Nuclear Nonproliferation: Further Actions Needed by U.S. Agencies to Secure Vulnerable Nuclear and Radiological Materials
Published: 2012-03-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In 2009, President Obama announced an international initiative to secure all vulnerable nuclear material worldwide within 4 years. Leaders of 47 nations endorsed this effort at the 2010 Nuclear Security Summit and will meet again in March 2012 to evaluate their work and set new goals for nuclear security. The United States has been a leader in promoting nuclear nonproliferation efforts worldwide. GAO has issued numerous reports on U.S. nonproliferation programs administered by several agencies, including the departments of Energy (DOE), State, and Defense (DOD); and the Nuclear Regulatory Commission (NRC). This testimony, which is based primarily on previously issued reports, discusses (1) the U.S. strategy to secure all vulnerable nuclear material within 4 years, (2) U.S. agencies ability to track and evaluate the security of U.S. nuclear materials transferred to foreign countries, (3) challenges coordinating federal nuclear nonproliferation efforts, and (4) preliminary observations regarding GAOs ongoing work on federal efforts to secure radiological sources in U.S. hospitals and medical facilities. To conduct its ongoing work, GAO visited 25 hospitals and medical facilities in 7 states and the District of Columbia.
GAO is making no new recommendations, but continues to believe that implementation of the recommendations made in its recent reports complements and supports the administrations goal of securing vulnerable nuclear material in a timely fashion.
section_title: What GAO Found
paragraphs: The Presidents 4-year initiative is a worthwhile effort designed to accelerate U.S. and international efforts to secure nuclear material worldwide. However, as GAO reported in December 2010, the governmentwide strategy approved by the National Security Council (NSC) for the initiative lacked specific details regarding how the initiative will be implemented. As a result, key details associated with the initiative are unclear, including its overall estimated cost, time frame for completion of work, and scope of planned work. In its 2010 report, GAO recommended, among other things, that NSC lead the interagency development of a more detailed implementation plan for the Presidents 4-year initiative. NSC did not comment on GAOs recommendations.
The United States also faces challenges accounting for and evaluating the security of U.S. nuclear material overseas. As GAO reported in September 2011, federal agencies are not able to fully account for U.S. nuclear material overseas that is subject to nuclear cooperation agreements. GAO also found that the agreements do not contain specific access rights that enable agencies to monitor and evaluate the physical security of U.S. nuclear material overseas. GAO found that the agencies responsible for reviewing foreign partners security are not doing so systematically. GAO suggested that Congress consider directing DOE and NRC to fully account for U.S. weapon-usable nuclear materials overseas and consider amending the Atomic Energy Act to require access rights allowing the United States to verify adequate protection of U.S. nuclear materials if future agreements cannot be negotiated to include such rights.
GAO also reported in December 2011 on the challenges in coordinating U.S. governmentwide nonproliferation efforts. Specifically, GAO identified potential fragmentation and overlap among some U.S. programs that played a role in preventing and detecting the smuggling of nuclear materials overseas. GAO also found that no single federal agency had the lead responsibility to direct these efforts. GAO recommended, among other things, that NSC review U.S. programs working to prevent nuclear smuggling overseas to reduce fragmentation and potential overlap. NSC declined to comment on the recommendations.
In addition to nuclear materials, the Summit plans to address the security of radiological sourcesmaterial that could be used to make a dirty bomb. Based on preliminary results from ongoing work on federal efforts to secure radiological sources in U.S. hospitals and medical facilities, GAO found that NRCs security controls for hospitals and medical facilities do not prescribe the specific steps that must be taken to protect their radiological sources. GAO also found that medical facilities have implemented the controls in various ways. This has created a mix of security measures at the locations GAO visited that could leave some facilities more vulnerable than others. DOEs National Nuclear Security Administration (NNSA) has established a voluntary program to upgrade the security of domestic facilities that have radiological sources. NNSA has made progress in securing domestic radiological sources, but some facilities have declined NNSAs assistance, including hospitals located in high-risk urban areas.

section_title: Letter
paragraphs: I am pleased to participate in this hearing in advance of the Nuclear  Security Summit in South Korea. As you know, in 2009, President Obama  announced an international initiative to secure all vulnerable nuclear  materials around the world within 4 years, and leaders of 47 nations  endorsed this initiative at the 2010 Nuclear Security Summit here in  Washington. The leaders pledged to work together toward this end and  also reaffirmed the fundamental responsibility of nations to maintain  effective security of the nuclear materials and facilities under their control.  At the conclusion of the summit, the leaders agreed to meet again in  South Korea in March 2012 to evaluate their work and set new goals for  nuclear security, including the security of radiological material. We  recognize the importance of the Summit as a way to galvanize  international support for reducing the risks posed by the proliferation of  these dangerous materials and are pleased to see that radiological  material security will be given greater attention. This could provide a more  comprehensive and balanced approach to risk reduction efforts by the  international community.
