Nuclear Security: NRC Has Enhanced the Controls of Dangerous Radioactive Materials, but Vulnerabilities Remain
Published: 2016-07-01T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In 2007, GAO reported weaknesses in NRC's licensing program as GAO investigators, after setting up fictitious companies, were able to obtain an NRC license and then alter it to obtain agreements to purchase devices containing, in aggregate, a dangerous quantity of radioactive materials.
GAO was asked to review and assess the steps NRC and agreement states have taken to strengthen their licensing processes. This report examines (1) the steps NRC and agreement states have taken to ensure that radioactive materials licenses are granted only to legitimate organizations and licensees can obtain materials only in quantities allowed by their licenses; and (2) the results of covert vulnerability testing designed to test the effectiveness of these controls. GAO reviewed relevant guidance documents, regulations, and analyses of orders, and interviewed NRC and state officials. GAO also established three fictitious businesses and applied for a radioactive materials license for each.
section_title: What GAO Found
paragraphs: The Nuclear Regulatory Commission (NRC) and the 37 states it permits to grant licenses for radioactive materials—called agreement states—have taken several steps since 2007 to help ensure that licenses are granted only to legitimate organizations and that licensees can only obtain such materials in quantities allowed by their licenses. However, NRC and agreement states have not taken some measures to better control some dangerous quantities of radioactive materials. The International Atomic Energy Agency established a system ranking quantities of certain radioactive materials into five categories based on their potential to harm human health, with, in descending order of danger, categories 1, 2, and 3 all considered dangerous. NRC developed revised guidance, screening criteria, and a checklist, among other things, and now directs NRC regions and agreement states to conduct prelicensing site visits—focusing on questions related to the applicant's business operations, facility, radiation safety operations, and personnel qualifications for all unknown applicants. NRC, however, has not strengthened controls for all categories of radioactive material considered dangerous. Unlike its process for applicants for category 1 and 2 quantities of radioactive materials, for category 3 applicants NRC does not review specific security measures before a license is issued. NRC has also developed and deployed the National Source Tracking System (NSTS), the Web-based Licensing System (WBL), and the License Verification System to better control some materials. However, these systems focus on more dangerous category 1 and 2 quantities but not category 3 quantities. Further, NRC does not specifically require that the validity of category 3 licenses be verified by the seller with NRC or the agreement states—creating risks that licenses could be counterfeited or that licensees could obtain radioactive materials in quantities greater than what is allowed by their licenses.
GAO's covert testing of NRC requirements showed them to be effective in two out of our three cases; in a third case, GAO was able to obtain a license and secure commitments to purchase, by accumulating multiple category 3 quantities of materials, a category 2 quantity of a radioactive material considered attractive for use in a “dirty bomb”—which uses explosives to disperse radioactive material. To test NRC's prelicensing processes, GAO established three fictitious companies, leased vacant space for each company (two in agreement states, one in an NRC state), and submitted an application to the appropriate agreement state or NRC office for a license to possess a category 3 source only slightly below the threshold for category 2. GAO made no attempt to outfit the site to make it appear as if a legitimate business was operating there. In the two cases where GAO was unable to obtain a license, the scrutiny provided by NRC or agreement state (regulatory body) officials during the prelicensing site visit led to the license not being granted. In the third case, the official from the regulatory body accepted GAO's assurances without scrutinizing key aspects of the fictitious business, which led to a license being obtained. NRC is currently taking corrective actions to provide training to NRC and agreement state officials to emphasize greater scrutiny in conducting prelicensing site visits. According to NRC officials, NRC and agreement state working groups are currently developing and evaluating enhancements to (1) prelicensing guidance overall and (2) license verification and transfer requirements for category 3 licenses.
section_title: What GAO Recommends
paragraphs: GAO is making three recommendations to NRC, including that NRC (1) take steps to include category 3 quantities of radioactive materials in NSTS and WBL, and (2) require that transferors of category 3 quantities of radioactive materials confirm the validity of licenses with regulators before selling or transferring these materials. GAO provided a draft of this report to NRC for comment. NRC neither agreed nor disagreed with GAO's recommendations, but noted that the agency has formal evaluations underway considering all three recommendations.

section_title: Letter
paragraphs: Radioactive materials are commonly used throughout the world for a  variety of purposes in medicine and the oil and gas, electric power,  construction, and food industries. Radioactive materials are frequently  sealed in a capsule or permanently bonded in solid form for use as sealed  sources in various devices. For example, devices containing radioactive  materials in sealed sources are used to diagnose and treat millions of  patients each year, sterilize medical instruments and food, and detect  flaws in the metal welds in pipelines. Since terrorists attacked the United  States in 2001, concerns have grown that terrorists could obtain and use  radioactive materials to build a “dirty bomb”—a type of radiological  dispersal device (RDD) that uses conventional explosives to disperse  radioactive material. The consequences of detonating an RDD would  depend on the amount and type of radioactive material used and the size  and characteristics of the area in which the material was dispersed. In  many scenarios, an RDD would cause few deaths or injuries, but would  likely have significant economic effects because the affected area would  need to be decontaminated and people who live and work there might not  return to their homes or businesses for an extended period of time  because of actual or feared contamination.
Until 2001, oversight of radioactive sealed sources in the United States  largely focused on ensuring that such sources were licensed as required  and used and stored safely. The Atomic Energy Act gives the Nuclear  Regulatory Commission (NRC) regulatory authority over domestic  industrial, medical, and research uses of radioactive materials. The act  also authorizes NRC to enter into agreements with states (called  agreement states) so they assume, and NRC relinquishes, regulatory  authority over specified radioactive materials. NRC and agreement  states license, monitor, track, and require security for radioactive  materials in order to protect both workers and the public from exposure to  hazardous levels of radiation generated by the activities of licensees. To  date, NRC has relinquished authority to 37 agreement states to grant  licenses to possess and use radioactive materials and sealed sources  and to conduct regular inspections of licensees. NRC retains its mandate  to regulate the use of radioactive materials in the remaining 13 states  (NRC states). Given their mandate to regulate the radioactive material  covered by their licenses, NRC and state regulators focused on the  dangers posed by day-to-day occupational exposure to radiation and the  direct health effects from industrial accidents.
