The human health risks posed by any given type of radioactive material depend on its activity level, or intensity; how long exposure lasts; and the way in which the body is exposed to it—via inhalation, ingestion, or external exposure. The different types of radiation—including alpha, beta, gamma, and neutron—vary in how easy or difficult they are to block or shield, which, in turn, affects the health threat posed by a particular type of radiation. Depending on the radioactive material’s intensity and the length and manner of exposure to it, health effects range from death, to severe injury, to the development of cancer, to no discernable damage. For example, alpha radiation poses little threat to human health from external exposure, but poses considerable health risks if inhaled or ingested. Gamma radiation is more penetrating and, if not properly shielded, can cause injury or death through external exposure. Neutron radiation, like gamma radiation, if not shielded, can also cause injury or death through external exposure. Although sources of neutron radiation are less common, neutron radiation is emitted from some materials that are used to make nuclear weapons. NRC oversees licensees of radiological material through three regional offices located in Illinois, Pennsylvania, and Texas; radiological material licensing responsibilities for the region II office in Georgia are handled by the region I office in Pennsylvania. NRC has relinquished regulatory authority for licensing and regulating certain radioactive material to 37 states that have entered into an agreement with NRC (agreement states). Figure 1 shows which states are agreement states and in which states NRC has maintained all regulatory authority (NRC states). NRC and agreement states issue two types of licenses authorizing the possession and use of radioactive materials: specific licenses and general licenses. Specific licenses, which are the focus of this report, are issued for devices that contain relatively larger sealed radioactive sources. These devices, such as medical equipment used to treat cancer, cameras used for industrial radiography, and moisture and density gauges used in construction, generally require training to be used safely and may also need to be properly secured to avoid misuse. An organization or individual seeking to obtain a specific license must submit an application and gain the approval of either NRC or the appropriate agreement state prior to receiving and using licensed radioactive materials. According to NRC, of the approximately 21,000 specific radioactive materials licenses in the United States, NRC administers about 2,900, and agreement states administer the rest. Our prior work on security of radioactive materials found that NRC could do more to ensure the security of these materials. Specifically, we recommended in 2008 that among other things NRC take steps to develop and implement the systems it was then planning to better track, secure, and control radioactive materials. These systems are the National Source Tracking System (NSTS), the Web-based Licensing System (WBL), and the License Verification System (LVS). NSTS, deployed in January 2009, tracks category 1 and 2 sources of the 20 radionuclides that NRC determined are sufficiently attractive for use in an RDD or for other malicious purposes and warrant national tracking. NSTS is a transaction-based system that tracks each major step that each tracked radioactive source takes within the United States from “cradle to grave.” Licensees are responsible for reporting the manufacture, shipment, arrival, disassembly, and disposal of all nationally tracked sources. A nationally tracked source is a source containing a category 1 or 2 quantity of certain radioactive materials specified in NRC’s regulations. More specifically, NSTS includes the radionuclide, quantity (activity), manufacturer, manufacture date, model number, serial number, and site address. The licensee has until the close of the next business day after a transaction—such as the sale of a source from a vendor to a customer—takes place to enter it into the system. As a result, the location of all such sources are accounted for and closely tracked. While NSTS is presently configured to track larger and potentially more dangerous radioactive sources, NRC’s WBL—deployed in August 2012— provides quick access to up-to-date information on all NRC and four agreement states’ specific licenses for all radioactive materials and sources in all five IAEA categories, enabling the user to enter, maintain, track, and search radioactive material licensing and inspection information. WBL also includes pdf images of all paper copies of category 1 and 2 licenses for both NRC and agreement state licensees. NRC also developed a third system—LVS, deployed in May 2013—which draws on the information in NSTS and WBL and provides information to regulators and vendors and other would-be transferors on whether those applicants seeking to acquire category 1 and 2 sources are legitimately licensed to do so. This is particularly important because paper licenses issued by NRC and agreement states can be altered or counterfeited. LVS provides a means to mitigate the risks of using paper licenses. While NRC and agreement states have taken steps to improve their licensing programs and better ensure that radiological materials are safe and secure, concerns about the theft of radioactive materials and the possible consequences of a dirty bomb attack persist. In 2012, for example, we identified security weaknesses at some U.S. medical facilities that use high-risk radioactive materials, such as cesium-137, and in 2014, we found that challenges exist in reducing the security risks faced by licensees using high-risk radioactive materials for industrial purposes. NRC periodically evaluates NRC regional offices’ and agreement states’ programs for licensing radioactive materials through its Integrated Materials Performance Evaluation Program (IMPEP). NRC implemented IMPEP in 1995 to periodically review NRC regional office and agreement state radioactive materials programs to ensure that they are adequately protecting public health and safety from the potential hazards associated with the use of radioactive materials, and that agreement state programs are compatible with NRC’s program. As part of IMPEP, each NRC regional office and agreement state regulatory program is typically expected to undergo a program review every 4 years; reviews may occur more or less frequently depending on a program’s past performance. The IMPEP reviewers examine a regional office’s or an agreement state’s performance in areas such as licensing and inspections to determine if the regional office’s program is adequate to protect public health and safety and if the agreement state’s program is adequate to protect public health and safety and compatible with NRC requirements. NRC also has the option to employ greater oversight of agreement state programs if it discovers performance issues. Specifically, if performance problems are found, a Management Review Board (MRB)—comprised of NRC officials and an agreement state liaison—may decide to (in ascending order of seriousness) institute Monitoring, Heightened Oversight, Probation, Suspension, or Termination. The MRB may decide to place an agreement state on Monitoring if weaknesses in the program have resulted in or could result in less than satisfactory performance in one or more performance areas. If an agreement state program is found to have more serious problems (i.e., one or more performance indicators are found to be unsatisfactory), the MRB may opt to place a program on Heightened Oversight. Under Heightened Oversight, a program may be requested to submit a program improvement plan, which involves establishing a plan to address all recommendations to eliminate unsatisfactory performance as well as frequent contact with NRC to closely monitor progress. If the program under IMPEP review does not correct performance weaknesses under Heightened Oversight the MRB/NRC may place the program on Probation or even suspend or terminate the agreement and reassert regulatory authority. Probation is a formal process and requires approval of the Commission and notification of the state’s governor, congressional delegation, and public. NRC and agreement states have taken several steps since 2007 to help ensure that radioactive materials licenses are granted only to legitimate organizations and that licensees can only obtain such materials in quantities allowed by their licenses, but have not taken some measures for better controlling category 3 quantities of radioactive materials. In 2008, NRC developed revised screening criteria and a checklist covering all five IAEA categories of radioactive materials and now directs regions and agreement states to conduct prelicensing site visits for all unknown applicants. NRC and agreement states performed IMPEP reviews to assess whether licensing guidance was being met and took corrective actions when it was not. NRC also developed and deployed NSTS, WBL, and LVS to better control such materials, although these systems are focused on category 1 and 2 quantities. NRC does not require that category 3 quantities be tracked in NSTS nor does it require all category 3 licenses be included in WBL. LVS, which queries NSTS and WBL, provides information to regulators and vendors on whether a license is valid. By not including category 3 materials in NSTS nor most agreement state licenses in WBL, NRC has not taken an important step that could better track and control these materials. Further, including all category 3 materials in these systems could help address the risk that paper licenses issued by NRC and agreement states could be altered or counterfeited or that a licensee could obtain radioactive materials in quantities greater than what is allowed by their license. NRC has taken a number of steps to address the vulnerabilities in its licensing process identified by GAO and others. Specifically, in September 2007, NRC approved its Action Plan to respond to recommendations to address security issues its and agreement states’ radioactive materials programs raised in NRC Inspector General, Senate subcommittee, and GAO reports. NRC also established prelicensing and materials working groups and the Independent External Review Panel to assess the security of NRC and agreement programs and develop recommendations to address any vulnerabilities identified. Among the outcomes of the working groups and panel was the September 2008 issuance of revised prelicensing guidance, which, among other things, according to NRC officials suspended the “good faith presumption.” Prior to this change, NRC and agreement states were to maintain a good faith presumption that assumed that applicants and licensees did not have malicious intentions and that they would be honest and truthful in providing information to regulators. The revised guidance suspended this presumption, and directed regions and agreement states to conduct prelicensing site visits for all unknown applicants. Prior to June 2007, such visits were optional except in cases where the proposed use of radioactive materials involved unusually complex technical, safety, or unprecedented issues, or were otherwise judged to be high risk. The revised guidance directed NRC regions to conduct prelicensing site visits for unknown applicants for specific licenses starting in September 2008, and as a matter of compatibility for agreement states since March 2009. Taken together, according to NRC officials, the suspension of the presumption of good faith was intended to provide greater scrutiny of both license applications and prelicensing site visits for unknown applicants. In addition to suspending the good faith presumption for previously unknown applicants, NRC developed screening criteria to determine whether a prelicensing site visit should be conducted. Specifically, among other things, these criteria focus on whether the applicant may already have a license elsewhere with NRC or agreement states. If the applicant is known to NRC or an agreement state, a site visit may not need to be conducted. Nonetheless, some agreement states conduct prelicensing site visits for all applicants, regardless of whether they are known to NRC or other agreement states, according to NRC officials. According to NRC, the purpose of the site visit is to have a face-to-face meeting with the applicant to determine whether there is a basis for confidence that the sought radioactive materials will be used as represented in the application when the applicant receives the license. NRC also established a 14-point checklist to guide prelicensing site visits and developed a list of questions and activities related to the applicant’s business operations, facility, radiation safety operations, and personnel qualifications, to scrutinize the applicant and provide a basis for confidence that the applicant will use the radioactive material as specified in the license. In 2008, NRC also adopted revised prelicensing guidance. Under this guidance, according to NRC officials, for any specific license (category 1- 5) to be granted, unknown applicants must demonstrate during the prelicensing site visit that they are aware of, capable of, and committed to complying with all applicable (health, safety, and security) guidance before they take possession of licensed radioactive materials. In general, according to NRC officials, applicants must demonstrate that they are constructing facilities, establishing procedures, and have sufficient qualified staff to support the size and scope of the program described in the application. In addition, NRC officials told us that new applicants for category 1 and 2 quantities also undergo an on-site security review performed by NRC or agreement state officials. These security reviews verify that the applicant is prepared to implement the required security measures before the applicant takes possession of licensed radioactive materials, according to NRC officials. (On-site security reviews are not conducted for applicants for category 3-5 licenses.) According to NRC staff, those conducting on-site security reviews determine whether the applicant has the staff, processes, procedures, facilities, and equipment to be ready to comply with all applicable additional security requirements. NRC officials told us that they inspect each licensee for compliance with health, safety, and security requirements for all licenses (category 1-5) during an inspection after a licensee takes possession of the materials and that this inspection occurs within 12 months of the issuance of a new or amended license. NRC officials we spoke with, however, say that the initial postlicensing inspection may, and typically does, take place sooner. Through IMPEP reviews, NRC identified instances where agreement state programs did not follow NRC licensing guidance and took steps to ensure that corrective actions are taken. For example, according to NRC officials, from 2009 to 2013, IMPEP reviews found that three agreement state programs did not consistently apply the 2008 prelicensing guidance. As a result, NRC reminded all agreement state programs to follow prelicensing guidance, to ensure that the problem would not continue. According to NRC officials, NRC regional offices and agreement state agencies follow essentially the same guidance and procedures when reviewing license applications. NRC also took steps to improve IMPEP by, among other things, addressing program weaknesses. For example, in 2008, the NRC- chartered Materials Program Working Group recommended that NRC incorporate new security policies and foster an enhanced security culture as part of IMPEP reviews. In 2007, GAO recommended that NRC should conduct periodic oversight of the license application examiners to ensure that the new guidance is being appropriately applied. In response to this recommendation, NRC officials told us that they started working to incorporate enhanced security measures into the review process. For example, according to NRC officials, IMPEP review teams now evaluate programs on items such as their implementation of the prelicensing checklist, control of sensitive information, and amending of licenses to include new security requirements. In addition, the Commission directed NRC staff to develop options, among other things, to revise IMPEP metrics. According to NRC officials, the Commission approved the staff’s plan to improve IMPEP consistency by updating guidance and training, and the staff have started implementing plans to enhance the IMPEP process and expects these activities to be completed by the end of 2017. To help ensure that licensees can obtain radioactive materials only in quantities allowed by their licenses, NRC developed and deployed NSTS and WBL to track category 1 and 2 quantities of radioactive materials and record specific license information, respectively. It also deployed LVS, which queries WBL and NSTS, to better enable regulators, vendors, and other licensees to ensure that those seeking category 1 and 2 quantities of radioactive materials are properly licensed to do so. Specifically, prior to transferring category 1 and 2 quantities of radioactive materials, licensees are required to verify with the appropriate regulatory body that the transferee is licensed to have material of the type, form, and quantity specified on the license and, in the case of category 1, to receive material at the location specified on the license. Verification can be done electronically using LVS or by the vendor or other seller (licensee) contacting the appropriate regulatory body (specifically, NRC or the agreement state that issued the license) directly to confirm the validity of the license. LVS queries WBL and NSTS and enables users to confirm that 1. a category 1 or 2 license is valid and accurate, 2. a licensee is authorized to acquire quantities and types of radioactive 3. the licensee’s current category 1 or 2 inventories in NSTS do not exceed the possession limits. If the licensee is over their possession limit at the time the license verification request is made, the LVS user would receive an error message to contact the regulatory agency that issued the license for a manual license verification, according to NRC officials. For category 1 and 2 licenses, deployment and use of these three systems, combined with the requirement that transferors verify the legitimacy of licenses with the appropriate regulatory body, serve as an impediment to those who would attempt to illicitly obtain radioactive materials using a counterfeit or altered license. In contrast to the requirements for category 1 and 2 quantities of radioactive materials, NRC does not require the tracking of category 3 materials or specifically require vendors to verify the legitimacy of licenses with the appropriate regulatory body for those seeking to acquire category 3 materials. Category 3 quantities of radioactive materials, which are considered dangerous by IAEA, are not tracked in NSTS, nor are licenses for such material issued by most agreement states in WBL. In addition, unlike transfers of category 1 and 2 quantities of radioactive materials, NRC regulations governing transfers of category 3 and smaller quantities of radioactive materials, which were last updated in 1978, do not specifically require transferors to contact the appropriate NRC regional office or agreement state regulator to verify that those wishing to take possession of the material are licensed to do so. Instead, transferors have several options, including obtaining a copy of the transferee’s license, for verifying that the transferee has a license. We recommended in 2008 that NRC include all potentially dangerous radioactive sources in NSTS to address risks that a licensee could obtain radioactive materials in quantities greater than what is allowed by their license. In 2009, after years of study, NRC staff recommended that the Commission approve a final rule requiring that category 3 materials be tracked in NSTS. The recommendation, according to NRC staff, was based on several factors: Category 3 sources are considered dangerous by IAEA The potential to accumulate category 3 sources by aggregation to a more dangerous category 2 level The additional burden to track category 3 was deemed justified given the benefit in improved source accountability NSTS could accommodate additional data for newly tracked sources When considering the recommendation to require that category 3 materials be tracked in NSTS, the Commission was evenly divided. Specifically, the Commission split two to two, and thus did not adopt the recommendation as Commission policy. Accordingly, it continues to be the case that only category 1 and 2 sources are required to be tracked in NSTS. In addition to not requiring tracking of category 3 quantities of radioactive materials, NRC regulations governing transfers of category 3 and smaller quantities of radioactive materials do not specifically require transferors to verify the legitimacy of the license with the appropriate regulatory body. Instead, transferors are required to choose one of several methods to assure themselves that the purchaser has a license. Options include obtaining a copy of the transferee’s license and verifying directly with the appropriate regulatory body that a purchaser has a license to acquire sought category 3 or below radioactive materials. Because category 3 licensees are not specifically required to verify licenses through LVS or directly with the appropriate regulatory body, most agreement state category 3 license information is not in WBL, and transferors cannot verify through LVS that a purchaser is legitimately licensed. Instead, to get agency verification, transferors would need to contact the appropriate NRC regional office or agreement state regulatory body. By contrast, those transferring category 1 and 2 quantities of radioactive materials to other parties must verify license validity either by using LVS or by contacting the relevant NRC regional office or agreement state regulatory authority. The NRC regulations applicable to category 3 and smaller quantities of radioactive materials have not been updated since 1978. According to NRC officials, many transferors of category 3 and smaller quantities of radioactive materials comply with NRC requirements by obtaining and keeping a copy of the transferees’ licenses for their records. However, there is presently no specific requirement that they do so. Because they do not require transferors of category 3 and smaller quantities of radioactive materials to verify the validity of a transferee’s license by contacting the appropriate regulatory body directly, and do not make LVS available for use by these transferors, NRC and agreement states do not have assurance that their systems would prevent bad actors from altering licenses or fraudulently reporting the details of their licenses to transferors, accumulating dangerous materials by aggregation to category 2 or larger quantities on the basis of those fraudulent licenses, and thereby endangering public health and safety. On this point, we recommended in 2007 that NRC explore options to prevent individuals from counterfeiting NRC licenses, especially if this counterfeiting allows transferees to purchase more radioactive materials than they are approved for under the terms of their original licenses. Our testing of NRC and agreement state programs showed guidance— including the suspension of the good faith presumption, screening criteria, and checklists, as well as inspectors’ application of scrutiny during prelicensing site visits—to be effective in two out of our three cases. In a third case, we were able to obtain a license for a category 3 quantity of radioactive materials and secure commitments to purchase a category 2 quantity of radioactive materials by aggregation by altering a paper license. In order to test the effectiveness of NRC’s revised guidance, screening criteria, checklists, and the prelicensing site visit, we established three fictitious companies; leased vacant space in an industrial or office park for each company (two in agreement states, one in an NRC state); and submitted an application to the appropriate NRC regional office or agreement state for a specific radioactive materials license to possess a high-level category 3 quantity source that was only slightly below the threshold for a category 2 quantity source. We designed our test to fail the prelicensing site visit. In each case, we took no actions to prepare the leased space for the site visit. According to NRC officials, while the NRC prelicensing checklist does not require that a site have implemented all the requirements that apply to licensees, its purpose, among other things, is to establish a basis for confidence that radioactive material will be used as specified on the license being sought, and we made no attempt to improve or outfit the site to make it appear as if a legitimate business was operating there. In our view, a prelicensing site visit, conducted with adequate scrutiny, would likely reveal that our fictitious companies were not suitable for a license. In each case, after we submitted a license application, and answered some additional questions from NRC or agreement state officials, we scheduled a time to meet officials from the NRC or agreement state at the location of the fictitious business. Two of the three fictitious companies we established were unable to obtain a license because NRC or agreement state officials found some aspects of the application, the fictitious company, the leased space, or a combination of these not to be credible. In these two cases, the scrutiny of the prelicensing site visit was an important factor in the regulatory bodies not granting our fictitious companies a radioactive materials license. GAO Also Obtained a License for a Fictitious Business in 2007 In 2007, GAO tested controls on the licensing of radioactive materials in two states—a state regulated by the Nuclear Regulatory Commission and an agreement state. To do this, GAO established two fictitious businesses and submitted a radioactive materials application to the relevant regulatory body for each state. GAO did not rent office space for its fictitious businesses but instead used post office boxes for addresses. GAO was able to obtain a genuine radioactive materials license from one of the two regulatory bodies. After obtaining a (paper) license, GAO investigators altered the license so the fictitious company could purchase a much larger quantity of radioactive material rather than the maximum listed on the license. GAO then sought to purchase, from two suppliers, devices containing radioactive materials. These suppliers gave GAO price quotes and commitments to ship the devices containing radioactive materials in an amount sufficient to reach the International Atomic Energy Agency category 3 level—considered dangerous if not safely managed or secured. Importantly, GAO could have accumulated substantially more radioactive material. GAO withdrew its application from the second regulatory body after the license examiners indicated that they would visit the fictitious company’s office before granting the license. An official with the regulatory body told GAO that conducting a site visit was a standard procedure before license applications are approved. adequate to protect public health and safety and minimize danger to life and property. To reach this conclusion, they asked us numerous detailed questions about the nature of our business and our past business experience. We had difficulty answering some of these questions because of the fictitious nature of our business. They asked for key business documents that we could not provide, such as a copy of a business license from the state. Further, they contacted us the day after the site visit about not being able to verify the work history of the company’s radiation safety officer. (We had fabricated this individual’s work history.) This regulatory body performed satisfactorily for all performance indicators during its most recent IMPEP review and was rated satisfactory on all performance indicators in two consecutive IMPEP reviews. In the second case, officials from the regulatory body stated that we would not receive a license until the site was significantly more developed, consistent with operating as a genuine business, and had installed on-site an appropriately safe and secure storage container for the radiological source and posted requisite safety placards specified in the application, among other things. These comments are consistent with NRC officials’ statements that the purpose of the site visit is to have a face-to-face meeting with the applicant to determine whether there is a basis for confidence that the sought radioactive materials will be used as represented in the application. Moreover, the regulatory body stated in a follow-up e-mail that the company must submit additional information on several aspects of the application before a license could be issued: new facility drawings (as the ones provided were not accurate), public radiation dose calculations (as the proposed facility was next to an office building), descriptions of the security measures that would be implemented, and more specific information about how the company planned to transfer the source from the facility to the company’s truck since there was no garage door in the facility. In summary, the regulators stated that they wanted to “see everything that is in place right before you go into business.” This regulatory body had recently been subjected to Heightened Oversight by NRC because of problems uncovered regarding, among other things, the qualifications, retention, and depth of its licensing staff during an earlier IMPEP review. The regulatory body’s performance had improved in