standard 

required procedure before radioactive materials license applications are

approved in that state. 

As a result of this investigation, NRC suspended its licensing program until it 

could determine what corrective actions were necessary to resolve the 

weaknesses GAO identified. On June 12, 2007, NRC issued supplemental 

interim guidance with additional screening criteria. These criteria are 

intended to help a license examiner determine whether a site visit or face-toface meeting with new license applicants is required.

www.gao.gov/cgi-bin/getrpt?GAO-07-1038T.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Gregory D. 

Kutz at (202) 512-7455 or kutzg@gao.gov or 

Gene Aloise at (202) 512-3841 or

aloisee@gao.gov. 
Mr. Chairman and Members of the Subcommittee: 

Thank you for the opportunity to discuss our covert testing of the Nuclear

Regulatory Commission’s (NRC) licensing process for sealed radioactive 

sources. Under the Atomic Energy Act of 1954, NRC regulates domestic 

medical, industrial, and research uses of sealed radioactive sources 

through a combination of regulatory requirements, licensing, inspection, 

and enforcement. Organizations or individuals attempting to purchase a 

sealed source must apply for a license and gain the approval of either NRC 

or an “agreement state.” To become an agreement state, a state must first 

demonstrate to NRC that its regulatory program is compatible with NRC 

regulations and is effective in protecting public health and safety. Through

an agreement between NRC and the state governor, NRC then transfers 

portions of its regulatory and licensing authority to the state. According to

NRC, there are approximately 22,000 licenses in the United States—NRC 

administers about 4,400 licenses, and the rest are administered by 

regulatory authorities in the 34 agreement states. 

Given that terrorists have expressed an interest in obtaining nuclear 

material, the Congress and the American people expect licensing 

programs for these materials to be secure. However, in 2003, we reported 

that weaknesses in the licensing program could allow terrorists to obtain 

radioactive materials. We recommended that NRC close this vulnerability 

by modifying its licensing process.1

 Among other things, we recommended 

that “NRC modify its process for issuing specific licenses to ensure that 

sealed radioactive sources cannot be purchased before NRC’s 

verification—through inspection or other means—that the materials will 

be used as intended.” NRC agreed with this recommendation and referred 

the issue to a working group composed of NRC and state representatives 

to coordinate NRC’s response. In December 2005, the working group 

delivered its recommendations to NRC senior management. In December 

2006, NRC issued new guidance to agreement states and NRC regional 

offices meant to strengthen the radioactive materials licensing process.2

Although these are important steps forward, the Subcommittee remained

concerned about whether, almost 6 years after September 11, 2001, 

 1

GAO, Nuclear Security: Federal and State Action Needed to Improve Security of Sealed

Radioactive Sources, GAO-03-804 (Washington, D.C.: Aug. 6, 2003). 

2

The guidance was also sent to officials in New Jersey, Pennsylvania, and Virginia—states 

that are not yet agreement states but have filed statements of intent with NRC to achieve 

agreement state status. 

Page 1 GAO-07-1038T 
terrorists could still exploit weaknesses in the government’s licensing 

process and obtain radioactive material. To determine whether NRC 

actions to address our 2003 recommendations were sufficient, the 

Subcommittee asked us to use covert investigative methods to test the 

licensing program. 

To perform this investigation, we incorporated two bogus businesses—

one in a non-agreement state and one in an agreement state. We selected

these two states based on their proximity to the Washington, D.C., metro 

area. Using the names of the bogus businesses, we then prepared and 

submitted one application for a byproduct materials license to NRC and a 

second application to the department of the environment of the agreement 

state. In creating these applications, we only used publicly available 

information. Our investigators did not actually purchase radioactive 

materials for several reasons—first, the primary intent of our work was to 

test the licensing process rather than the purchasing process; second, we 

did not think the cost borne by the government would be necessary to 

prove the point of our work; and third, we did not have the proper 

facilities to safely store the radioactive materials. In performing research 

for this work, we reviewed our previous reports on nuclear security and

learned about the licensing process from NRC’s Web site. We altered the 

license we received from NRC, which enabled us to obtain agreements to 

purchase more radioactive material than the original license permitted. We 

conducted our investigative work from October 2006 through June 2007 in

accordance with standards prescribed by the President’s Council on 

Integrity and Efficiency.

In summary, we found the following:

• The license application we submitted to NRC was approved. We 

received a license in the mail from NRC about 4 weeks after submitting 

the application. Aside from traveling to a non-agreement state to pick 

up and send mail, our investigators did not need to leave their office in 

Washington, D.C., to obtain the license from NRC. Further, other than 

obtaining radiation safety officer training, investigators gathered all the 

information they needed for the license from the NRC Web site. 