One of the most serious threats facing the United States and other  countries is the possibility that other nations or terrorist organizations  could steal a nuclear warhead or nuclear weapon-usable materials from  poorly secured stockpiles around the world, or that nations could divert  nuclear material intended for peaceful purposes to the development of  nuclear weapons. Terrorists or countries seeking nuclear weapons could  use as little as 25 kilograms (Kg) of weapon-grade highly enriched  uranium (HEU) or 8 Kg of plutonium to construct a nuclear weapon. Of  great concern is that terrorists could fashion a crude nuclear bomb made  from either HEU or plutonium into an improvised nuclear device (IND). An  IND would create an explosion producing extreme heat, powerful  shockwaves and intense radiation that would be immediately lethal to  individuals within miles of the explosion, as well as radioactive fallout over  thousands of square miles. Nonproliferation experts estimate that a  successful IND could produce the same force as the equivalent yield of  the bomb that destroyed Nagasaki, Japan, in 1945; it could devastate the  heart of a medium-sized U.S. city. The explosion could cause hundreds of  thousands of deaths and injuries, as well as pose long-term cancer risks  to those exposed to the radioactive fallout.
Radiological material also poses a significant security threat to the United  States and the international community. Radiological material, such as  cobalt-60, cesium-137, and strontium-90, is encapsulated or sealed in  metal—such as stainless steel, titanium, or platinum—to prevent its  dispersal and is commonly called a sealed radiological source. Sealed  radiological sources are used worldwide for many legitimate purposes,  such as medical, industrial, and agricultural applications. The total  number of these sources in use worldwide is unknown because many  countries do not systematically account for them. If certain types of these  sources were obtained by terrorists, they could be used to produce a  simple and crude but potentially dangerous weapon—known as a  radiological dispersion device, or dirty bomb. Although experts believe  that a dirty bomb could result in a limited number of deaths, it could have  severe economic consequences. Depending on the type, amount, and  form, the dispersed radiological material could cause radiation sickness  for people nearby and produce serious economic, psychological and  social disruption associated with the evacuation and subsequent cleanup  of the contaminated area. The economic consequences resulting from the  improper use of radiological materials is not theoretical. Some actual  incidents involving sources can provide a measure of understanding of  what could happen in the case of a dirty bomb attack. For example, in  1987, an accident involving a medical device containing about 1,400  curies of cesium-137, killed four people in Brazil’s Goiania region and  injured many more. The accident and its aftermath caused about $36  million in damages to the region. The decontamination process required  the demolition of homes and other buildings and generated 3,500 cubic  meters of radioactive waste. becquerels.
National Nuclear Security Administration (NNSA), a separately organized  agency within the Department of Energy (DOE) has more than 20  programs that are intended to, among other things, secure nuclear  warheads; reduce the risk of nuclear smuggling; and protect, consolidate,  and dispose of weapon-usable nuclear material and radiological sources.  The two other U.S. agencies that conduct major nuclear nonproliferation  programs and activities overseas are the departments of Defense (DOD)  and State. DOD administers the Cooperative Threat Reduction program,  which has facilitated the removal of nuclear weapons from Ukraine,  Belarus, and Kazakhstan and has helped Russia and Ukraine meet their  arms control commitments by assisting in the elimination of strategic  delivery systems. State manages its own nonproliferation programs, such  as the Export Control and Related Border Security program, provides  support to NNSA and other U.S. agencies’ nuclear nonproliferation  programs working overseas, and conducts bilateral and multilateral  diplomacy to address proliferation threats around the world under its  Bureau of International Security and Nonproliferation. The Department of  Homeland Security is responsible for, among other things, developing  and deploying technologies to detect, prevent and interdict nuclear  materials smuggled into the United States. National Security Council  (NSC) staff have the principal role in coordinating the implementation of  NNSA, DOD, State, and other agencies’ nonproliferation programs. NSC  oversees development of general policy and establishes guidelines for  U.S. nonproliferation programs, but it does not implement programs or  control their budgets. In addition, the Nuclear Regulatory Commission  (NRC) and NNSA are involved in regulating and/or securing radiological  sources within the United States and in foreign countries.
My statement today is based primarily on reports we issued from  September 2010 to December 2011 that assess various U.S. nuclear  nonproliferation programs and activities that support both the President’s  4-year initiative and, more broadly, the goals of the Summit. Specifically,   I will focus my testimony on (1) the U.S. governmentwide strategy for  supporting the President’s goal of securing all vulnerable nuclear  materials worldwide within 4 years, (2) U.S. agencies’ ability to track and  evaluate the security of U.S. nuclear materials transferred to foreign  countries, (3) challenges in coordinating federal nuclear nonproliferation  efforts, and (4) ongoing work on federal efforts to secure radiological  sources in U.S. hospitals and medical facilities. Detailed information on  our scope and methodology for our prior work can be found in these  reports. To develop our preliminary observations on efforts to secure  radiological sources in U.S. medical facilities, we visited 25 hospitals and  medical facilities in seven states and the District of Columbia, interviewed  regulatory officials from 20 states, and interviewed agency officials at  DOD, DOE, NRC, and the Department of Veterans Affairs (VA). We also  reviewed relevant laws, regulations, and guidance for overseeing  commercial radiological sources. We are conducting our ongoing work in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
We obtained the views of DOE, DOD, VA and NRC for new information in  our statement concerning radiological source security at U.S. hospitals  and medical facilities. We incorporated the agencies’ technical comments  where appropriate.
subsections: section_title: Background
paragraphs: The 2010 Nuclear Security Summit highlighted the global threat posed by  nuclear terrorism and the need for countries to work in a comprehensive  and concerted fashion to ensure that nuclear materials are not stolen or  diverted for weapons use. The Summit produced a communiqué, a high- level political statement by the leaders of the 47 participating countries.  The communiqué identified several measures that countries planned to  take to strengthen their nonproliferation efforts. These efforts included,  among other things, (1) focusing on improving security; (2) accounting for  and consolidating HEU and plutonium; and (3) ensuring that the  International Atomic Energy Agency (IAEA) has the necessary resources  to carry out its nuclear security activities.