In the years after 2001, security concerns surrounding radioactive  materials received greater attention nationally and internationally. For  example, in May 2003, NRC and the Department of Energy (DOE)  identified several radionuclides—particular types of radioactive  material—that are most commonly used in the United States and that  pose the greatest risk of being used by terrorists to make an RDD. That  same year, the International Atomic Energy Agency (IAEA) published a  system that ranked quantities of individual radionuclides into one of five  categories on the basis of their potential to harm human health. Under  IAEA’s system, a given radionuclide is considered dangerous when  gathered in close proximity to people in sufficient quantity to cause direct  human health effects. A category 1 quantity of a radionuclide, the most  dangerous, is defined as an amount 1,000 times or more than the amount  necessary to cause permanent human injury. A category 2 quantity is  defined as an amount at least 10 times, but less than 1,000 times, the  amount necessary to cause permanent human injury. A category 3  quantity of a given radionuclide is defined as at least the minimum  amount, but less than 10 times the amount sufficient to cause permanent  injury. Category 4 and 5 quantities of radioactive materials are unlikely to  cause permanent injury.
In September 2003, the United States and other nations endorsed IAEA’s  Code of Conduct that set forth basic principles and guidance to promote  the safe and secure use of radioactive sources containing dangerous  quantities of radioactive materials and that countries should take  appropriate measures to ensure that such radioactive sources are safely  managed and securely protected. The Code of Conduct applies to  category 1, 2, and 3 radioactive materials—all of which are potentially  dangerous to human health and could, if not properly controlled, cause  permanent injuries or death to a person who handled or was otherwise in  contact with them. Category 1 and 2 quantities of radioactive sources  listed in the Code of Conduct are considered the highest risk and most  dangerous and have been the focus of federal and state efforts to place  tighter controls on their licensing and use. Specifically, NRC, working with  agreement states, issued security orders beginning in 2003 requiring  several additional security measures. Subsequently, NRC issued  increased control orders in 2005 to protect certain radionuclides from  theft, diversion, or other unauthorized access when they are gathered in  quantities at or above a particular threshold. According to NRC officials,  agreement states also issued legally binding requirements at the same  time that required their licensees to take the same actions required in the  NRC increased controls orders. Additional security measures include 24- hour surveillance, multiple layers of physical security, and measures to  request assistance from local law enforcement agencies in the event of  any actual or attempted breach in security. These additional security  requirements have been incorporated into NRC regulations, including 10  C.F.R. Part 37, Physical Protection of Category 1 and Category 2  Quantities of Radioactive Material. Part 37 was promulgated on March  19, 2013. According to NRC, its regional offices have fully implemented  this rule. According to NRC officials, all agreement states have fully  implemented compatible requirements to Part 37 as of March 19, 2016;  state licensees operated under orders or other legally binding  requirements in the interim.
In addition, in 2005, Congress passed the Energy Policy Act (EPAct)  establishing a radiation source protection and security task force (Task  Force) to make recommendations relating to the security of radiation  sources in the United States from potential terrorist threats. The EPAct  requires that at least once every 4 years, the Task Force submit to  Congress and the President a report providing its recommendations,  including possible legislative and regulatory changes on a variety of  topics that include the protection and security of radiation sources.  Accordingly, in 2007, the Task Force directed the Radiation Sources  Subgroup to reevaluate the list of radioactive sources that warrant  enhanced security and protection, among other things. In 2009, the  subgroup found that the IAEA Code of Conduct category 1 and 2  quantities for sealed and unsealed radiological sources remained valid as  these could result in a significant RDD event and therefore warrant  enhanced security and protection.
We first reported that there were potential weaknesses in NRC and  agreement state licensing processes in 2003, and we made  recommendations to correct the problems at that time. By 2006, NRC  and agreement states had taken steps to improve their licensing  processes, and we later found that NRC had implemented three of our  recommendations to address weaknesses in NRC and agreement state  licensing processes made in GAO’s 2003 report. In 2007, however, a  GAO covert vulnerability testing effort revealed that weaknesses  persisted as GAO investigators, after setting up a fictitious company,  were able to obtain a genuine NRC license and then alter it to obtain  agreements to purchase devices containing, in aggregate, a dangerous  (category 3) quantity of radioactive materials. In 2008, we found that  NRC had worked with the agreement states and others to (1) identify  sealed sources of greatest concern, (2) enhance requirements to secure  radioactive sources, and (3) ensure that security requirements were  implemented. In addition, we found that NRC had made progress toward  implementing recommendations to (1) modify its process for issuing  licenses to ensure that radioactive materials cannot be purchased by  those with no legitimate need for them and (2) examine whether certain  radioactive sources should be subject to more stringent regulations. Our  2008 work also found that NRC could do more to ensure the security of  radioactive materials. Specifically, we recommended that among other  things NRC take steps to develop and implement the systems it was then  planning to better track, secure, and control radioactive materials.
This report provides our first review of NRC and agreement state  materials licensing programs since our 2007 covert vulnerability testing  and our 2008 report. You asked us to review and assess the steps NRC  and agreement states have taken to strengthen their licensing processes.  This report (1) examines what steps NRC and agreement states have  taken since 2007 to ensure that radioactive materials licenses are granted  only to legitimate organizations, and licensees can obtain materials only  in quantities allowed by their licenses, and (2) presents the results of our  covert vulnerability testing designed to test the effectiveness of these  controls.
