The small size, portability and potential value of sealed radiological sources make them vulnerable to misuse, improper disposal and theft. According to IAEA, the confirmed reports of illicit trafficking in radiological materials have increased since 2002. For example, in 2004, about 60 percent of the cases involved radiological materials, some of which are considered by U.S. government and IAEA as attractive for the development of a dirty bomb. Although experts generally believe that a dirty bomb could result in a limited number of deaths, it could, however, have severe economic consequences. Depending on the type, amount, and form, the dispersed radiological material could cause radiation sickness for people nearby and produce serious economic, psychological and social disruption associated with the evacuation and subsequent cleanup of the contaminated area. Although no dirty bombs have been detonated, in the mid-1990s, Chechen separatists placed a canister containing cesium-137 in a Moscow park. While the device was not detonated and no radiological material was dispersed, the incident demonstrated that terrorists have the capability and willingness to use radiological sources as weapons of terror. A 2004 study by the National Defense University noted that the economic impact on a major populated area from a successful dirty bomb attack is likely to equal, and perhaps exceed, that of the September 11, 2001, attacks on New York City and Washington, D.C. According to another study, the economic consequences of detonating a series of dirty bombs at U.S. ports, for example, would result in an estimated $58 billion in losses to the U.S. economy. The potential impacts of a dirty bomb attack could also produce significant health consequences. In 2002, the Federation of American Scientists concluded that an americium radiological source combined with one pound of explosives would result in medical supervision and monitoring required for the entire population of an area 10 times larger than the initial blast. The consequences resulting from the improper use of radiological sources are not theoretical. Some actual incidents involving sources can provide a measure of understanding of what could happen in case of a dirty bomb attack. In 1987, an accident involving a teletherapy machine containing about 1,400 curies of cesium-137, which is generally in the form of a powder similar to talc and highly dispersible, killed four people in Brazil and injured many more. The accident and its aftermath caused about $36 million in damages to the region (Goiania) where the accident occurred, according to an official from Brazil’s Nuclear Energy Commission. In addition to the deaths and economic impact, the accident created environmental and medical problems. For example, 85 houses were significantly contaminated and 41 of these had to be evacuated. The decontamination process required the demolition of homes and other buildings and generated 3,500 cubic meters of radioactive waste. Over 8,000 persons requested monitoring for contamination in order to obtain certificates stating they were not contaminated. DOE has improved the security of hundreds of sites that contain radiological sources in more than 40 countries since the program’s inception in 2002. However, despite these achievements, such as removing dangerous sources from a waste storage facility in Chechnya, many of the high-risk and most dangerous sources remain unsecured, particularly in Russia. DOE officials told us that the program has barely “scratched the surface” in terms of securing the most dangerous sources in the former Soviet Union. Specifically, removing dangerous sources from 16 of 20 waste storage facilities across Russia and Ukraine remain unsecured while more than 700 RTGs remain operational or abandoned in Russia and are vulnerable to theft or potential misuse. In 2003, when DOE decided to broaden the program’s scope beyond the former Soviet Union, it also expanded the types of sites that required security upgrades. As a result, as of September 2006, almost 70 percent of all sites secured were medical facilities, which generally contain one radiological source. In addition, DOE’s program does not address the transportation of radiological sources from one location to another, a security measure that DOE and international officials have identified as the most vulnerable link in the radiological supply chain. DOE has experienced numerous problems and challenges implementing its program to secure radiological sources worldwide, including a lack of cooperation from host country officials. Finally, DOE has not developed an adequate plan to ensure that countries receiving security upgrades will be able to sustain them once installed. Since DOE began its program in 2002, it has taken steps to secure radiological sources in more than 40 countries and has achieved some noteworthy accomplishments. For example, DOE told us that it has (1) facilitated the removal of 5,500 curies of cobalt-60 and cesium-137 sources from a poorly protected nuclear waste repository in Chechnya, the location of continuing political unrest in southeastern Russia; (2) constructed storage facilities in Uzbekistan, Moldova, Tajikistan and Georgia so that sources can be consolidated at one site to strengthen their long-term protection; and (3) increased security at 21 sites in Greece prior to the 2004 Olympics, including providing 110 hand-held radiation detection devices for first responders. DOE secured, among other things, facilities with blood irradiators containing cesium chloride and a large industrial sterilization facility. According to DOE, it has neither the resources nor staff to comprehensively address and secure the tens of thousands of vulnerable radiological sources worldwide on its own. As a result, it has enlisted the support of regional partners and IAEA to implement programs to help other countries find, characterize and secure their most dangerous sources. DOE works with partner countries to identify sites where high- risk sources may be located and provides the equipment and training to conduct searches. Once the sources have been