• After obtaining a license from NRC, we sought to purchase, from two 

U.S. suppliers, machines containing sealed radioactive material. Our 

letters of intent to purchase, which included an altered version of the 

NRC license as an attachment, were accepted by the suppliers. These 

suppliers gave us price quotes and commitments to ship the machines 

containing radioactive materials. The amount of radioactive material 

Page 2 GAO-07-1038T 
we could have acquired from these two suppliers was sufficient to 

reach the International Atomic Energy Agency’s (IAEA) definition of 

category 3. According to IAEA, category 3 sources are dangerous if not 

safely managed or securely protected and “could cause permanent 

injury to a person who handled them, or was otherwise in contact with 

them, for some hours. It could possibly—although it is unlikely—be 

fatal to be close to this amount of unshielded radioactive material for a 

period of days to weeks.”3

 Importantly, with patience and the proper 

financial resources, we could have accumulated from other suppliers 

substantially more radioactive source material than what the two 

suppliers initially agreed to ship to us. 

• We withdrew our second application from the agreement state 

department of the environment after license examiners indicated they

would visit our company office before granting the license. Since we 

did not have a company office or the proper storage equipment, we 

asked the state to withdraw our application to obtain a license in this 

state. According to an official with the licensing program for this state, 

the completion of a site visit is a standard procedure before the state 

department of the environment approves a radioactive materials 

license application. 

Since the September 11, 2001, terrorist attacks there has been concern that

certain radioactive material could be used in the construction of a 

radiological dispersion device (RDD). An RDD disperses radioactive 

material over a particular target area, which could be accomplished using 

explosives or by other means.4

 The major purpose of an RDD would be to 

create terror and disruption, not death or destruction. Depending on the 

type, form, amount, and concentration of radioactive material used, direct 

radiation exposure from an RDD could cause health effects to individuals 

in proximity to the material for an extended time; for those exposed for 

shorter periods and at lower levels, it could potentially increase the longBackground 

 3

International Atomic Energy Agency, Code of Conduct on the Safety and Security of 

Radioactive Sources (Vienna, Austria: 2004).

4

According to NRC, a dirty bomb is one type of RDD that combines a conventional 

explosive, such as dynamite, with radioactive material. The terms dirty bomb and RDD are 

often used interchangeably in the media. Most RDDs would not release enough radiation to

kill people or cause severe illness—the conventional explosive itself could be more 

harmful to individuals than the radioactive material. However, depending on the scenario, 

an RDD explosion could create fear and panic, contaminate property, and require 

potentially costly cleanup. 

Page 3 GAO-07-1038T 
term risks of cancer. In addition, the evacuation and cleanup of 

contaminated areas after dispersal could lead to panic and serious 

economic costs on the affected population. In 2003, a joint 

NRC/Department of Energy (DOE) interagency working group identified

several radioactive materials (including Americium-241 and Cesium-137) 

as materials at higher risk of being used in an RDD, describing these as 

“materials of greatest concern.”5

In its risk-based approach to securing radioactive sources, NRC has made 

a commitment to work toward implementing the provisions of IAEA’s 

Code of Conduct. This document provides a framework that categorizes

the relative risk associated with radioactive sources.6 While NRC has 

recently focused on upgrading its capacity to track, monitor, and secure 

category 1 and 2 sources, which are considered high risk, category 3 

sources are not a primary focus of NRC regulatory efforts. Category 3 

sources include byproduct material, which is radioactive material 

generated by a nuclear reactor, and can be found in equipment that has 

medical, academic, and industrial applications. For example, a standard 

type of moisture gauge used by many construction companies contains 

small amounts of Americium-241 and Cesium-137. According to NRC, it 

would take 16 curies of Americium-241 to constitute a high-risk category 2 

quantity, and 1.6 curies of Americium-241 is considered a category 3 

quantity. 

In October and November 2006, using fictitious names, our investigators 

created two bogus companies—one in an agreement state and one in a 

non-agreement state. After the bogus businesses were incorporated, our 

investigators prepared and submitted applications for a byproduct 

materials license to both NRC and the department of the environment for 

the selected agreement state. The applications, mailed in February 2007,

Results of 

Investigation 

 5

The DOE/NRC Interagency Working Group on Radiological Dispersal Devices, 

Radiological Dispersal Devices: An Initial Study to Identify Radioactive Materials of 

Greatest Concern and Approaches to Their Tracking, Tagging, and Disposition 

(Washington, D.C.: 2003). 