The 2010 Summit produced results. For example, Ukraine announced at  the Summit that it would ship approximately 236 pounds of HEU and 123  pounds of spent nuclear fuel to Russia by the end of 2012. During the  Summit, the United States, Canada, and Mexico announced a new  agreement that calls for the conversion of HEU fuel at Mexico’s nuclear  research reactor to low enriched uranium. Malaysia, Egypt, and Armenia  planned to enact new export control laws to limit nuclear trafficking.  Malaysia, an important hub in the A.Q. Khan illicit nuclear trafficking  network, approved a new export law curbing transfers of nuclear  weapons-related materials. Many other nations expressed their support to  funding efforts for international nuclear safety organizations. For example,  Belgium, Japan, the United Kingdom, Norway, and New Zealand all  pledged funding efforts towards IAEA’s Nuclear Security Fund.
section_title: Governmentwide Strategy to Implement the President’s 4-Year Global Nuclear Material Security Initiative Lacked Important Details
paragraphs: In December 2010, we reported on aspects of U.S. planning and  strategies to secure all vulnerable nuclear materials worldwide within a 4- year period. Following President Obama’s announcement of the 4-year  initiative, NSC took the lead in coordinating efforts among different federal  agencies that will contribute to the initiative. NSC officials approved a  U.S. governmentwide strategy entitled “Interagency Efforts to Improve the  Security of Nuclear Weapons and Fissile Materials,” which, among other  things, described the scope and objectives of the interagency effort and  identified the main activities by agencies and programs in support of the  President’s initiative. U.S. agencies—including NNSA, DOD, and State— had identified individual plans describing how they intend to contribute to  the 4-year initiative. NNSA, for example, had developed a formal written  plan with specific details regarding how it intends to contribute to the 4- year nuclear material security goal. The NNSA plan details a prioritized  five-part effort, including (1) continuing nuclear security cooperation,  especially nuclear material protection, control and accounting (MPC&A)  upgrades and efforts to transition responsibility for sustaining MPC&A  systems; (2) expanding nuclear security cooperation with other  countries; (3) accelerating nuclear material removal with other countries;  (4) strengthening nuclear security standards, practices, and next- generation nuclear safeguards; and (5) building international capabilities  to prevent illicit nuclear trafficking and smuggling.
Despite individual agency efforts to implement the 4-year initiative, we  found that the overarching interagency strategy coordinated by NSC  lacked specific details concerning how the initiative would be  implemented, including the identity of, and details regarding, vulnerable  foreign nuclear material sites and facilities to be addressed, agencies and  programs responsible for addressing each site, planned activities at each  site, potential challenges and strategies for overcoming these challenges,  anticipated timelines, and cost estimates. NSC officials told us that  developing a single, integrated cross-agency plan that incorporates all  these elements could take years. However, we found that, absent such  an implementation plan, essential details associated with the 4-year  initiative were unclear, including the initiative’s overall estimated costs,  time frames, and scope of work. For instance, we reported that the costs  of implementing the initiative were unknown. Among other things, NSC  officials told us that estimating the costs associated with the President’s  goal is impossible because the initiative is predicated on having other  countries provide assistance and share costs, and it is impossible to  forecast cooperation that may occur with other countries, including the  resumption of denuclearization efforts in North Korea.
We also found that the time frames for the initiative are uncertain because  NSC officials did not consider the 4-year time frame to be a hard and fast  deadline. Rather than achieving a specific level of nuclear material  security around the world within the 4-year time frame, the President’s  proposal has value in broader terms, according to NSC officials. They  described the value of the President’s proposal as a “forcing function” to  (1) accelerate ongoing U.S. nuclear nonproliferation programs, (2) drive  closer integration of nuclear nonproliferation programs across the federal  government, and (3) mobilize greater international responsibility for and  commitment to nuclear material security. Furthermore, we reported that  other details relating to the overall scope of the 4-year initiative were  vague. For example, we were unable to identify the scope of nuclear  material worldwide that would be addressed under the initiative, because  such details were not included in the interagency strategy document. We  also identified concerns with how the initiative intends to address sites  with potentially vulnerable nuclear materials located in countries that may  impose access limitations that could complicate or preclude U.S. security  assistance.
We recommended that NSC lead and coordinate the development of a  comprehensive plan for implementing this initiative. Such a plan, in our  view, should clearly identify the specific foreign countries, sites, and  facilities, where materials have been determined to be poorly secured,  and include information specifying the agencies and programs  responsible for addressing each location; planned activities, potential  implementation challenges, and steps needed to overcome those  challenges at each location; and estimated time frames and costs  associated with achieving the 4-year goal. NSC did not comment on our  recommendation.
section_title: U.S. Agencies Have Limited Ability to Account for, Monitor, and Evaluate the Security of U.S. Nuclear Material Overseas
paragraphs: Improving the U.S. government’s management of nuclear cooperation  agreements could contribute to the administration achieving its goal of  securing all vulnerable nuclear material worldwide in 4 years.
The United States has 27 nuclear cooperation agreements in force for peaceful civilian  cooperation with partners, including foreign countries, the European Atomic Energy  Community (EURATOM), IAEA, and Taiwan. Governmental relations between the United  States and Taiwan were terminated on January 1, 1979. All agreements concluded with  the authorities on Taiwan prior to January 1, 1979, are administered for the United States  by the American Institute in Taiwan, a nonprofit corporation based in Washington, D.C.  The United States has two nuclear cooperation agreements with Australia, including one  for Separation of Uranium Isotopes by Laser Excitation technology, bringing the total  number of agreements to 27. response to a 1992 congressional mandate.that NRC produced in response to the mandate stated that it was not  possible to reconcile this information from available U.S. sources of data  with all foreign holders of U.S. HEU within the 90-day period specified in  the act. Our analysis of other documentation associated with the report  shows that NRC, in consultation with U.S. agencies, was able to verify the  location of 1,160 kilograms out of 17,500 kilograms of U.S. HEU  remaining overseas as of January 1993. According to DOE and NRC  officials, no further update to the 1993 report was issued, and the U.S.  government has not subsequently attempted to develop such a  comprehensive estimate of the location and status of U.S. HEU overseas.
Nuclear cooperation agreements do not contain specific access rights  that enable U.S. agencies to monitor and evaluate the physical security of  U.S. nuclear material overseas, and the United States relies on its  partners to maintain adequate security. In the absence of access rights,  DOE, NRC, and State have conducted physical protection visits, when  permitted, to monitor and evaluate physical security conditions of U.S.  nuclear materials at overseas facilities. However, we found that the  agencies have not systematically visited countries believed to be holding  the most sensitive material or systematically revisited facilities not  meeting international physical security standards in a timely manner. U.S.  interagency teams made 55 visits from 1994 through 2010 and found that  countries met IAEA security guidelines approximately half of the time.
There are several countries that have U.S. nuclear material that are  particularly problematic and represent special cases for concern.  Specifically, U.S. nuclear material has remained at sites in three countries  where physical protection measures are unknown or the sites have not  been visited by an interagency physical protection team in decades.  DOE’s Global Threat Reduction Initiative (GTRI) removed a large quantity  of U.S.-spent HEU recently from one of those countries. However,  according to NRC and State officials, U.S. transfers to these three  countries were made prior to 1978, when a requirement that the partner  countries guarantee that they will maintain adequate physical security for  transferred nuclear material was added to the U.S. Atomic Energy Act of  1954. Therefore, these countries have not made the same commitments  regarding the physical security of U.S.-transferred material as the United  States’ other nuclear cooperation agreement partner countries.
We also found that physical security concerns are not confined to  countries that have limited infrastructure and resources. The potential  vulnerability of nuclear material at certain facilities in high-income  countries was raised to us by NSC officials. Specifically, we reported  that there may be security vulnerabilities in certain high-income countries,  including three specific high-income countries. For sites in these  countries, GTRI officials told us the U.S. government’s strategy is to work  bilaterally with the countries, provide recommendations to improve  physical protection, and follow up as needed.
In our September 2011 report, we found that DOE has taken steps to  improve security at a number of facilities overseas that hold U.S. nuclear  material but faces constraints. DOE’s GTRI program removes U.S.  material from vulnerable facilities but can only repatriate materials that  have an approved disposition pathway and meet the program’s eligibility  criteria. GTRI officials told us that of the approximately 17,500 kilograms  of HEU exported from the United States, 12,400 kilograms are currently  not eligible for return to the United States. The vast majority of this  amount—about 10,000 kilograms—is currently not eligible for return  because the material does not have an acceptable disposition pathway,  such as permanent disposal or potential reuse. Another 2,000 kilograms  of material is located primarily in the European Atomic Energy Community  (EURATOM) member countries and is in use or adequately protected,  according to GTRI officials.
As a result, we made several suggestions and recommendations to  improve oversight and accountability. For example, we suggested that  Congress consider directing DOE and NRC to compile an inventory of  U.S. weapon-usable nuclear materials overseas. As a separate matter,  we also suggested that Congress consider amending the Atomic Energy  Act if State, working with other U.S. agencies, does not include enhanced  measures regarding physical protection access rights in future and  renewed agreements, so that U.S. interagency physical protection teams  may obtain access when necessary to verify that U.S. nuclear materials  have adequate physical protection. We also recommended that the  Secretary of State, working with the Secretary of Energy and the  Chairman of the NRC, establish better inventory reporting and  reconciliation procedures, particularly when it comes to foreign facilities  holding U.S. weapon-usable material.
DOE, NRC, and State generally disagreed with our recommendations  when commenting on our draft report, including the need to reconcile  inventories with partner countries, stating that these reconciliations were  unnecessary. State believes that implementing the recommendations,  generally, would adversely impact U.S. commercial competitiveness in  overseas markets and diminish U.S. influence to advance our  nonproliferation objectives and cost jobs at home. DOE, however, now  agrees in principle with several recommendations we directed to that  agency according to a January 24, 2012, letter to us. For example, we  recommended, among other things, that DOE, working with its  interagency partners, develop formal goals and a systematic process to  determine which foreign facilities to visit for future interagency physical  protection visits. DOE informed us in the January 2012 letter that it is  working with NRC, State, and other agencies to develop a new  methodology and improve their efforts to set priorities for U.S. interagency  physical protection visits. To that end, DOE has established regular  interagency conference calls to coordinate upcoming visits and directed a  national laboratory to establish a repository of information regarding past  physical protection visits to assist in determining which sites to visit in the  future and in what time frame to do so.
section_title: Agencies Face Challenges in Coordinating U.S. Efforts to Combat Nuclear Smuggling Overseas
paragraphs: Reducing the risks posed by vulnerable nuclear material worldwide  requires a layered approach to protecting such material. As a first layer of  defense, the United States has helped countries secure nuclear materials  in place at civilian and defense facilities. As a second line of defense, the  United States has also helped countries improve their border security to  address the threat posed by nuclear smuggling. According to IAEA, there  were 2,164 confirmed cases of illicit trafficking in nuclear and radiological  materials worldwide from 1993 through 2011.
In December 2011, we reported on issues relating to the coordination of  U.S. programs involved in combating nuclear smuggling overseas.reviewed 21 federal programs and offices under five federal agencies— NNSA, DOD, State, DHS, and the Department of Justice.  These  programs (1) conduct research and development on radiation detection  technologies, (2) deploy radiation detection equipment along foreign  borders and points of transit, (3) train and equip foreign customs and  border security officials to identify and interdict illicit nuclear materials or  technology transfers, (4) assist foreign governments in the development  of export control systems, (5) enhance and coordinate with foreign  antismuggling law enforcement and prosecutorial capabilities, and (6)  analyze potential foreign nuclear smuggling cases and incidents.
However, we found impediments to the coordination of U.S. efforts to  combat nuclear smuggling overseas. Specifically, we found that none of  the existing strategies and plans for coordinating federal efforts to prevent  and detect nuclear smuggling and illicit nuclear transfers overseas  incorporate all of the desirable characteristics of national strategies, such  as identifying the financial resources needed and monitoring mechanisms  to be used to determine progress and make improvements. For example,  the 2010 Global Nuclear Detection Architecture Strategic Plan—developed  jointly by DHS, DOD, Energy, State, Justice, the intelligence community,  and NRC—did not identify the financial resources needed to achieve the  strategic plan’s objectives or the monitoring mechanisms that could be  used to determine programmatic progress and needed improvements.
We also identified potential fragmentation and overlapping functions  among some programs. Specifically, we identified six programs that  provide training to improve the capabilities of foreign border security and  customs officials to prevent smuggling and illicit nuclear shipments: (1)  NNSA’s Second Line of Defense program, (2) International  Nonproliferation Export Control Program, and (3) Cooperative Border  Security Program, (4) State’s Export Control and Related Border  Security program, (5) DOD’s Weapons of Mass Destruction-Proliferation  Prevention Program, and (6) International Counterproliferation Program.  Similarly, we identified four programs that are involved in providing  equipment to foreign governments to enhance the ability of their customs  and border security organizations to detect nuclear smuggling: (1)  NNSA’s Second Line of Defense program, (2) State’s Export Control and  Related Border Security program, (3) DOD’s Weapons of Mass  Destruction-Proliferation Prevention Program, and (4) DOD’s International  Counterproliferation Program. In prior reports on nuclear nonproliferation  programs, we have found that consolidating programs that share common  goals and implement similar projects can maximize limited resources and  may achieve potential cost savings or other programmatic and  administrative efficiencies.
Agency officials representing these programs told us that not all of them  have the same focus, that some concentrate on specialized niches, and  that many are complementary. For instance, regarding the provision of  equipment, NNSA, State, and DOD officials noted that the Second Line of  Defense program tends to provide larger equipment, such as radiation  portal monitors and cargo scanning equipment, while the Export Control  and Related Border Security Program and International  Counterproliferation Program provide smaller-scale equipment, such as  hand-held radiation detection pagers, hazardous materials kits, and  investigative suits to foreign customs and border security organizations.  Nevertheless, in our view, the fragmented and overlapping nature of the  programs raise questions as to whether greater efficiency could be  obtained through possible consolidation of such efforts.
Furthermore, we found that no single federal agency has lead  responsibility to direct federal efforts to prevent and detect nuclear  smuggling overseas. In the past, we have reported that interagency  undertakings can benefit from the leadership of a single entity with  sufficient time, responsibility, authority, and resources needed to ensure  that federal programs are based upon a coherent strategy and are well  coordinated, and that gaps and duplication in capabilities are avoided.  For instance, State and DOD officials told us that neither State nor any  other federal agency has the authority to direct the activities or coordinate  the implementation of programs administered by other agencies involved  in preventing or detecting nuclear smuggling overseas.
Regarding interagency coordinating mechanisms, NSC has established  mechanisms to coordinate efforts in this area, including a Countering  Nuclear Threats Interagency Policy Committee (IPC) and a sub-IPC for  international nuclear and radiological border security efforts. NSC officials  declined our request to discuss various aspects of the IPC structure and  how it coordinates U.S. efforts to combat nuclear smuggling overseas.  However, some officials from other agencies expressed doubts about the  value of NSC’s coordinating role. Notably, DOD officials told us that they  believed NSC has played a negligible role in coordinating programs to  counter nuclear smuggling.
We made two recommendations to NSC to streamline and eliminate the  potential for fragmentation and overlap among U.S. government  programs involved in preventing and detecting the smuggling of nuclear  materials overseas. Specifically, we recommended that NSC undertake or  direct an appropriate agency or agencies to conduct a comprehensive  review of the structure, scope, and composition of agencies and  programs across the federal government involved in such efforts. Such a  review should include, among other things, (1) the level of overlap and  duplication among agencies and programs and (2) potential for  consolidation to fewer programs and agencies. Following this review, new  guidance should be issued that incorporates the elements of effective  strategic plans, including clearly delineating the roles and missions of  relevant programs, specific priorities, performance measures, overall  program costs, and projected time frames for program completion. NSC  did not respond to these recommendations.
section_title: Agencies Have Taken Steps to Secure Domestic Radiological Materials, but Gaps Remain
paragraphs: In 2007, we issued a report at the Subcommittee’s request focusing on the  security of radiological sources overseas. In the course of that work we  visited a number of hospitals and medical facilities in foreign countries and  identified weaknesses in security. For example, in one country the security  cable used to secure a teletherapy machine’s cobalt-60 source had been  broken for almost a month. In another country, we observed that a storage  facility containing devices with thousands of curies of cesium-137 had  several unsecured large openings in the roof. Based on the findings in this  report, the Subcommittee subsequently asked us to review the security of  hospitals and medical facilities in the United States that use radiological  sources. Hospitals and medical facilities in the United States are significant  users of radiological sources contained in medical devices used primarily  for cancer treatment and research. The amount of radiation emitted by the  sources in these devices varies according to the size and type of source.  For example, teletherapy machines contain a single cobalt-60 source  ranging from about 1,000 to 10,000 curies, while irradiators can  occasionally contain up to 27,000 curies or more of cesium-137. The  following section provides our preliminary findings on our ongoing work.
subsections: section_title: NRC’s Security Requirements Do Not Prescribe Specific Measures for Protecting Radiological Sources at Hospitals and Medical Facilities
paragraphs: NRC, which is responsible for regulating the security of radiological  sources in U.S. hospitals and medical facilities, issued a security order in  2005 that directed licensees possessing radiological sources of concern  to implement increased controls for access, detection and assessment,  material shipments, physical barriers, information protection, and  sensitive information.  NRC has relinquished jurisdiction for licensing  and regulating radiological sources to 37 states called Agreement States,  whose offices are typically administered by state health or environment  departments, and which inspect licensees to ensure compliance with  state regulations that are generally compatible with NRC regulations. The  Department of Veterans Affairs and DOD, which maintain a network of  hospitals and medical facilities in the United States, are also required to  meet the NRC security order for radiological sources of concern at their  facilities.
NRC’s security order and implementation guidance are broadly written  and do not prescribe the specific steps that licensees must take to secure  their sources. Rather, they provide a general framework for what  constitutes adequate security practices. According to NRC, the intent of  the increased controls is not to provide absolute security from theft or  unauthorized access. Rather, the intent is to develop a combination of  people, procedures, and equipment that will delay and detect an intruder,  and initiate a response to the intrusion. In addition, the controls provide  minimum requirements that a licensee must implement, and licensees  may go beyond the minimum requirements. However, the ultimate  responsibility for securing radiological materials in the United States rests  with the licensees that possess these materials.
The security order directs that licensees limit access to radiological  sources and develop a documented program to detect, assess, and  respond to unauthorized access. The controls do not prescribe the types  of physical security needed. It is up to the licensee to determine, for  example, if security cameras are necessary or what types of locks or  alarms are needed to secure doors or windows. For some locations, such  as blood banks, requirements for access control can be met if the room  where the medical device is located is staffed 24 hours a day, 7 days a  week by an individual, or individuals, who are determined to be  trustworthy and reliable. As long as the room is staffed at all times, the  facility is not required to have any additional physical security, such as  cameras or motion detection equipment. As a result, the only access  control in place could be one or more staff members.
NRC also requires that hospitals and medical facilities verify the  trustworthiness and reliability of individuals who are granted unescorted  access to the medical devices containing radiological sources. The  trustworthiness and reliability process requires that hospitals conduct a  background check using information such as employment history,  academic records, and other relevant information. It is ultimately the  responsibility of the licensee to decide whether to grant the employee  unescorted access. In 2007, NRC issued an additional security order  requiring individuals employed at facilities containing highly radioactive  sources to undergo fingerprinting with verification through the Federal  Bureau of Investigation.
According to NRC officials, the requirements are intentionally broad to  allow licensees flexibility to tailor security upgrades to their specific facility  and operations. The ability to tailor security to a facility’s needs and  resources is particularly important for commercial facilities with limited  resources. For example, officials from smaller medical facilities told us  that implementing specific security requirements—such as cameras and  other surveillance equipment—could jeopardize their continued  operations because of the costs associated with this equipment. NRC  officials told us that given factors such as diverse economic conditions,  facility type, layout, and operations of facilities, a “one size fits all”  approach is neither practical nor desirable.
We found that the NRC controls have been implemented in a variety of  ways in the hospitals and medical facilities we visited in seven states and  District of Columbia. These approaches have created a mix of security  controls and procedures that could leave some facilities’ radiological  sources more vulnerable than others to possible tampering, sabotage, or  outright theft. At some locations, the controls resulted in significant  security upgrades, such as the addition of surveillance cameras,  upgrades to locks on doors, and alarms. In contrast, we observed minimal  security in other facilities. Moreover, law enforcement personnel from  states with significant amounts of high-activity radioactive sources at  hospitals and medical facilities told us that the NRC controls have an  inherent weakness: the controls do not specify what the facility is  protecting against and are not linked to a design basis threat. Typically,  a design basis threat characterizes the elements of a potential attack,  including the number of attackers, their training, and the weapons and  tactics they are capable of employing. Although NNSA does not use a  design basis threat for its security assessments of hospitals and medical  facilities, it does employ a threat scenario (known as potential adversary  capability) as the basis for its recommendations for security  enhancements. According to a VA official, VA initially developed a generic  threat scenario for use at its facilities with larger activity sealed  radiological sources since NRC did not provide a design basis threat as  part of the increased controls. Later, VA partnered with NNSA to  implement security enhancements based on the NNSA threat scenario.
The 25 sites we visited are a non-generalizable sample, selected on the basis of the  number of radiological devices in the state and the total number of cumulative curies  contained in these devices in each state. In addition, we also considered if the site had  undergone security upgrades funded by NNSA, and if the site is located in a large urban  area. from the room. The door to the room is opened by a swipe card lock,  and there are no cameras or other security measures inside the room.  We observed that one of the irradiators was sitting on a wheeled  pallet. When we asked the radiation safety officer (RSO)—the  designated hospital official responsible for the security of radiological  sources—if he had considered removing the wheels, he said no. This  response was given even though the irradiator room is located in  close proximity to an external loading dock, and the cameras along  the corridor to the loading dock are displayed on a single monitor.  This facility had passed its most recent NRC security inspection  because access to the room where the irradiators were located was  restricted through use of a swipe card. However, it could be  vulnerable because of the limited security we observed and the  potential mobility of the device.
At a hospital in a major U.S. city, we observed that the interior door to  the hospital blood bank, which had a cesium-137 blood irradiator of  approximately 1,500 curies, had the combination to the lock written on  the door frame. The door is in a busy hallway with heavy traffic, and  the security administrator for the hospital said that he often walks  around erasing door combinations that are written next to the locks.  According to NRC, a single lock is not necessarily a security  weakness, however, they noted that writing combinations on the door  is a weakness.
The RSO at a university hospital in another state told us that he did  not know the exact number of individuals with unescorted access to  the hospital’s radiological sources, although he said that there were at  least 500 people—the current data system does not allow for entering  records of individuals beyond 500. In the past, he said, the hospital  had as many as 800 people with unescorted access to sources. In  contrast, at a major medical research facility at a military installation  we visited, access was limited to 4 safety and security personnel.
At a blood center in a third state we visited, we observed a cesium- 137 blood irradiator of approximately 1,400 curies in a room that was  secured by a conventional key lock. The irradiator was located in the  middle of the room and not secured to the floor. The room had an  exterior wall with a bank of unalarmed and unsecured windows that  looked out onto a loading dock. The blood center officials said that  while they met the controls, they acknowledged that the center is  highly vulnerable to theft or sabotage of their radiological sources.  According to NRC, an irradiator sitting in the middle of the floor not  bolted down is not necessarily vulnerable.
Licensees are responsible for implementing the security requirements,  including designing a security plan and implementing it. Implementation  includes procuring and installing surveillance and alarm equipment that  the licensees believe is adequate to protect the radiological materials in  their facilities. However, many of the officials at the 25 hospitals and  medical facilities we visited told us that they have backgrounds in  radiological safety and facilities management and have limited security  experience. Furthermore, none of these officials has been trained in how  to implement the controls. For example:
At another hospital we visited, the RSO said that when the controls  were instituted in 2005, his new responsibilities included ensuring the  security of a cobalt-60 gamma knife of approximately 2,600 curies and  a cesium-137 blood irradiator of about 2,400 curies. He told us that he  was not comfortable with his security role because his training was as  a health physicist.
One facility manager who oversees the security for an approximately  1,700 curie cesium-137 blood irradiator at a blood bank told us that he  has a background in construction, not security. He said that it would  have been helpful if NRC’s controls were more specific so that he  would be in a better position to determine what security measures  were necessary to adequately protect the device.
According to NRC, NRC and Agreement State inspectors receive training  in security inspections. They also noted that only qualified inspectors can  conduct security inspections. Qualification includes training and  inspection accompaniments with qualified inspectors. However, some  inspectors from NRC and Agreement States we interviewed told us that  they do not feel comfortable conducting security inspections at hospitals  and medical facilities, despite having received this training. For example,  an NRC inspector said that security inspections were particularly difficult  for her because she is trained as a physicist. She said that the controls  were confusing, and she did not understand the nuances of security. An  Agreement State inspector from another state we visited also told us that  he was not qualified to do security inspections. However, he said that he  was doing the best he could to interpret the controls and help the  licensees implement the requirements. Other inspectors from this state  told us that they were placed in the awkward situation of having to  enforce regulations that they did not believe they were fully qualified to  interpret.
We also found that Agreement States lacked sufficient staff and adequate  training to ensure the security of radiological sources, according to recent  NRC reviews of two Agreement States’ inspection programs. For  example, NRC’s review of one of the state’s radioactive materials  program found that the program experienced significant turnover and that  inspectors did not have an adequate understanding of the controls.  According to a state official, high staff turnover and the resulting lack of  security experience affected the quality of their oversight. As a result,  inspectors had difficulty assessing licensee compliance with the security  requirements. According to NRC’s review of the other state’s radioactive  materials program, the state’s newer inspectors would have benefitted  from additional training on NRC’s security requirements. A state inspector  told NRC that he did not understand the meaning of some of the  documentation he was reviewing. Another state official stated that he was  authorized to inspect a radiological device independently (without being  accompanied by a more experienced inspector) before he was ready to  do so. Furthermore, according to state officials, staff turnover has  significantly affected the state’s timely follow-up of increased controls  violations. NRC told us that they plan, based on the findings of these  reviews, to take action in future reviews to remedy these problems.
section_title: NNSA Has Secured Radiological Sources at U.S. Hospitals and Medical Facilities
paragraphs: According to NNSA, there are approximately 1,500 hospital and medical  buildings in the United States —that they have identified—that contain  high-activity radiological sources. NNSA also estimates that these  buildings cumulatively contain about 22 million curies of radioactive  material. One of GTRI’s components is the Domestic Material Protection  program, which further improves security beyond NRC and Agreement  State regulatory requirements at U.S. facilities with high-activity  radiological sources, including hospitals and medical facilities. This  voluntary program provides, among other things, U.S. hospitals with  security upgrades to the devices that contain high-activity radiological  sources. It also provides training for hospital personnel and local police  departments through its Alarm Response Training program at the Y-12  National Security Complex in Oak Ridge, Tennessee. This training is  designed to teach facility personnel and local law enforcement officials  how to protect themselves and their communities when responding to  alarms indicating the possible theft or sabotage of nuclear or radioactive  materials. NNSA funds the cost of the security upgrades and training.  However, the licensee is responsible for maintaining the security systems  once the 3-to-5-year warranty period established by NNSA expires.  NNSA officials told us that they estimated the average cost of maintaining  the upgrades at each hospital was typically less than $10,000 per year.
According to NNSA officials, as of December 2011, the program spent an  estimated $96 million to secure radiological sources at 302 U.S. hospitals  and medical facilities. The program plans to complete voluntary security  upgrades at all 1,503 hospital and medical buildings it has identified as  high-risk by 2025, at a projected cost of $608 million. NNSA officials told  us that they estimate the average cost to upgrade a medical building has  been $317,800. We plan to analyze these expenditures more fully  during the course of our review.
Of the 25 hospital and medical facilities that we visited in seven states  and the District of Columbia, 13 have received GTRI upgrades and three  were in the process of receiving the upgrades. Officials from most of the  16 hospitals and medical facilities told us that GTRI’s program enhanced  the security of their facilities. We observed a number of security upgrades  at the facilities we visited, including remote monitoring systems,  surveillance cameras, hardened doors, iris scanners, motion detectors,  and tamper-proof alarms. NNSA has established criteria for determining  which hospitals are eligible for assistance; it ranks facilities to be  upgraded based on the relative risk of the radiological sources and  expected risk reduction resulting from the planned GTRI activity. The  criteria NNSA uses include the following: the attractiveness for theft or  diversion of nuclear and radiological materials; existing site security  conditions; threat environment; and location to a potential target, such as  a large population center.
Some hospital officials and police department personnel told us that the  GTRI program is limited because it is a voluntary program and because of  the potential financial burden placed on hospitals and medical facilities to  maintain the upgrades beyond the 3- to 5-year warranty period. We found  that some hospitals have declined the upgrades, including hospitals  located in high-risk urban areas. For example:
At a blood bank in one of the states we visited with a cesium-137  blood irradiator of approximately 1,400 curies, staff told us that NNSA  was prepared to upgrade the bank’s security, but the blood bank  decided not to participate because senior management wanted to wait  until the blood bank moved to a new location, which it planned to do  within the next 3 years. We observed that the blood irradiator  appeared vulnerable—it was visible through an unalarmed and  unsecured bank of windows overlooking an exterior loading dock. In  February 2012, we contacted NNSA officials about this matter. As a  result, NNSA and national laboratory officials met with the facility and  developed a plan to secure the irradiator before the end of the fiscal  year.
According to police department officials from one major U.S. city, one  hospital with a blood irradiator of approximately 1,700 curies has  declined the GTRI upgrades, even though the police department  considers it a high-risk facility. The hospital officials told us in  February 2012 that they decided not to implement the GTRI upgrades  because of concerns about maintenance costs associated with the  security equipment after the NNSA-funded warranty period expired.  The RSO said that the security the hospital has in place is adequate.  Furthermore, the hospital is under serious budget pressure that  makes it difficult to justify spending more money on protecting the  sources.
Under the GTRI program, NNSA also upgrades some smaller sources,  such as those contained in brachytherapy devices. Typically, these  devices contain between 10 and 15 curies of iridium-192. The curie level  is not considered high enough to be subject to NRC’s security controls,  but NNSA officials told us that the devices’ portability makes them a  potential target for theft. NNSA officials stated that GTRI completed  security upgrades at some sites before they considered including  brachytherapy devices. GTRI is in the process of revisiting these sites  and implementing security enhancements. We observed GTRI upgrades  for brachytherapy devices at some hospitals, including a device that was  put in a locked closet. However, we did visit one GTRI-upgraded facility  where the security of the brachytherapy device had not been upgraded. In  this facility, there were no security cameras monitoring the area, and in  particular, there were no cameras in the room where the device was  located. Furthermore, access to the room was controlled by a wooden  door with a padlock, and we observed a hospital official retrieve the key to  the padlock from an unlocked desk immediately outside the door. Upon  entering the room, we observed that the device was not secured to the  floor, as required by the hospital’s own security protocol.
We are continuing to conduct our audit and plan to visit some additional  medical facilities in the United States. We plan to issue our report later  this year.
Chairman Akaka, Ranking Member Johnson, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions you may have at this time.
section_title: GAO Contact and Staff Acknowledgements
paragraphs: If you or your staff have any questions about this testimony, please  contact me at (202) 512-3841 or aloisee@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this statement. GAO staff who made key contributions to  this testimony are Glen Levis, Assistant Director; Jeffrey Barron; Alysia  Davis; William Hoehn; Will Horton; and Michelle Munn.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.