In conducting our work, we reviewed planning documents,  memorandums, and analyses of orders describing changes NRC made to  its licensing process since 2007. We also reviewed regulations, guidance  documents, and directives describing NRC and agreement states’  licensing processes. To examine what steps NRC and agreement states  have taken since 2007 to ensure that radioactive materials licenses are  granted only to legitimate organizations, and that licensees can obtain  such materials only in quantities allowed by their licenses, we reviewed  GAO reports as well as reports and recommendations made by the  Senate Permanent Subcommittee on Investigations, the Independent  External Review Panel, the Materials Program Working Group, as well  as the radiation source protection and security task force. We also  examined NRC documents on the use of NRC’s key data systems—the  National Source Tracking System, Web-based Licensing System, and  License Verification System. Finally, we gathered testimonial evidence  through telephone and in-person interviews with NRC officials in  headquarters and regional offices, Organization of Agreement States  (OAS) officials, and officials from a nonprobability sample of agreement  states selected on the basis of an Integrated Materials Performance  Evaluation Program (IMPEP) review and periodic meeting findings,  number of licenses issued by the state, and geographic diversity. We also  obtained written responses to some of our questions from NRC officials.  We also reviewed documents describing NRC’s IMPEP and IMPEP  policy, guidance, and criteria, including NRC management directives and  regulatory guides, and IMPEP reports that document NRC’s reviews of  agreement states and NRC regional offices’ radioactive materials  licensing programs. In addition, we reviewed a 2009 report by NRC’s  Office of Inspector General that revealed weaknesses in IMPEP. We  obtained documents from NRC and agreement states that describe  measures taken to ensure compliance with guidance, rules, orders, and  other criteria outside of IMPEP reviews, including periodic self- assessments and other supplemental oversight processes.
Finally, we tested the effectiveness of these controls through the use of  covert investigative techniques. Specifically, we established fictitious  businesses and applied for radioactive materials licenses in three  states—two agreement states and one NRC state. In all three states, we  leased vacant space in an industrial or office park. We used these spaces  as the physical addresses of fictitious businesses, and these locations  were later the subject of prelicensing site visits by agreement state or  NRC officials as part their prelicensing reviews of our applications. We  selected these states based on a nongeneralizable sampling strategy  focusing on states with a history of issuing the largest numbers of  radioactive materials licenses for the type of devices we sought for our  fictitious businesses, and in one case, a state that was also known to  have a history of weaknesses in its radioactive materials regulatory  program.
We conducted this performance audit from April 2014 to July 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. We conducted our related  investigative work in accordance with investigation standards prescribed  by the Council of the Inspectors General on Integrity and Efficiency.
subsections: section_title: Background
paragraphs: The human health risks posed by any given type of radioactive material  depend on its activity level, or intensity; how long exposure lasts; and the  way in which the body is exposed to it—via inhalation, ingestion, or  external exposure. The different types of radiation—including alpha, beta,  gamma, and neutron—vary in how easy or difficult they are to block or  shield, which, in turn, affects the health threat posed by a particular type  of radiation. Depending on the radioactive material’s intensity and the  length and manner of exposure to it, health effects range from death, to  severe injury, to the development of cancer, to no discernable damage.  For example, alpha radiation poses little threat to human health from  external exposure, but poses considerable health risks if inhaled or  ingested. Gamma radiation is more penetrating and, if not properly  shielded, can cause injury or death through external exposure. Neutron  radiation, like gamma radiation, if not shielded, can also cause injury or  death through external exposure. Although sources of neutron radiation  are less common, neutron radiation is emitted from some materials that  are used to make nuclear weapons.
NRC oversees licensees of radiological material through three regional  offices located in Illinois, Pennsylvania, and Texas; radiological material  licensing responsibilities for the region II office in Georgia are handled by  the region I office in Pennsylvania. NRC has relinquished regulatory  authority for licensing and regulating certain radioactive material to 37  states that have entered into an agreement with NRC (agreement  states). Figure 1 shows which states are agreement states and in which  states NRC has maintained all regulatory authority (NRC states).
NRC and agreement states issue two types of licenses authorizing the  possession and use of radioactive materials: specific licenses and  general licenses. Specific licenses, which are the focus of this report, are  issued for devices that contain relatively larger sealed radioactive  sources. These devices, such as medical equipment used to treat cancer,  cameras used for industrial radiography, and moisture and density  gauges used in construction, generally require training to be used safely  and may also need to be properly secured to avoid misuse. An  organization or individual seeking to obtain a specific license must submit  an application and gain the approval of either NRC or the appropriate  agreement state prior to receiving and using licensed radioactive  materials. According to NRC, of the approximately 21,000 specific  radioactive materials licenses in the United States, NRC administers  about 2,900, and agreement states administer the rest.
Our prior work on security of radioactive materials found that NRC could  do more to ensure the security of these materials. Specifically, we  recommended in 2008 that among other things NRC take steps to  develop and implement the systems it was then planning to better track,  secure, and control radioactive materials. These systems are the National  Source Tracking System (NSTS), the Web-based Licensing System  (WBL), and the License Verification System (LVS).
NSTS, deployed in January 2009, tracks category 1 and 2 sources of the  20 radionuclides that NRC determined are sufficiently attractive for use in  an RDD or for other malicious purposes and warrant national tracking.  NSTS is a transaction-based system that tracks each major step that  each tracked radioactive source takes within the United States from  “cradle to grave.” Licensees are responsible for reporting the  manufacture, shipment, arrival, disassembly, and disposal of all nationally  tracked sources. A nationally tracked source is a source containing a  category 1 or 2 quantity of certain radioactive materials specified in  NRC’s regulations. More specifically, NSTS includes the radionuclide,  quantity (activity), manufacturer, manufacture date, model number,  serial number, and site address. The licensee has until the close of the  next business day after a transaction—such as the sale of a source from  a vendor to a customer—takes place to enter it into the system. As a  result, the location of all such sources are accounted for and closely  tracked.
While NSTS is presently configured to track larger and potentially more  dangerous radioactive sources, NRC’s WBL—deployed in August 2012— provides quick access to up-to-date information on all NRC and four  agreement states’ specific licenses for all radioactive materials and  sources in all five IAEA categories, enabling the user to enter, maintain,  track, and search radioactive material licensing and inspection  information. WBL also includes pdf images of all paper copies of  category 1 and 2 licenses for both NRC and agreement state licensees.  NRC also developed a third system—LVS, deployed in May 2013—which  draws on the information in NSTS and WBL and provides information to  regulators and vendors and other would-be transferors on whether those  applicants seeking to acquire category 1 and 2 sources are legitimately  licensed to do so. This is particularly important because paper licenses  issued by NRC and agreement states can be altered or counterfeited.  LVS provides a means to mitigate the risks of using paper licenses.