the next IMPEP review, and its status was upgraded from Heightened Oversight to Monitoring by the time the prelicensing visit took place. In one of the three cases, we were able to obtain a license for one of our fictitious companies. Specifically, our application was approved and the paper license was handed to our GAO investigator posing as a representative of our fictitious company at the end of the prelicensing site visit. During the application process and site visit, the regulatory official accepted our written and oral assurances of the steps that our fictitious company would take—to construct facilities, establish safety procedures, hire sufficient qualified staff, and construct secure storage areas—after receiving a license. We had taken no actions to implement any of these steps when regulators approved our application and awarded the company a license. The regulatory body in this case used a more lengthy and detailed application than the other two regulatory bodies from which we attempted to obtain licenses. However, notwithstanding NRC’s guidance to suspend the presumption of good faith, the official from the regulatory body accepted our assurances without scrutinizing key aspects of our fictitious business to the extent that the other regulatory bodies had. This regulatory body was found to have satisfactory performance in all performance areas in its most recent IMPEP review. Once we obtained a license, we were able to exploit the absence of a requirement to verify the legitimacy of category 3 licenses with the appropriate regulatory body and obtained commitments to acquire, by accumulating multiple category 3 sources, a category 2 quantity of radioactive material. Importantly, this material is 1 of the 20 radionuclides that NRC previously determined are attractive for use in an RDD (also known as a dirty bomb). Once we obtained a license, we contacted a vendor of the category 3 radioactive source that we specified on our license application. We provided a copy of the license, among other things, to the vendor and subsequently obtained a signed commitment from this vendor to sell us the source. We then altered the paper license and contacted another vendor who also agreed to sell us a category 3 source we specified on our altered license. When combined, these two high-level category 3 sources aggregate to a category 2 quantity of radioactive material. According to IAEA, a category 2 quantity, if not safely managed or securely protected, could cause permanent injury to a person who handled it, or was otherwise in contact with the material, for a short time (minutes to hours). NRC and agreement states require additional security measures for those seeking to acquire this quantity of material. Our fictitious business was not subjected to these more stringent measures and provisions, however, because we were seeking a category 3 quantity of material. It is important to note that we undertook a very similar covert testing of NRC and agreement state radioactive materials licensing programs in 2007 with very similar results. In 2007, we obtained a real radioactive materials license for a below category 3 quantity of material and then altered it to obtain commitments from multiple vendors to sell us, in aggregate, devices containing a category 3 quantity of a radioactive material considered attractive for use in an RDD. This time, we were able to complete a similar covert vulnerability test in which we obtained a real license for a category 3 quantity of radioactive material and altered it to obtain commitments from multiple vendors to sell us, in aggregate, a more dangerous category 2 quantity of a type of radioactive material considered attractive for use in an RDD. Once we received our license from the agreement state and secured commitments from vendors to sell us radiological material, we met with NRC officials in October 2015 to alert them to the outcomes of the investigative component of our work. As a result of our findings, NRC officials told us that they are taking a number of corrective actions. Specifically, NRC is updating training courses for new NRC and agreement state inspectors to reinforce the importance of properly implementing the prelicensing guidance. A key part of this training is to reinforce the suspension of the good faith assumption during prelicensing—particularly during site visits. NRC also developed and provided a training webinar for NRC and agreement state staff to further emphasize prelicensing guidance and providing adequate scrutiny during site visits. In addition, NRC requested that NRC regional offices and agreement states conduct self-assessments of their implementation of the prelicensing guidance and site visits. Finally, according to NRC officials, NRC and agreement state working groups are currently developing and evaluating enhancements to (1) current prelicensing guidance overall, and (2) license verification and transfer requirements and prelicensing guidance for category 3 licenses in particular. However, NRC officials informed us that since the Commission did not adopt a proposal to include category 3 quantities of radioactive materials in NSTS in 2009, NRC had no current plans to take action on requiring category 3 quantities be included in NSTS. Because of this, NRC and the agreement states will continue to be very limited in their ability to track these dangerous quantities of radioactive material. Since 2007, NRC has taken steps to implement several of the recommendations made by GAO and others to enhance the control and accountability of radioactive sources and materials. NRC has deployed data systems—NSTS, WBL, and LVS—that are helping to better track, secure, and control category 1 and 2 quantities of radioactive materials. NRC also developed revised guidance, screening criteria, and checklists covering all five IAEA categories of radioactive materials, and now directs regions and agreement states to conduct prelicensing site visits for all unknown applicants. However, NRC chose not to implement recommendations to better track, secure, and control category 3 materials. GAO testing of the revised guidance, checklists, and prelicensing site visits showed these revised systems to be only partially effective in that our attempts to obtain a license using a fictitious company was successful in one of our three cases—allowing us to obtain commitments from vendors to sell, in aggregate, a category 2 quantity of radioactive material considered attractive for use in an RDD. This demonstrates vulnerabilities similar to those we found in 2007. To its credit, NRC has taken a number of corrective actions in response to our findings, including more training on prelicensing guidance to ensure that NRC and agreement state staff provide adequate scrutiny during prelicensing site visits. NRC has also formed working groups to consider enhancements to the prelicensing process. It will be important for NRC to continue these efforts as part of its process to ensure that its prelicensing guidance, including site visits, is effectively performed. Nonetheless, our work shows that NRC can do more to strengthen its processes of licensing radioactive materials. Specifically, we continue to believe that NRC should implement the recommendations by GAO and others for enhancing the ability to track, secure, and control category 3 sources by including such sources in both NSTS and WBL. Doing so would also enable LVS to query these systems and better enable transferors to verify the legitimacy of those seeking to purchase radioactive materials. As the results of our covert vulnerability testing show, it is possible for someone to obtain a license, which is printed on paper; make alterations to this paper license; and use the altered license for a category 3 source to acquire another category 3 source and thereby accumulate more dangerous, high-risk category 2 quantities. Including category 3 quantities in NSTS and WBL, and requiring transferors to verify the legitimacy of licenses of those seeking to purchase radioactive materials through LVS or with the appropriate regulatory body, would provide greater assurance that a bad actor could not manipulate the system by, for example, altering a paper license, to acquire radioactive materials in aggregate greater than what they are authorized to possess. Moreover, NRC regulations governing the steps that transferors of category 3 quantities of radioactive materials must take to verify that those wishing to take possession of the material are properly licensed to do so have not been updated since 1978 and may not be adequate to protect public health and safety. In contrast, NRC has taken several steps to update its licensing guidance by, among other things, directing regions and agreement states to conduct site visits for unknown applicants and suspending the good faith presumption, which fosters greater scrutiny of applicants. However, because paper licenses are vulnerable to being altered, not requiring transferors of category 3 quantities of radioactive materials to verify the validity of their licenses with the appropriate regulatory body may still allow bad actors to accumulate dangerous materials and in quantities that threaten public health and safety. Finally, prior to issuing a license to a new applicant for category 1 and 2 quantities, NRC and agreement states conduct an on-site security review to verify that the applicant is prepared to implement the required security measures before taking possession of licensed radioactive materials. However, such on-site security reviews are not conducted for applicants of category 3 quantities and below, and regulators told us that they may take up to a year to ensure that applicants have implemented all required health, safety, and security measures. Although category 3 quantities of materials are considered dangerous by IAEA, NRC on-site security reviews are not currently conducted for all prospective licensees that will have access to dangerous quantities of radioactive materials. Because some quantities of radioactive materials are potentially dangerous to human health if not properly handled, we recommend that NRC take action to better track and secure these materials and verify the legitimacy of the licenses for those who seek to possess them. Specifically, we recommend that the Nuclear Regulatory Commission (NRC) take the following three actions: Take the steps needed to include category 3 sources in the National Source Tracking System and add agreement state category 3 licenses to the Web-based Licensing System as quickly as reasonably possible. At least until such time that category 3 licenses can be verified using the License Verification System, require that transferors of category 3 quantities of radioactive materials confirm the validity of a would-be purchaser’s radioactive materials license with the appropriate regulatory authority before transferring any category 3 quantities of licensed materials. As part of the ongoing efforts of NRC working groups meeting to develop enhancements to the prelicensing requirements for category 3 licenses, consider requiring that an on-site security review be conducted for all unknown applicants of category 3 licenses to verify that each applicant is prepared to implement the required security measures before taking possession of licensed radioactive materials. We provided a draft of this product to NRC for comment. In its written comments, reproduced in appendix I, NRC neither explicitly agreed nor disagreed with our recommendations, but noted that the agency has formal evaluations underway considering all three recommendations. Specifically, NRC stated that the agency would consider GAO’s recommendations as part of the working groups the agency has established to evaluate (1) including category 3 sources in WBL and NSTS, (2) license verification transfer requirements for category 3 sources, and (3) enhancing security and safety measures as part of the prelicensing process. In addition, NRC recommended that we revise the first recommendation for clarity. We modified the language in this recommendation to provide greater clarity. NRC also provided technical comments that were incorporated, as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Chairman of the Nuclear Regulatory Commission, the appropriate congressional committees, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions concerning this report, please contact me at (202) 512-3841 or trimbled@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in appendix II. In addition to the contact named above, Ned Woodward (Assistant Director), Antoinette Capaccio, Frederick Childers, Jenny Chow, John Delicath, Barbara Lewis, Steven Putansu, Brynn Rovito, Kevin Tarmann, and the Forensic Audits and Investigative Service team made key contributions to this work.

Summary: In 2007, GAO reported weaknesses in NRC's licensing program as GAO investigators, after setting up fictitious companies, were able to obtain an NRC license and then alter it to obtain agreements to purchase devices containing, in aggregate, a dangerous quantity of radioactive materials. GAO was asked to review and assess the steps NRC and agreement states have taken to strengthen their licensing processes. This report examines (1) the steps NRC and agreement states have taken to ensure that radioactive materials licenses are granted only to legitimate organizations and licensees can obtain materials only in quantities allowed by their licenses; and (2) the results of covert vulnerability testing designed to test the effectiveness of these controls. GAO reviewed relevant guidance documents, regulations, and analyses of orders, and interviewed NRC and state officials. GAO also established three fictitious businesses and applied for a radioactive materials license for each. The Nuclear Regulatory Commission (NRC) and the 37 states it permits to grant licenses for radioactive materials—called agreement states—have taken several steps since 2007 to help ensure that licenses are granted only to legitimate organizations and that licensees can only obtain such materials in quantities allowed by their licenses. However, NRC and agreement states have not taken some measures to better control some dangerous quantities of radioactive materials. The International Atomic Energy Agency established a system ranking quantities of certain radioactive materials into five categories based on their potential to harm human health, with, in descending order of danger, categories 1, 2, and 3 all considered dangerous. NRC developed revised guidance, screening criteria, and a checklist, among other things, and now directs NRC regions and agreement states to conduct prelicensing site visits—focusing on questions related to the applicant's business operations, facility, radiation safety operations, and personnel qualifications for all unknown applicants. NRC, however, has not strengthened controls for all categories of radioactive material considered dangerous. Unlike its process for applicants for category 1 and 2 quantities of radioactive materials, for category 3 applicants NRC does not review specific security measures before a license is issued. NRC has also developed and deployed the National Source Tracking System (NSTS), the Web-based Licensing System (WBL), and the License Verification System to better control some materials. However, these systems focus on more dangerous category 1 and 2 quantities but not category 3 quantities. Further, NRC does not specifically require that the validity of category 3 licenses be verified by the seller with NRC or the agreement states—creating risks that licenses could be counterfeited or that licensees could obtain radioactive materials in quantities greater than what is allowed by their licenses. GAO's covert testing of NRC requirements showed them to be effective in two out of our three cases; in a third case, GAO was able to obtain a license and secure commitments to purchase, by accumulating multiple category 3 quantities of materials, a category 2 quantity of a radioactive material considered attractive for use in a “dirty bomb”—which uses explosives to disperse radioactive material. To test NRC's prelicensing processes, GAO established three fictitious companies, leased vacant space for each company (two in agreement states, one in an NRC state), and submitted an application to the appropriate agreement state or NRC office for a license to possess a category 3 source only slightly below the threshold for category 2. GAO made no attempt to outfit the site to make it appear as if a legitimate business was operating there. In the two cases where GAO was unable to obtain a license, the scrutiny provided by NRC or agreement state (regulatory body) officials during the prelicensing site visit led to the license not being granted. In the third case, the official from the regulatory body accepted GAO's assurances without scrutinizing key aspects of the fictitious business, which led to a license being obtained. NRC is currently taking corrective actions to provide training to NRC and agreement state officials to emphasize greater scrutiny in conducting prelicensing site visits. According to NRC officials, NRC and agreement state working groups are currently developing and evaluating enhancements to (1) prelicensing guidance overall and (2) license verification and transfer requirements for category 3 licenses. GAO is making three recommendations to NRC, including that NRC (1) take steps to include category 3 quantities of radioactive materials in NSTS and WBL, and (2) require that transferors of category 3 quantities of radioactive materials confirm the validity of licenses with regulators before selling or transferring these materials. GAO provided a draft of this report to NRC for comment. NRC neither agreed nor disagreed with GAO's recommendations, but noted that the agency has formal evaluations underway considering all three recommendations.