6

NRC has endorsed the IAEA Code of Conduct and is working toward the implementation 

of its various provisions. On November 8, 2006, NRC issued a rule to require licensees to 

report information on the manufacture, transfer, receipt, disassembly, and disposal of all 

category 1 and 2 sources throughout their entire life cycle in the National Source Tracking 

System (NSTS). NRC’s latest estimate is that the NSTS will be operational in May 2008.

NRC told us that it has plans to consider including category 3 sources in the NSTS after the 

system becomes operational. 

Page 4 GAO-07-1038T 
were identical except for minor differences resulting from variations in the

application forms. Using fictitious identities, one investigator represented 

himself as the company president in the applications, and another 

investigator represented himself as the radiation safety officer. The license 

applications stated that our company intended to purchase machines with 

sealed radioactive sources. 

According to NRC guidance finalized in November 2006 and sent to 

agreement states in December 2006, both NRC and agreement state license 

examiners should consider 12 screening criteria to verify that radioactive 

materials will be used as intended by a new applicant.7

 For example, one 

criterion suggests that the license examiner perform an Internet search 

using common search engines to confirm that an applicant company 

appears to be a legitimate business that would require a specific license.

Another screening technique calls for the license examiner to contact a 

state agency to confirm that the applicant has been registered as a 

legitimate business entity in that state. If the examiner believes there is no

reason to be suspicious, he or she is not required to take the steps 

suggested in the screening criteria and may indicate “no” or “not 

applicable” for each criteria. If the license examiner takes additional steps 

to evaluate a criterion, he or she should indicate what publicly available 

information was considered. If there is concern for a potential security 

risk, the guidance instructs license examiners to note the basis for that 

concern. 

Application to NRC Nine days after mailing their application form to NRC, our investigators 

received a call from an NRC license examiner. The NRC license examiner

stated that the application was deficient in some areas and explained the

necessary corrections. For example, the license examiner asked our 

investigators to certify that the machines containing sealed radioactive 

source material, which are typically used at construction sites, would be 

returned to the company office before being transported to a new 

construction site. The license examiner explained that this was a standard 

security precaution. Even though we did not have a company office or a 

construction site, our investigators nevertheless certified their intent to 

bring the machines back to their office before sending them to a new 

location. They made this certification via a letter faxed to NRC. Four days 

 7

Nuclear Regulatory Commission, Checklist to Ensure that Radioactive Materials Will Be

Used As Intended, NUREG-1556, Vol. 20, C (Washington, D.C.: Nov. 2006). 

Page 5 GAO-07-1038T 
after our final correction to the license application, NRC approved our 

application and mailed the license to the bogus business in the nonagreement state. It took a total of 4 weeks to obtain the license. See figure 

1 for the first page of the transmittal letter we received from NRC with our 

license. 

Figure 1: Excerpt from NRC License Acceptance Letter for Bogus Business 

The NRC license is printed on standard 8-1/2 x 11 inch paper and contains 

a color NRC seal for a watermark. It does not appear to have any features

that would prevent physical counterfeiting. We therefore concluded that 

we could alter the license without raising the suspicion of a supplier. We 

altered the license so that it appeared our bogus company could purchase 

an unrestricted quantity of sealed source materials rather than the small 

amounts of Americium-241 and Cesium-137 listed on the original license. 

We determined the proper language for the license by reviewing publicly

available information. 

Next, we contacted two U.S. suppliers of the machines specified in our 

license. We requested price quotes and faxed the altered license to the 

suppliers as proof that we were certified to purchase the machines. Both 

suppliers offered to sell us the machines and provided us price quotes. 

One of these suppliers offered to provide twice as many machines as we 

requested and offered a discount for volume purchases. In a later 

telephone call to one of the suppliers, a representative of the supplier told 

us that his company does not check with NRC to confirm the terms listed 

on the licenses that potential customers fax them. He said that his 

company checks to see whether a copy of the front page of the license is 

faxed with the intent to purchase and whether the requested order 

Page 6 GAO-07-1038T 
exceeds the maximum allowable quantity a licensee is allowed to possess 

at any one time. 

Although we had no legitimate use for the machines, our investigators 

received, within days of obtaining a license from NRC, price quotes and 

terms of payment that would have allowed us to purchase numerous 

machines containing sealed radioactive source materials. These purchases

would have substantially exceeded the limit that NRC approved for our 

bogus company. If these radioactive materials were unsealed and 

aggregated together, the machines would yield an amount of 

Americium-241 that exceeds the threshold for category 3 materials. 