located, DOE enlists the support of IAEA or partner countries to transfer them to a secure facility. For example, DOE established a regional partnership with Lithuania to facilitate orphan source recovery efforts both in Lithuania and in neighboring countries. DOE purchased radiation detection equipment and trained Lithuanian specialists to initiate orphan source recovery efforts. Lithuania was able to identify 41 former Soviet military and industrial sites that potentially held high-risk radiological sources. Subsequently, Lithuania assisted DOE in initiating search and secure efforts in Estonia and Latvia, which resulted in the discovery and disposition of orphan sources. Despite these achievements, DOE’s program has not adequately addressed many high-priority sources. In 2003, the Secretary of Energy directed NNSA to expand its program to secure radiological sources worldwide, which increased both the number of countries targeted to receive DOE assistance and the types of sites to be secured. Expanding the program into many countries outside of the former Soviet Union—the initial focus and attention of DOE’s program—resulted in the addition of many medical facilities that contained lower priority sources that were now being targeted for physical security upgrades. As of September 30, 2006, DOE’s program had completed the installation of physical security upgrades at 368 sites in over 40 countries. However, a majority of sites secured do not represent the highest-risk or the most vulnerable sources. Of the total sites completed, 256—or about 70 percent—were hospitals and oncology clinics operating teletherapy machines used to provide radiation treatment to cancer patients. These machines generally contain a single cobalt-60 radiological source ranging from about 1,000 to 10,000 curies. In 38 of the 41 countries—or 93 percent—DOE had upgraded at least one hospital or oncology clinic. According to DOE, many of the countries that are included in its global program have medical facilities with radiological sources. As a result, these facilities were targeted for upgrades. In addition to the medical facilities, DOE has completed security upgrades at 47 research institutes, 35 commercial and industrial sites, and 30 waste storage facilities. Figure 1 depicts the countries receiving security upgrades, and table 1 provides a breakdown of the total number and types of facilities upgraded by DOE, as of September 30, 2006. Six national laboratory officials and security specialists responsible for implementing the program told us that although progress had been made in securing radiological sources, DOE had focused too much attention on securing medical facilities at the expense of other higher-priority sites, such as waste storage facilities and RTGs. In their view, DOE installed security upgrades at so many of these facilities primarily because the upgrades are relatively modest in scope and cost. For example, a typical suite of security upgrades at a medical facility costs between $10,000 to $20,000, depending on the size of the site, whereas the average cost to remove and replace an RTG in the Far East region of Russia is about $72,000 based on 2006 dollars. Officials from three of the four recipient countries we visited also raised concerns about DOE’s focus on securing radiological sources at so many medical facilities. For example, staff responsible for operating the teletherapy machines in hospitals in Lithuania and Poland told us that the cobalt-60 sources contained in the teletherapy machine did not pose a significant security risk. In their view, it was highly unlikely that the sources could be easily removed from these machines and that it would take more than one highly skilled and determined intruder to remove the source and transport it out of the facility without being detected or dangerously exposed to radiation. In fact, while emphasizing the importance of securing medical facilities, DOE officials stated that getting medical and security staff to buy into the need for improved security has been a consistent challenge for the program. Further, Russian officials told us that radiological sources in hospitals did not pose a comparable risk to RTGs or lost or abandoned sources. DOE has not offered to fund any security upgrades of Russian medical facilities since its funds are focused on securing RTGs, Radons, and orphan sources. According to five national laboratory officials and security specialists, completing upgrades at medical facilities also served to demonstrate rapid program progress because the upgrades are completed relatively quickly. DOE has relied upon an indicator that focuses on the number of sites that have been upgraded, or “sites secured.” While sites completed is the primary metric used by DOE, the program does compile and track several additional activities, including the amount of curies secured, countries that receive regulatory assistance, and orphan sources recovered. In measuring program performance, the Director of IRTR said that the number of sites completed demonstrated conclusively that work has been completed and represents the best available measurement. In discussions with other high-level DOE officials about the program, they consistently identified the number of sites upgraded as evidence that the program had been achieving results and reducing the threat posed by radiological sources overseas. However, PNNL and Sandia National Laboratory officials told us that the measurement used by DOE does not demonstrate how the program is reducing threats posed to U.S. national security interests. In their view, this measurement is one-dimensional and does not adequately distinguish lower-priority sites from higher-priority sites. DOE has made limited progress removing hundreds of RTGs containing high-priority sources which, according to DOE, likely represent the largest unsecured quantity of radioactivity in the world. These devices were designed to provide electric power and are suited for remote locations to power navigational facilities such as lighthouses and meteorological stations. Each has activity levels ranging from 25,000 to 250,000 curies