While NRC and agreement states have taken steps to improve their  licensing programs and better ensure that radiological materials are safe  and secure, concerns about the theft of radioactive materials and the  possible consequences of a dirty bomb attack persist. In 2012, for  example, we identified security weaknesses at some U.S. medical  facilities that use high-risk radioactive materials, such as cesium-137,  and in 2014, we found that challenges exist in reducing the security risks  faced by licensees using high-risk radioactive materials for industrial  purposes.
NRC periodically evaluates NRC regional offices’ and agreement states’  programs for licensing radioactive materials through its Integrated  Materials Performance Evaluation Program (IMPEP). NRC implemented  IMPEP in 1995 to periodically review NRC regional office and agreement  state radioactive materials programs to ensure that they are adequately  protecting public health and safety from the potential hazards associated  with the use of radioactive materials, and that agreement state programs  are compatible with NRC’s program. As part of IMPEP, each NRC  regional office and agreement state regulatory program is typically  expected to undergo a program review every 4 years; reviews may occur  more or less frequently depending on a program’s past performance. The  IMPEP reviewers examine a regional office’s or an agreement state’s  performance in areas such as licensing and inspections to determine if  the regional office’s program is adequate to protect public health and  safety and if the agreement state’s program is adequate to protect public  health and safety and compatible with NRC requirements.
NRC also has the option to employ greater oversight of agreement state  programs if it discovers performance issues. Specifically, if performance  problems are found, a Management Review Board (MRB)—comprised of  NRC officials and an agreement state liaison—may decide to (in  ascending order of seriousness) institute Monitoring, Heightened  Oversight, Probation, Suspension, or Termination. The MRB may  decide to place an agreement state on Monitoring if weaknesses in the  program have resulted in or could result in less than satisfactory  performance in one or more performance areas. If an agreement state  program is found to have more serious problems (i.e., one or more  performance indicators are found to be unsatisfactory), the MRB may opt  to place a program on Heightened Oversight. Under Heightened  Oversight, a program may be requested to submit a program  improvement plan, which involves establishing a plan to address all  recommendations to eliminate unsatisfactory performance as well as  frequent contact with NRC to closely monitor progress. If the program  under IMPEP review does not correct performance weaknesses under  Heightened Oversight the MRB/NRC may place the program on  Probation or even suspend or terminate the agreement and reassert  regulatory authority. Probation is a formal process and requires approval  of the Commission and notification of the state’s governor, congressional  delegation, and public.
section_title: NRC and Agreement States Have Taken Several Steps to Better Control Radioactive Materials, but Not Requiring Tracking and Agency License Verification for Category 3 Quantities Leaves Vulnerabilities
paragraphs: NRC and agreement states have taken several steps since 2007 to help  ensure that radioactive materials licenses are granted only to legitimate  organizations and that licensees can only obtain such materials in  quantities allowed by their licenses, but have not taken some measures  for better controlling category 3 quantities of radioactive materials. In  2008, NRC developed revised screening criteria and a checklist covering  all five IAEA categories of radioactive materials and now directs regions  and agreement states to conduct prelicensing site visits for all unknown  applicants. NRC and agreement states performed IMPEP reviews to  assess whether licensing guidance was being met and took corrective  actions when it was not. NRC also developed and deployed NSTS, WBL,  and LVS to better control such materials, although these systems are  focused on category 1 and 2 quantities. NRC does not require that  category 3 quantities be tracked in NSTS nor does it require all category  3 licenses be included in WBL. LVS, which queries NSTS and WBL,  provides information to regulators and vendors on whether a license is  valid. By not including category 3 materials in NSTS nor most agreement  state licenses in WBL, NRC has not taken an important step that could  better track and control these materials. Further, including all category 3  materials in these systems could help address the risk that paper licenses  issued by NRC and agreement states could be altered or counterfeited or  that a licensee could obtain radioactive materials in quantities greater  than what is allowed by their license.
subsections: section_title: NRC Revised Guidance Provides Greater Scrutiny of Radioactive Materials License Applications
paragraphs: NRC has taken a number of steps to address the vulnerabilities in its  licensing process identified by GAO and others. Specifically, in  September 2007, NRC approved its Action Plan to respond to  recommendations to address security issues its and agreement states’  radioactive materials programs raised in NRC Inspector General, Senate  subcommittee, and GAO reports. NRC also established prelicensing  and materials working groups and the Independent External Review  Panel to assess the security of NRC and agreement programs and  develop recommendations to address any vulnerabilities identified.  Among the outcomes of the working groups and panel was the  September 2008 issuance of revised prelicensing guidance, which,  among other things, according to NRC officials suspended the “good faith  presumption.” Prior to this change, NRC and agreement states were to  maintain a good faith presumption that assumed that applicants and  licensees did not have malicious intentions and that they would be honest  and truthful in providing information to regulators. The revised guidance  suspended this presumption, and directed regions and agreement states  to conduct prelicensing site visits for all unknown applicants. Prior to June  2007, such visits were optional except in cases where the proposed use  of radioactive materials involved unusually complex technical, safety, or  unprecedented issues, or were otherwise judged to be high risk. The  revised guidance directed NRC regions to conduct prelicensing site visits  for unknown applicants for specific licenses starting in September 2008,  and as a matter of compatibility for agreement states since March 2009.  Taken together, according to NRC officials, the suspension of the  presumption of good faith was intended to provide greater scrutiny of both  license applications and prelicensing site visits for unknown applicants.
subsections: section_title: New Screening Criteria, Site Visit Checklist, and Guidance
paragraphs: In addition to suspending the good faith presumption for previously  unknown applicants, NRC developed screening criteria to determine  whether a prelicensing site visit should be conducted. Specifically, among  other things, these criteria focus on whether the applicant may already  have a license elsewhere with NRC or agreement states. If the applicant  is known to NRC or an agreement state, a site visit may not need to be  conducted. Nonetheless, some agreement states conduct prelicensing  site visits for all applicants, regardless of whether they are known to NRC  or other agreement states, according to NRC officials. According to NRC,  the purpose of the site visit is to have a face-to-face meeting with the  applicant to determine whether there is a basis for confidence that the  sought radioactive materials will be used as represented in the application  when the applicant receives the license. NRC also established a 14-point  checklist to guide prelicensing site visits and developed a list of questions  and activities related to the applicant’s business operations, facility,  radiation safety operations, and personnel qualifications, to scrutinize the  applicant and provide a basis for confidence that the applicant will use the  radioactive material as specified in the license.