As discussed previously, according to IAEA, category 3 sources are 

dangerous if not safely managed or securely protected and “could cause 

permanent injury to a person who handled them, or was otherwise in 

contact with them, for some hours. It could possibly—although it is 

unlikely—be fatal to be close to this amount of unshielded radioactive 

material for a period of days to weeks.” Importantly, with patience and the

proper financial resources, we could have accumulated, from other 

suppliers, substantially more radioactive source material than what the 

two suppliers initially agreed to ship to us—potentially enough to reach 

category 2. According to IAEA, category 2 sources, if not safely managed 

or securely protected, “could cause permanent injury to a person for a 

short time (minutes to hours), and it could possibly be fatal to be close to 

this amount of unshielded material for a period of hours to days.” 

Application to the 

Agreement State 

Ten days after mailing their application form to the agreement state’s 

department of environment, our investigators received a call from a 

department license examiner. The license examiner stated that the 

application was deficient in some areas and said that she would send us a 

letter outlining what additional information the state required before 

approving the license. The examiner further stated that before the license

was granted, she would conduct a site visit to inspect the company office 

and storage facilities cited in our application. Our investigators 

subsequently decided not to pursue the license in this state and requested 

that their application be withdrawn. According to an official in the 

department of environment for this state, the license examiner followed 

the required state procedure in requesting a site visit. The official told us 

that as a matter of long-standing state policy, license examiners in this 

state conduct site visits and interview company management (especially 

radiation safety officers) before granting new licenses for radioactive 

materials. This state policy is more stringent than the guidance NRC 

Page 7 GAO-07-1038T 
provided agreement states in December 2006. The NRC guidance identified

a site visit as one possible screening criterion to use in evaluating a new 

license application, but, as discussed above, a site visit is not required 

under the NRC guidance. 

On June 1, 2007, we contacted NRC and discussed the results of our work. 

An NRC official indicated that NRC would take immediate action to 

address the weaknesses we identified. After this meeting, we learned that

NRC suspended its licensing program for specific licenses until it could 

determine what corrective actions were necessary to resolve the 

weaknesses. NRC also held a teleconference with a majority of the 34 

agreement states to discuss our work. On June 12, 2007, NRC issued 

supplemental interim guidance with additional screening criteria. These 

criteria are intended to help a license examiner determine whether a site 

visit or face-to-face meeting with new license applicants is required. NRC 

told us that it planned to convene a working group to develop improved 

guidance addressing the weaknesses we identified. 

NRC’s goal is to provide licenses to only those entities that can 

demonstrate that they have legitimate uses for radioactive materials. 

However, our work shows that there continues to be weaknesses in the 

process NRC uses to approve license applications. In our view, a routine 

visit by NRC staff to the site of our bogus business would have been 

enough to reveal our lack of facilities and equipment. Furthermore, if NRC 

license examiners had conducted even a minimal amount of screening—

such as performing common Web searches or making telephone calls to 

local government or business offices—they would have developed serious 

doubts about our application. Once we received our license, the ease with

which we were able to alter the license and obtain price quotes and 

commitments to ship from suppliers of radioactive materials is also cause 

for concern. Accordingly, we are making the following three 

recommendations to the Chairman of the NRC: 

Corrective Action 

Briefing 

Conclusions and 

Recommendations for 

Executive Action 

• First, to avoid inadvertently allowing a malevolent individual or group 

to obtain a license for radioactive materials, NRC should develop 

improved guidance for examining NRC license applications. In 

developing improved screening criteria, NRC should consider whether 

site visits to new licensees should be mandatory. These improved 

screening criteria will allow NRC to provide reasonable assurance that 

licenses for radioactive materials will only be issued to those with 

legitimate uses. 

Page 8 GAO-07-1038T 
• Second, NRC should conduct periodic oversight of license application 

examiners so that NRC will be assured that any new guidance is being 

appropriately applied.

• Third, NRC should explore options to prevent individuals from 

counterfeiting NRC licenses, especially if this allows the purchase of 

more radioactive materials than they are approved for under the terms 

of the original license. 

Mr. Chairman, this concludes our statement. We would be pleased to 

answer any questions that you or other Members of the Subcommittee 

may have at this time. 

For further information about this testimony, please contact Gregory D. 

Kutz at (202) 512-7455 or kutzg@gao.gov or Gene Aloise at (202) 512-3841

or aloisee@gao.gov. Contacts points for our Offices of Congressional 

Relations and Public Affairs may be found on the last page of this 

testimony. 

Contacts and 

Acknowledgments 

Page 9 GAO-07-1038T (192228) 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER