Nuclear Security: Actions Taken by NRC to Strengthen Its Licensing Process for Sealed Radioactive Sources Are Not Effective
Published: 2007-07-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Nuclear Regulatory Commission (NRC) regulates domestic medical, industrial, and research uses of sealed radioactive sources. Organizations or individuals attempting to purchase a sealed source must apply for a license and gain the approval of either NRC or an "agreement state." To become an agreement state, a state must demonstrate to NRC that its regulatory program is compatible with NRC regulations and is effective in protecting public health and safety. NRC then transfers portions of its authority to the agreement state. In 2003, GAO reported that weaknesses in NRC's licensing program could allow terrorists to obtain radioactive materials. NRC took some steps to respond to the GAO report, including issuing guidance to license examiners. To determine whether NRC actions to address GAO recommendations were sufficient, the Subcommittee asked GAO to test the licensing program using covert investigative methods.
section_title: What GAO Found
paragraphs: By using the name of a bogus business that existed only on paper, GAO investigators were able to obtain a genuine radioactive materials license from NRC. Aside from traveling to a non-agreement state to pick up and send mail, GAO investigators did not need to leave their office in Washington, D.C., to obtain the license from NRC. Further, other than obtaining radiation safety officer training, investigators gathered all the information they needed for the license from the NRC Web site. After obtaining a license from NRC, GAO investigators altered the license so it appeared that the bogus company could purchase an unrestricted quantity of radioactive sealed sources rather than the maximum listed on the approved license. GAO then sought to purchase, from two U.S. suppliers, machines containing sealed radioactive material. Letters of intent to purchase, which included the altered NRC license as an attachment, were accepted by the two suppliers. These suppliers gave GAO price quotes and commitments to ship the machines containing radioactive materials. The amount of radioactive material we could have acquired from these two suppliers was sufficient to reach the International Atomic Energy Agency's (IAEA) definition of category 3. According to IAEA, category 3 sources are dangerous if not safely managed or securely protected. Importantly, with patience and the proper financial resources, we could have accumulated substantially more radioactive source material. GAO also attempted to obtain a license from an agreement state, but withdrew the application after state license examiners indicated they would visit the bogus company office before granting the license. An official with the licensing program told GAO that conducting a site visit is a standard required procedure before radioactive materials license applications are approved in that state. As a result of this investigation, NRC suspended its licensing program until it could determine what corrective actions were necessary to resolve the weaknesses GAO identified. On June 12, 2007, NRC issued supplemental interim guidance with additional screening criteria. These criteria are intended to help a license examiner determine whether a site visit or face-to-face meeting with new license applicants is required.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss our covert testing of the Nuclear  Regulatory Commission’s (NRC) licensing process for sealed radioactive  sources. Under the Atomic Energy Act of 1954, NRC regulates domestic  medical, industrial, and research uses of sealed radioactive sources  through a combination of regulatory requirements, licensing, inspection,  and enforcement. Organizations or individuals attempting to purchase a  sealed source must apply for a license and gain the approval of either NRC  or an “agreement state.” To become an agreement state, a state must first  demonstrate to NRC that its regulatory program is compatible with NRC  regulations and is effective in protecting public health and safety. Through  an agreement between NRC and the state governor, NRC then transfers  portions of its regulatory and licensing authority to the state. According to  NRC, there are approximately 22,000 licenses in the United States—NRC  administers about 4,400 licenses, and the rest are administered by  regulatory authorities in the 34 agreement states.
Given that terrorists have expressed an interest in obtaining nuclear  material, the Congress and the American people expect licensing  programs for these materials to be secure. However, in 2003, we reported  that weaknesses in the licensing program could allow terrorists to obtain  radioactive materials. We recommended that NRC close this vulnerability  by modifying its licensing process. Among other things, we recommended  that “NRC modify its process for issuing specific licenses to ensure that  sealed radioactive sources cannot be purchased before NRC’s  verification—through inspection or other means—that the materials will  be used as intended.” NRC agreed with this recommendation and referred  the issue to a working group composed of NRC and state representatives  to coordinate NRC’s response. In December 2005, the working group  delivered its recommendations to NRC senior management. In December  2006, NRC issued new guidance to agreement states and NRC regional  offices meant to strengthen the radioactive materials licensing process.  Although these are important steps forward, the Subcommittee remained  concerned about whether, almost 6 years after September 11, 2001,  terrorists could still exploit weaknesses in the government’s licensing  process and obtain radioactive material. To determine whether NRC  actions to address our 2003 recommendations were sufficient, the  Subcommittee asked us to use covert investigative methods to test the  licensing program.
To perform this investigation, we incorporated two bogus businesses— one in a non-agreement state and one in an agreement state. We selected  these two states based on their proximity to the Washington, D.C., metro  area. Using the names of the bogus businesses, we then prepared and  submitted one application for a byproduct materials license to NRC and a  second application to the department of the environment of the agreement  state. In creating these applications, we only used publicly available  information. Our investigators did not actually purchase radioactive  materials for several reasons—first, the primary intent of our work was to  test the licensing process rather than the purchasing process; second, we  did not think the cost borne by the government would be necessary to  prove the point of our work; and third, we did not have the proper  facilities to safely store the radioactive materials. In performing research  for this work, we reviewed our previous reports on nuclear security and  learned about the licensing process from NRC’s Web site. We altered the  license we received from NRC, which enabled us to obtain agreements to  purchase more radioactive material than the original license permitted. We  conducted our investigative work from October 2006 through June 2007 in  accordance with standards prescribed by the President’s Council on  Integrity and Efficiency.
In summary, we found the following:    The license application we submitted to NRC was approved. We  received a license in the mail from NRC about 4 weeks after submitting  the application. Aside from traveling to a non-agreement state to pick  up and send mail, our investigators did not need to leave their office in  Washington, D.C., to obtain the license from NRC. Further, other than  obtaining radiation safety officer training, investigators gathered all the  information they needed for the license from the NRC Web site.
After obtaining a license from NRC, we sought to purchase, from two  U.S. suppliers, machines containing sealed radioactive material. Our  letters of intent to purchase, which included an altered version of the  NRC license as an attachment, were accepted by the suppliers. These  suppliers gave us price quotes and commitments to ship the machines  containing radioactive materials. The amount of radioactive material  we could have acquired from these two suppliers was sufficient to  reach the International Atomic Energy Agency’s (IAEA) definition of  category 3. According to IAEA, category 3 sources are dangerous if not  safely managed or securely protected and “could cause permanent  injury to a person who handled them, or was otherwise in contact with  them, for some hours. It could possibly—although it is unlikely—be  fatal to be close to this amount of unshielded radioactive material for a  period of days to weeks.” Importantly, with patience and the proper  financial resources, we could have accumulated from other suppliers  substantially more radioactive source material than what the two  suppliers initially agreed to ship to us.
We withdrew our second application from the agreement state  department of the environment after license examiners indicated they  would visit our company office before granting the license. Since we  did not have a company office or the proper storage equipment, we  asked the state to withdraw our application to obtain a license in this  state. According to an official with the licensing program for this state,  the completion of a site visit is a standard procedure before the state  department of the environment approves a radioactive materials  license application.
subsections: section_title: Background
paragraphs: Since the September 11, 2001, terrorist attacks there has been concern that  certain radioactive material could be used in the construction of a  radiological dispersion device (RDD).  An RDD disperses radioactive  material over a particular target area, which could be accomplished using  explosives or by other means. The major purpose of an RDD would be to  create terror and disruption, not death or destruction. Depending on the  type, form, amount, and concentration of radioactive material used, direct  radiation exposure from an RDD could cause health effects to individuals  in proximity to the material for an extended time; for those exposed for  shorter periods and at lower levels, it could potentially increase the long- term risks of cancer. In addition, the evacuation and cleanup of  contaminated areas after dispersal could lead to panic and serious  economic costs on the affected population. In 2003, a joint  NRC/Department of Energy (DOE) interagency working group identified  several radioactive materials (including Americium-241 and Cesium-137)  as materials at higher risk of being used in an RDD, describing these as  “materials of greatest concern.”
In its risk-based approach to securing radioactive sources, NRC has made  a commitment to work toward implementing the provisions of IAEA’s  Code of Conduct. This document provides a framework that categorizes  the relative risk associated with radioactive sources. While NRC has  recently focused on upgrading its capacity to track, monitor, and secure  category 1 and 2 sources, which are considered high risk, category 3  sources are not a primary focus of NRC regulatory efforts. Category 3  sources include byproduct material, which is radioactive material  generated by a nuclear reactor, and can be found in equipment that has  medical, academic, and industrial applications. For example, a standard  type of moisture gauge used by many construction companies contains  small amounts of Americium-241 and Cesium-137. According to NRC, it  would take 16 curies of Americium-241 to constitute a high-risk category 2  quantity, and 1.6 curies of Americium-241 is considered a category 3  quantity.
section_title: Results of Investigation
paragraphs: In October and November 2006, using fictitious names, our investigators  created two bogus companies—one in an agreement state and one in a  non-agreement state. After the bogus businesses were incorporated, our  investigators prepared and submitted applications for a byproduct  materials license to both NRC and the department of the environment for  the selected agreement state. The applications, mailed in February 2007,  were identical except for minor differences resulting from variations in the  application forms. Using fictitious identities, one investigator represented  himself as the company president in the applications, and another  investigator represented himself as the radiation safety officer. The license  applications stated that our company intended to purchase machines with  sealed radioactive sources.
According to NRC guidance finalized in November 2006 and sent to  agreement states in December 2006, both NRC and agreement state license  examiners should consider 12 screening criteria to verify that radioactive  materials will be used as intended by a new applicant. For example, one  criterion suggests that the license examiner perform an Internet search  using common search engines to confirm that an applicant company  appears to be a legitimate business that would require a specific license.  Another screening technique calls for the license examiner to contact a  state agency to confirm that the applicant has been registered as a  legitimate business entity in that state. If the examiner believes there is no  reason to be suspicious, he or she is not required to take the steps  suggested in the screening criteria and may indicate “no” or “not  applicable” for each criteria. If the license examiner takes additional steps  to evaluate a criterion, he or she should indicate what publicly available  information was considered. If there is concern for a potential security  risk, the guidance instructs license examiners to note the basis for that  concern.
subsections: section_title: Application to NRC
paragraphs: Nine days after mailing their application form to NRC, our investigators  received a call from an NRC license examiner. The NRC license examiner  stated that the application was deficient in some areas and explained the  necessary corrections. For example, the license examiner asked our  investigators to certify that the machines containing sealed radioactive  source material, which are typically used at construction sites, would be  returned to the company office before being transported to a new  construction site. The license examiner explained that this was a standard  security precaution. Even though we did not have a company office or a  construction site, our investigators nevertheless certified their intent to  bring the machines back to their office before sending them to a new  location. They made this certification via a letter faxed to NRC. Four days  after our final correction to the license application, NRC approved our  application and mailed the license to the bogus business in the non- agreement state. It took a total of 4 weeks to obtain the license. See figure  1 for the first page of the transmittal letter we received from NRC with our  license.
The NRC license is printed on standard 8-1/2 x 11 inch paper and contains  a color NRC seal for a watermark. It does not appear to have any features  that would prevent physical counterfeiting. We therefore concluded that  we could alter the license without raising the suspicion of a supplier. We  altered the license so that it appeared our bogus company could purchase  an unrestricted quantity of sealed source materials rather than the small  amounts of Americium-241 and Cesium-137 listed on the original license.  We determined the proper language for the license by reviewing publicly  available information.
Next, we contacted two U.S. suppliers of the machines specified in our  license. We requested price quotes and faxed the altered license to the  suppliers as proof that we were certified to purchase the machines. Both  suppliers offered to sell us the machines and provided us price quotes.   One of these suppliers offered to provide twice as many machines as we  requested and offered a discount for volume purchases. In a later  telephone call to one of the suppliers, a representative of the supplier told  us that his company does not check with NRC to confirm the terms listed  on the licenses that potential customers fax them. He said that his  company checks to see whether a copy of the front page of the license is  faxed with the intent to purchase and whether the requested order  exceeds the maximum allowable quantity a licensee is allowed to possess  at any one time.
Although we had no legitimate use for the machines, our investigators  received, within days of obtaining a license from NRC, price quotes and  terms of payment that would have allowed us to purchase numerous  machines containing sealed radioactive source materials. These purchases  would have substantially exceeded the limit that NRC approved for our  bogus company. If these radioactive materials were unsealed and  aggregated together, the machines would yield an amount of       Americium-241 that exceeds the threshold for category 3 materials.
As discussed previously, according to IAEA, category 3 sources are  dangerous if not safely managed or securely protected and “could cause  permanent injury to a person who handled them, or was otherwise in  contact with them, for some hours. It could possibly—although it is  unlikely—be fatal to be close to this amount of unshielded radioactive  material for a period of days to weeks.” Importantly, with patience and the  proper financial resources, we could have accumulated, from other  suppliers, substantially more radioactive source material than what the  two suppliers initially agreed to ship to us—potentially enough to reach  category 2. According to IAEA, category 2 sources, if not safely managed  or securely protected, “could cause permanent injury to a person for a  short time (minutes to hours), and it could possibly be fatal to be close to  this amount of unshielded material for a period of hours to days.”
section_title: Application to the Agreement State
paragraphs: Ten days after mailing their application form to the agreement state’s  department of environment, our investigators received a call from a  department license examiner. The license examiner stated that the  application was deficient in some areas and said that she would send us a  letter outlining what additional information the state required before  approving the license. The examiner further stated that before the license  was granted, she would conduct a site visit to inspect the company office  and storage facilities cited in our application. Our investigators  subsequently decided not to pursue the license in this state and requested  that their application be withdrawn. According to an official in the  department of environment for this state, the license examiner followed  the required state procedure in requesting a site visit. The official told us  that as a matter of long-standing state policy, license examiners in this  state conduct site visits and interview company management (especially  radiation safety officers) before granting new licenses for radioactive  materials. This state policy is more stringent than the guidance NRC  provided agreement states in December 2006. The NRC guidance identified  a site visit as one possible screening criterion to use in evaluating a new  license application, but, as discussed above, a site visit is not required  under the NRC guidance.
section_title: Corrective Action Briefing
paragraphs: On June 1, 2007, we contacted NRC and discussed the results of our work.  An NRC official indicated that NRC would take immediate action to  address the weaknesses we identified. After this meeting, we learned that  NRC suspended its licensing program for specific licenses until it could  determine what corrective actions were necessary to resolve the  weaknesses. NRC also held a teleconference with a majority of the 34  agreement states to discuss our work. On June 12, 2007, NRC issued  supplemental interim guidance with additional screening criteria. These  criteria are intended to help a license examiner determine whether a site  visit or face-to-face meeting with new license applicants is required. NRC  told us that it planned to convene a working group to develop improved  guidance addressing the weaknesses we identified.
section_title: Conclusions and Recommendations for Executive Action
paragraphs: NRC’s goal is to provide licenses to only those entities that can  demonstrate that they have legitimate uses for radioactive materials.  However, our work shows that there continues to be weaknesses in the  process NRC uses to approve license applications. In our view, a routine  visit by NRC staff to the site of our bogus business would have been  enough to reveal our lack of facilities and equipment. Furthermore, if NRC  license examiners had conducted even a minimal amount of screening— such as performing common Web searches or making telephone calls to  local government or business offices—they would have developed serious  doubts about our application. Once we received our license, the ease with  which we were able to alter the license and obtain price quotes and  commitments to ship from suppliers of radioactive materials is also cause  for concern. Accordingly, we are making the following three  recommendations to the Chairman of the NRC:    First, to avoid inadvertently allowing a malevolent individual or group  to obtain a license for radioactive materials, NRC should develop  improved guidance for examining NRC license applications. In  developing improved screening criteria, NRC should consider whether  site visits to new licensees should be mandatory. These improved  screening criteria will allow NRC to provide reasonable assurance that  licenses for radioactive materials will only be issued to those with  legitimate uses.
Second, NRC should conduct periodic oversight of license application  examiners so that NRC will be assured that any new guidance is being  appropriately applied.
Third, NRC should explore options to prevent individuals from  counterfeiting NRC licenses, especially if this allows the purchase of  more radioactive materials than they are approved for under the terms  of the original license.
Mr. Chairman, this concludes our statement. We would be pleased to  answer any questions that you or other Members of the Subcommittee  may have at this time.
section_title: Contacts and Acknowledgments
paragraphs: For further information about this testimony, please contact Gregory D.  Kutz at (202) 512-7455 or kutzg@gao.gov or Gene Aloise at (202) 512-3841  or aloisee@gao.gov. Contacts points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  testimony.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.