section_title: Prelicensing Guidance
paragraphs: In 2008, NRC also adopted revised prelicensing guidance. Under this  guidance, according to NRC officials, for any specific license (category 1- 5) to be granted, unknown applicants must demonstrate during the  prelicensing site visit that they are aware of, capable of, and committed to  complying with all applicable (health, safety, and security) guidance  before they take possession of licensed radioactive materials. In general,  according to NRC officials, applicants must demonstrate that they are  constructing facilities, establishing procedures, and have sufficient  qualified staff to support the size and scope of the program described in  the application. In addition, NRC officials told us that new applicants for  category 1 and 2 quantities also undergo an on-site security review  performed by NRC or agreement state officials. These security reviews  verify that the applicant is prepared to implement the required security  measures before the applicant takes possession of licensed radioactive  materials, according to NRC officials. (On-site security reviews are not  conducted for applicants for category 3-5 licenses.) According to NRC  staff, those conducting on-site security reviews determine whether the  applicant has the staff, processes, procedures, facilities, and equipment  to be ready to comply with all applicable additional security requirements.  NRC officials told us that they inspect each licensee for compliance with  health, safety, and security requirements for all licenses (category 1-5)  during an inspection after a licensee takes possession of the materials  and that this inspection occurs within 12 months of the issuance of a new  or amended license. NRC officials we spoke with, however, say that the  initial postlicensing inspection may, and typically does, take place sooner.
section_title: NRC and Agreement States Took Steps to Assess Whether Licensing Guidance Is Properly Implemented
paragraphs: Through IMPEP reviews, NRC identified instances where agreement  state programs did not follow NRC licensing guidance and took steps to  ensure that corrective actions are taken. For example, according to NRC  officials, from 2009 to 2013, IMPEP reviews found that three agreement  state programs did not consistently apply the 2008 prelicensing guidance.  As a result, NRC reminded all agreement state programs to follow  prelicensing guidance, to ensure that the problem would not continue.  According to NRC officials, NRC regional offices and agreement state  agencies follow essentially the same guidance and procedures when  reviewing license applications.
NRC also took steps to improve IMPEP by, among other things,  addressing program weaknesses. For example, in 2008, the NRC- chartered Materials Program Working Group recommended that NRC  incorporate new security policies and foster an enhanced security culture  as part of IMPEP reviews. In 2007, GAO recommended that NRC should  conduct periodic oversight of the license application examiners to ensure  that the new guidance is being appropriately applied. In response to this  recommendation, NRC officials told us that they started working to  incorporate enhanced security measures into the review process. For  example, according to NRC officials, IMPEP review teams now evaluate  programs on items such as their implementation of the prelicensing  checklist, control of sensitive information, and amending of licenses to  include new security requirements. In addition, the Commission directed  NRC staff to develop options, among other things, to revise IMPEP  metrics. According to NRC officials, the Commission approved the staff’s  plan to improve IMPEP consistency by updating guidance and training,  and the staff have started implementing plans to enhance the IMPEP  process and expects these activities to be completed by the end of 2017.
section_title: NRC Developed and Deployed Tracking, Licensing, and Verification Systems to Better Control Category 1 and 2 Quantities of Radioactive Material
paragraphs: To help ensure that licensees can obtain radioactive materials only in  quantities allowed by their licenses, NRC developed and deployed NSTS  and WBL to track category 1 and 2 quantities of radioactive materials and  record specific license information, respectively. It also deployed LVS,  which queries WBL and NSTS, to better enable regulators, vendors, and  other licensees to ensure that those seeking category 1 and 2 quantities  of radioactive materials are properly licensed to do so. Specifically, prior  to transferring category 1 and 2 quantities of radioactive materials,  licensees are required to verify with the appropriate regulatory body that  the transferee is licensed to have material of the type, form, and quantity  specified on the license and, in the case of category 1, to receive material  at the location specified on the license. Verification can be done  electronically using LVS or by the vendor or other seller (licensee)  contacting the appropriate regulatory body (specifically, NRC or the  agreement state that issued the license) directly to confirm the validity of  the license. LVS queries WBL and NSTS and enables users to confirm  that  1.  a category 1 or 2 license is valid and accurate,  2.  a licensee is authorized to acquire quantities and types of radioactive  3.  the licensee’s current category 1 or 2 inventories in NSTS do not  exceed the possession limits.
If the licensee is over their possession limit at the time the license  verification request is made, the LVS user would receive an error  message to contact the regulatory agency that issued the license for a  manual license verification, according to NRC officials. For category 1  and 2 licenses, deployment and use of these three systems, combined  with the requirement that transferors verify the legitimacy of licenses with  the appropriate regulatory body, serve as an impediment to those who  would attempt to illicitly obtain radioactive materials using a counterfeit or  altered license.
section_title: NRC Does Not Require Tracking or Agency Verification for Category 3 Quantities, Creating Risks to Public Health, Safety, and Security
paragraphs: In contrast to the requirements for category 1 and 2 quantities of  radioactive materials, NRC does not require the tracking of category 3  materials or specifically require vendors to verify the legitimacy of  licenses with the appropriate regulatory body for those seeking to acquire  category 3 materials. Category 3 quantities of radioactive materials, which  are considered dangerous by IAEA, are not tracked in NSTS, nor are  licenses for such material issued by most agreement states in WBL. In  addition, unlike transfers of category 1 and 2 quantities of radioactive  materials, NRC regulations governing transfers of category 3 and smaller  quantities of radioactive materials, which were last updated in 1978, do  not specifically require transferors to contact the appropriate NRC  regional office or agreement state regulator to verify that those wishing to  take possession of the material are licensed to do so. Instead, transferors  have several options, including obtaining a copy of the transferee’s  license, for verifying that the transferee has a license. We recommended  in 2008 that NRC include all potentially dangerous radioactive sources in  NSTS to address risks that a licensee could obtain radioactive materials  in quantities greater than what is allowed by their license.
In 2009, after years of study, NRC staff recommended that the  Commission approve a final rule requiring that category 3 materials be  tracked in NSTS. The recommendation, according to NRC staff, was  based on several factors:
Category 3 sources are considered dangerous by IAEA
The potential to accumulate category 3 sources by aggregation to a  more dangerous category 2 level
The additional burden to track category 3 was deemed justified given  the benefit in improved source accountability
NSTS could accommodate additional data for newly tracked sources  When considering the recommendation to require that category 3  materials be tracked in NSTS, the Commission was evenly divided.  Specifically, the Commission split two to two, and thus did not adopt the  recommendation as Commission policy. Accordingly, it continues to be  the case that only category 1 and 2 sources are required to be tracked in  NSTS.
In addition to not requiring tracking of category 3 quantities of radioactive  materials, NRC regulations governing transfers of category 3 and smaller  quantities of radioactive materials do not specifically require transferors to  verify the legitimacy of the license with the appropriate regulatory body.  Instead, transferors are required to choose one of several methods to  assure themselves that the purchaser has a license. Options include  obtaining a copy of the transferee’s license and verifying directly with the  appropriate regulatory body that a purchaser has a license to acquire  sought category 3 or below radioactive materials. Because category 3  licensees are not specifically required to verify licenses through LVS or  directly with the appropriate regulatory body, most agreement state  category 3 license information is not in WBL, and transferors cannot verify  through LVS that a purchaser is legitimately licensed. Instead, to get  agency verification, transferors would need to contact the appropriate  NRC regional office or agreement state regulatory body. By contrast,  those transferring category 1 and 2 quantities of radioactive materials to  other parties must verify license validity either by using LVS or by  contacting the relevant NRC regional office or agreement state regulatory  authority. The NRC regulations applicable to category 3 and smaller  quantities of radioactive materials have not been updated since 1978.  According to NRC officials, many transferors of category 3 and smaller  quantities of radioactive materials comply with NRC requirements by  obtaining and keeping a copy of the transferees’ licenses for their  records. However, there is presently no specific requirement that they do  so. Because they do not require transferors of category 3 and smaller  quantities of radioactive materials to verify the validity of a transferee’s  license by contacting the appropriate regulatory body directly, and do not  make LVS available for use by these transferors, NRC and agreement  states do not have assurance that their systems would prevent bad actors  from altering licenses or fraudulently reporting the details of their licenses  to transferors, accumulating dangerous materials by aggregation to  category 2 or larger quantities on the basis of those fraudulent licenses,  and thereby endangering public health and safety. On this point, we  recommended in 2007 that NRC explore options to prevent individuals  from counterfeiting NRC licenses, especially if this counterfeiting allows  transferees to purchase more radioactive materials than they are  approved for under the terms of their original licenses.
section_title: Our Testing of NRC and Agreement State Programs Showed Them to Be Effective in Some Cases but Not Others, Allowing Us to Obtain Commitments to Purchase a Dangerous Quantity of Radioactive Materials
paragraphs: Our testing of NRC and agreement state programs showed guidance— including the suspension of the good faith presumption, screening criteria,  and checklists, as well as inspectors’ application of scrutiny during  prelicensing site visits—to be effective in two out of our three cases. In a  third case, we were able to obtain a license for a category 3 quantity of  radioactive materials and secure commitments to purchase a category 2  quantity of radioactive materials by aggregation by altering a paper  license.
In order to test the effectiveness of NRC’s revised guidance, screening  criteria, checklists, and the prelicensing site visit, we established three  fictitious companies; leased vacant space in an industrial or office park for  each company (two in agreement states, one in an NRC state); and  submitted an application to the appropriate NRC regional office or  agreement state for a specific radioactive materials license to possess a  high-level category 3 quantity source that was only slightly below the  threshold for a category 2 quantity source. We designed our test to fail  the prelicensing site visit. In each case, we took no actions to prepare the  leased space for the site visit. According to NRC officials, while the NRC  prelicensing checklist does not require that a site have implemented all  the requirements that apply to licensees, its purpose, among other things,  is to establish a basis for confidence that radioactive material will be used  as specified on the license being sought, and we made no attempt to  improve or outfit the site to make it appear as if a legitimate business was  operating there. In our view, a prelicensing site visit, conducted with  adequate scrutiny, would likely reveal that our fictitious companies were  not suitable for a license. In each case, after we submitted a license  application, and answered some additional questions from NRC or  agreement state officials, we scheduled a time to meet officials from the  NRC or agreement state at the location of the fictitious business.
subsections: section_title: NRC Guidance Was Effective in Preventing Us from Obtaining Licenses for Our Fictitious Companies in Two Cases
paragraphs: Two of the three fictitious companies we established were unable to  obtain a license because NRC or agreement state officials found some  aspects of the application, the fictitious company, the leased space, or a  combination of these not to be credible. In these two cases, the scrutiny  of the prelicensing site visit was an important factor in the regulatory  bodies not granting our fictitious companies a radioactive materials  license.
GAO Also Obtained a License for a  Fictitious Business in 2007  In 2007, GAO tested controls on the licensing  of radioactive materials in two states—a state  regulated by the Nuclear Regulatory  Commission and an agreement state. To do  this, GAO established two fictitious businesses  and submitted a radioactive materials  application to the relevant regulatory body for  each state. GAO did not rent office space for  its fictitious businesses but instead used post  office boxes for addresses. GAO was able to  obtain a genuine radioactive materials license  from one of the two regulatory bodies.  After obtaining a (paper) license, GAO  investigators altered the license so the  fictitious company could purchase a much  larger quantity of radioactive material rather  than the maximum listed on the license. GAO  then sought to purchase, from two suppliers,  devices containing radioactive materials.  These suppliers gave GAO price quotes and  commitments to ship the devices containing  radioactive materials in an amount sufficient to  reach the International Atomic Energy Agency  category 3 level—considered dangerous if not  safely managed or secured. Importantly, GAO  could have accumulated substantially more  radioactive material.  GAO withdrew its application from the second  regulatory body after the license examiners  indicated that they would visit the fictitious  company’s office before granting the license.  An official with the regulatory body told GAO  that conducting a site visit was a standard  procedure before license applications are  approved. adequate to protect public health and safety and minimize danger to  life and property. To reach this conclusion, they asked us numerous  detailed questions about the nature of our business and our past  business experience. We had difficulty answering some of these  questions because of the fictitious nature of our business. They asked  for key business documents that we could not provide, such as a copy  of a business license from the state. Further, they contacted us the  day after the site visit about not being able to verify the work history of  the company’s radiation safety officer. (We had fabricated this  individual’s work history.) This regulatory body performed satisfactorily  for all performance indicators during its most recent IMPEP review  and was rated satisfactory on all performance indicators in two  consecutive IMPEP reviews.
In the second case, officials from the regulatory body stated that we  would not receive a license until the site was significantly more  developed, consistent with operating as a genuine business, and had  installed on-site an appropriately safe and secure storage container  for the radiological source and posted requisite safety placards  specified in the application, among other things. These comments are  consistent with NRC officials’ statements that the purpose of the site  visit is to have a face-to-face meeting with the applicant to determine  whether there is a basis for confidence that the sought radioactive  materials will be used as represented in the application. Moreover, the  regulatory body stated in a follow-up e-mail that the company must  submit additional information on several aspects of the application  before a license could be issued: new facility drawings (as the ones  provided were not accurate), public radiation dose calculations (as the  proposed facility was next to an office building), descriptions of the  security measures that would be implemented, and more specific  information about how the company planned to transfer the source  from the facility to the company’s truck since there was no garage  door in the facility. In summary, the regulators stated that they wanted  to “see everything that is in place right before you go into business.”  This regulatory body had recently been subjected to Heightened  Oversight by NRC because of problems uncovered regarding, among  other things, the qualifications, retention, and depth of its licensing  staff during an earlier IMPEP review. The regulatory body’s  performance had improved in the next IMPEP review, and its status  was upgraded from Heightened Oversight to Monitoring by the time  the prelicensing visit took place.
section_title: The Implementation of NRC’s Guidance Was Not Effective in Preventing Us from Obtaining a License for Our Fictitious Company in One Case
paragraphs: In one of the three cases, we were able to obtain a license for one of our  fictitious companies. Specifically, our application was approved and the  paper license was handed to our GAO investigator posing as a  representative of our fictitious company at the end of the prelicensing site  visit. During the application process and site visit, the regulatory official  accepted our written and oral assurances of the steps that our fictitious  company would take—to construct facilities, establish safety procedures,  hire sufficient qualified staff, and construct secure storage areas—after  receiving a license. We had taken no actions to implement any of these  steps when regulators approved our application and awarded the  company a license. The regulatory body in this case used a more lengthy  and detailed application than the other two regulatory bodies from which  we attempted to obtain licenses. However, notwithstanding NRC’s  guidance to suspend the presumption of good faith, the official from the  regulatory body accepted our assurances without scrutinizing key aspects  of our fictitious business to the extent that the other regulatory bodies  had. This regulatory body was found to have satisfactory performance in  all performance areas in its most recent IMPEP review.
subsections: section_title: GAO Used License to Obtain Vendor Commitments to Sell a Dangerous Quantity of Radioactive Material Considered Attractive for Use in a Dirty Bomb
paragraphs: Once we obtained a license, we were able to exploit the absence of a  requirement to verify the legitimacy of category 3 licenses with the  appropriate regulatory body and obtained commitments to acquire, by  accumulating multiple category 3 sources, a category 2 quantity of  radioactive material. Importantly, this material is 1 of the 20 radionuclides  that NRC previously determined are attractive for use in an RDD (also  known as a dirty bomb). Once we obtained a license, we contacted a  vendor of the category 3 radioactive source that we specified on our  license application. We provided a copy of the license, among other  things, to the vendor and subsequently obtained a signed commitment  from this vendor to sell us the source. We then altered the paper license  and contacted another vendor who also agreed to sell us a category 3  source we specified on our altered license. When combined, these two  high-level category 3 sources aggregate to a category 2 quantity of  radioactive material. According to IAEA, a category 2 quantity, if not  safely managed or securely protected, could cause permanent injury to a  person who handled it, or was otherwise in contact with the material, for a  short time (minutes to hours). NRC and agreement states require  additional security measures for those seeking to acquire this quantity of  material. Our fictitious business was not subjected to these more stringent  measures and provisions, however, because we were seeking a category  3 quantity of material.
It is important to note that we undertook a very similar covert testing of  NRC and agreement state radioactive materials licensing programs in  2007 with very similar results. In 2007, we obtained a real radioactive  materials license for a below category 3 quantity of material and then  altered it to obtain commitments from multiple vendors to sell us, in  aggregate, devices containing a category 3 quantity of a radioactive  material considered attractive for use in an RDD. This time, we were able  to complete a similar covert vulnerability test in which we obtained a real  license for a category 3 quantity of radioactive material and altered it to  obtain commitments from multiple vendors to sell us, in aggregate, a  more dangerous category 2 quantity of a type of radioactive material  considered attractive for use in an RDD.
Once we received our license from the agreement state and secured  commitments from vendors to sell us radiological material, we met with  NRC officials in October 2015 to alert them to the outcomes of the  investigative component of our work. As a result of our findings, NRC  officials told us that they are taking a number of corrective actions.  Specifically, NRC is updating training courses for new NRC and  agreement state inspectors to reinforce the importance of properly  implementing the prelicensing guidance. A key part of this training is to  reinforce the suspension of the good faith assumption during  prelicensing—particularly during site visits. NRC also developed and  provided a training webinar for NRC and agreement state staff to further  emphasize prelicensing guidance and providing adequate scrutiny during  site visits. In addition, NRC requested that NRC regional offices and  agreement states conduct self-assessments of their implementation of the  prelicensing guidance and site visits. Finally, according to NRC officials,  NRC and agreement state working groups are currently developing and  evaluating enhancements to (1) current prelicensing guidance overall,  and (2) license verification and transfer requirements and prelicensing  guidance for category 3 licenses in particular. However, NRC officials  informed us that since the Commission did not adopt a proposal to  include category 3 quantities of radioactive materials in NSTS in 2009,  NRC had no current plans to take action on requiring category 3  quantities be included in NSTS. Because of this, NRC and the agreement  states will continue to be very limited in their ability to track these  dangerous quantities of radioactive material.
section_title: Conclusions
paragraphs: Since 2007, NRC has taken steps to implement several of the  recommendations made by GAO and others to enhance the control and  accountability of radioactive sources and materials. NRC has deployed  data systems—NSTS, WBL, and LVS—that are helping to better track,  secure, and control category 1 and 2 quantities of radioactive materials.  NRC also developed revised guidance, screening criteria, and checklists  covering all five IAEA categories of radioactive materials, and now directs  regions and agreement states to conduct prelicensing site visits for all  unknown applicants. However, NRC chose not to implement  recommendations to better track, secure, and control category 3  materials. GAO testing of the revised guidance, checklists, and  prelicensing site visits showed these revised systems to be only partially  effective in that our attempts to obtain a license using a fictitious company  was successful in one of our three cases—allowing us to obtain  commitments from vendors to sell, in aggregate, a category 2 quantity of  radioactive material considered attractive for use in an RDD. This  demonstrates vulnerabilities similar to those we found in 2007.
To its credit, NRC has taken a number of corrective actions in response  to our findings, including more training on prelicensing guidance to ensure  that NRC and agreement state staff provide adequate scrutiny during  prelicensing site visits. NRC has also formed working groups to consider  enhancements to the prelicensing process. It will be important for NRC to  continue these efforts as part of its process to ensure that its prelicensing  guidance, including site visits, is effectively performed. Nonetheless, our  work shows that NRC can do more to strengthen its processes of  licensing radioactive materials. Specifically, we continue to believe that  NRC should implement the recommendations by GAO and others for  enhancing the ability to track, secure, and control category 3 sources by  including such sources in both NSTS and WBL. Doing so would also  enable LVS to query these systems and better enable transferors to verify  the legitimacy of those seeking to purchase radioactive materials. As the  results of our covert vulnerability testing show, it is possible for someone  to obtain a license, which is printed on paper; make alterations to this  paper license; and use the altered license for a category 3 source to  acquire another category 3 source and thereby accumulate more  dangerous, high-risk category 2 quantities. Including category 3 quantities  in NSTS and WBL, and requiring transferors to verify the legitimacy of  licenses of those seeking to purchase radioactive materials through LVS  or with the appropriate regulatory body, would provide greater assurance  that a bad actor could not manipulate the system by, for example, altering  a paper license, to acquire radioactive materials in aggregate greater than  what they are authorized to possess.
Moreover, NRC regulations governing the steps that transferors of  category 3 quantities of radioactive materials must take to verify that  those wishing to take possession of the material are properly licensed to  do so have not been updated since 1978 and may not be adequate to  protect public health and safety. In contrast, NRC has taken several steps  to update its licensing guidance by, among other things, directing regions  and agreement states to conduct site visits for unknown applicants and  suspending the good faith presumption, which fosters greater scrutiny of  applicants. However, because paper licenses are vulnerable to being  altered, not requiring transferors of category 3 quantities of radioactive  materials to verify the validity of their licenses with the appropriate  regulatory body may still allow bad actors to accumulate dangerous  materials and in quantities that threaten public health and safety.
Finally, prior to issuing a license to a new applicant for category 1 and 2  quantities, NRC and agreement states conduct an on-site security review  to verify that the applicant is prepared to implement the required security  measures before taking possession of licensed radioactive materials.  However, such on-site security reviews are not conducted for applicants  of category 3 quantities and below, and regulators told us that they may  take up to a year to ensure that applicants have implemented all required  health, safety, and security measures. Although category 3 quantities of  materials are considered dangerous by IAEA, NRC on-site security  reviews are not currently conducted for all prospective licensees that will  have access to dangerous quantities of radioactive materials.
section_title: Recommendations for Executive Action
paragraphs: Because some quantities of radioactive materials are potentially  dangerous to human health if not properly handled, we recommend that  NRC take action to better track and secure these materials and verify the  legitimacy of the licenses for those who seek to possess them.  Specifically, we recommend that the Nuclear Regulatory Commission  (NRC) take the following three actions:
Take the steps needed to include category 3 sources in the National  Source Tracking System and add agreement state category 3  licenses to the Web-based Licensing System as quickly as reasonably  possible.
At least until such time that category 3 licenses can be verified using  the License Verification System, require that transferors of category 3  quantities of radioactive materials confirm the validity of a would-be  purchaser’s radioactive materials license with the appropriate  regulatory authority before transferring any category 3 quantities of  licensed materials.
As part of the ongoing efforts of NRC working groups meeting to  develop enhancements to the prelicensing requirements for category  3 licenses, consider requiring that an on-site security review be  conducted for all unknown applicants of category 3 licenses to verify  that each applicant is prepared to implement the required security  measures before taking possession of licensed radioactive materials.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this product to NRC for comment. In its written  comments, reproduced in appendix I, NRC neither explicitly agreed nor  disagreed with our recommendations, but noted that the agency has  formal evaluations underway considering all three recommendations.  Specifically, NRC stated that the agency would consider GAO’s  recommendations as part of the working groups the agency has  established to evaluate (1) including category 3 sources in WBL and  NSTS, (2) license verification transfer requirements for category 3  sources, and (3) enhancing security and safety measures as part of the  prelicensing process. In addition, NRC recommended that we revise the  first recommendation for clarity. We modified the language in this  recommendation to provide greater clarity. NRC also provided technical  comments that were incorporated, as appropriate.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  Chairman of the Nuclear Regulatory Commission, the appropriate  congressional committees, and other interested parties. In addition, this  report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff members have any questions concerning this report,  please contact me at (202) 512-3841 or trimbled@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made significant  contributions to this report are listed in appendix II.
section_title: Appendix I: Comments from the Nuclear Regulatory Commission
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Ned Woodward (Assistant  Director), Antoinette Capaccio, Frederick Childers, Jenny Chow, John  Delicath, Barbara Lewis, Steven Putansu, Brynn Rovito, Kevin Tarmann,  and the Forensic Audits and Investigative Service team made key  contributions to this work.