of strontium-90—similar to the amount of strontium-90 released from the Chernobyl nuclear reactor accident in 1986. As of September 30, 2006, DOE had funded the removal of about 13 percent of all RTGs located in Russia’s inventory. Until early 2000, approximately 1,049 RTGs were in Russia. Of those, approximately 317 RTGs have been removed over the past several years, according to DOE and Russian officials. DOE funded about 40 percent of those removed (132 RTGs) and Norway, France, and Russia funded the removal of the remaining 185. However, an estimated 732 RTGs, representing several million curies of radioactivity, remain unsecured. A majority of RTGs are located along coastlines in three major regions— the Baltic, Artic and Far East. To date, DOE has focused the majority of its efforts on removing RTGs along the Arctic coast. However, more than 90 RTGs remain operational along the Baltic coast under control of the Russian Ministry of Defense, which DOE does not plan to remove. DOE officials said that the program will now focus its efforts almost exclusively in the Far East because DOE expects other countries to remove RTGs from the Baltic region. Figure 2 shows the location of the remaining RTGs in Russia, and table 2 summarizes DOE’s efforts, along with other countries, to remove RTGs in Russia. DOE officials told us that the Far East region is now a priority for RTG removal because Russian Ministry of Defense officials have specifically requested DOE’s assistance for the Far East and provided DOE with a prioritized list of RTGs to be removed. In addition, other countries have expressed a willingness to support future RTG removal in the Baltic region. For example, according to DOE, in February 2005 Denmark announced that it had reached an agreement with Russia to replace and remove all RTGs in the Baltic region. Other European nations, including Germany, have also offered assistance. However, Russian officials told us that assistance from Germany has not materialized and that Denmark had rescinded its offer to provide assistance. Moreover, these officials expressed concern regarding DOE’s decision to fund the removal of RTGs exclusively from the Far East region. In their view, the RTGs in the Baltic are more vulnerable and should be removed as soon as possible because of their accessibility and proximity to large population centers. According to DOE officials, if international funding for removal of these vulnerable RTGs does not materialize, IRTR will likely have to fund the Baltic effort. According to DOE and Russian officials, RTG removal is complex and future efforts will face a number of challenges. No comprehensive inventory of RTGs exists and, as a result, the actual number of these devices is unknown. RTGs were originally manufactured in Estonia, but the company dissolved with the collapse of the Soviet Union, and all the records were lost. The Russian organization that originally designed them is currently developing a database of known RTGs in Russia—with U.S. funding and support—to reconstruct records and develop a reliable accounting of the total number of devices produced. However, this effort has been ongoing for years and remains incomplete. Officials from the Russian organization told us that they lack confidence that the precise number and location of RTGs, both in Russia and other countries of the former Soviet Union, will ever be known. RTGs contain sources with high levels of radioactivity, and their removal requires specialized containers for their transport and adequate storage capacity to securely house them once removed. Russian officials reported that RTG removal had been slowed due to a lack of both. To address the need for containers and space, DOE has enlisted Canada’s support to provide funds to Russia for constructing an additional 17 containers for transporting RTGs, bringing the total to 36. However, this effort is not scheduled to be completed until early to mid-2007. DOE is also supporting the construction of storage facilities at two locations in the Russian Far East, Vladivostok and Kamchatka. When completed, the Vladivostok facility is expected to house 150 to 200 RTGs. Moreover, a smaller storage building is under construction at Kamchatka, which will store RTGs until they can be shipped to Vladivostok for permanent storage. According to DOE, the Vladivostok facility houses 25 RTGs that were recovered from the Russian Far East. By the end of 2006, Vladivostok is scheduled to house 33 additional recovered RTGs. Finally, Russian officials told us that future RTG removal efforts will depend on finding a viable, alternative energy source to replace power supplied by radiological sources contained in RTGs. DOE has initiated a project to provide alternative power sources, including wind and solar- powered energy panels to accelerate RTG removal. However these replacements are not always viable. For example, navigational lighthouses located in northern Russia experience severe weather and limited daylight 4 to 5 months per year and cannot rely on solar power during the winter months. Russian Ministry of Defense officials have stated that the navigational devices are critical and that they will not approve removal of any additional RTGs without a viable energy source to replace them. Figure 3 shows a navigational beacon with a solar-powered replacement energy source funded by DOE that we observed during our fieldwork. DOE also noted that RTG removal and replacement has been slowed by challenges in project negotiation with Russian officials. For example, costs of RTG removal and transport have consistently risen as a result of increased Russian price demands and the failure of the Russian government to contribute funds to the effort. DOE has also experienced long delays while waiting for the Russian Ministry of Defense to approve the release of information regarding certain RTGs. Inadequate funding to support RTG removal has extended the deadline for completion from 2014 to 2021. As an interim measure to help reduce the risk posed by RTGs that have not yet been removed, DOE has equipped a select number of RTGs with alarm systems that are remotely monitored via satellite as part of a pilot project. Specifically the alarm consists of sensors that monitor, among other things, vibrations of the device and the source’s movement. Because the source is inside the RTG, the alarms on both the device and its source emit regular, electronic signals to a regional base station. If the signals are interrupted, then the alarm is triggered. As of September 2006, DOE had funded the installation of these security systems for 24 RTGs in the Baltic region and 20 RTGs in the Far East region. According to DOE, the cost of the alarm system is about $5,000, and about $8,000 to establish the regional base station. DOE officials said they will continue to install security upgrades to RTGs as an interim measure, as long as the costs remain at those levels. In addition to RTGs, DOE also has made limited progress securing radiological sources stored at waste storage facilities in Russia and Ukraine. DOE has determined that the storage facilities in Russia and Ukraine are the most vulnerable in the world and pose a significant risk, due to the very large quantities of radioactive sources currently housed at each site. According to DOE, waste storage facilities can store up to 3 million curies of radioactive waste. However, upgrades at a majority of these facilities throughout the former Soviet Union, particularly in Russia and Ukraine, remain incomplete. To date, upgrades at 4 of 15 Radons in Russia have been completed since DOE began work in 2002. According to DOE, upgrades are under way at seven additional Radons. However, work has been delayed at several of these facilities. According to DOE, delays in upgrades to Radons were due in large part to delays in the Russian certification process of physical equipment for upgrades at these types of facilities. In addition, reorganization and managerial changes at the primary Russian agency with oversight authority over construction at Radon facilities presented challenges for DOE officials trying to gain access to Radons for physical security assessments. Furthermore, DOE officials noted that progress has been slowed because several Radon managers were unwilling to participate in the program until they received assurances from DOE that their Radon would receive a level of funding comparable to larger Radons. DOE has not completed upgrades at any of Ukraine’s five Radon sites, one of which contains all 13 RTGs recovered in Ukraine. According to DOE officials, initiating work at the Radons has been problematic because Ukrainian officials have designated some sites as “sensitive” and thus denied DOE access to them. As a result, security upgrades have been delayed for at least 2 years. In May 2005, Ukraine agreed to provide DOE access to two of the five sites, and security upgrades at those facilities are under way. DOE plans to complete the remaining three Radons by 2010 but have found that Ukraine is impeding access to these additional sites. In addition, DOE has identified 49 vulnerable waste storage facilities worldwide for assistance and has completed work at 26 of these sites in several countries, including Armenia, Azerbaijan, Belarus, Estonia, Georgia, Kazakhstan, Kyrgyzstan, and Lithuania. DOE is also undertaking upgrades at 23 additional sites. However, DOE has not addressed sites in the following countries: Albania, Argentina, Bangladesh, Bolivia, Brazil, Ecuador, El Salvador, Ethiopia, Jordan, Libya, Peru, Serbia, and South Africa. It was unclear, based on our discussions with DOE officials, when, if ever, security upgrades would be completed in these countries. Although IAEA officials told us that transportation of high-risk radiological sources is the most vulnerable part of the nuclear and radiological supply chain, DOE determined that source transport is generally outside the scope of the program. Some DOE officials have expressed concern about the lack of security during the transport of radiological sources and questioned whether transportation should be a component of DOE’s program. For example, a May 2005 DOE analysis concluded that DOE was addressing transportation security on an ad-hoc basis, and the existing method of providing transportation security had serious limitations. The analysis also noted that DOE’s current approach is resource limited and lacked a commitment to integrate transport security into all countries participating in the program. According to DOE’s 2003 program guidelines, DOE will fund transportation security upgrades only in Russia and Uzbekistan because the United States had international agreements with these countries to provide liability coverage when transporting radiological sources. As a result, DOE security specialists were not pursuing transportation security-related projects with the majority of countries participating in the program. However, DOE noted that its national laboratories were working with the U.S. Department of Transportation, IAEA, and key IAEA donor states to strengthen transportation security regulations and procedures to reduce the risks of theft or diversion of nuclear and other radioactive materials in transit. In every country we visited, host country officials identified the transportation of sources as a critical vulnerability and a priority for security upgrades. Moscow Radon officials told us that transportation security had emerged as one of their top priorities. DOE has, in fact, provided a fleet of transport vehicles for the Moscow Radon, including guard vehicles, escort vehicles, and cargo trucks for transporting both liquid and solid waste. However, Radon officials told us that they also needed a reliable communication system to ensure the security of sources in transit. Consequently, the Moscow Radon funded a satellite-linked cell phone to facilitate communication and to monitor vehicles that transport radiological sources. However, at another Radon site we visited in Russia, a similar communications system did not exist. Moreover, officials from this site told us that their fleet of transportation vehicles was about 30 years old and needed to be replaced. These officials stated that they requested funds from DOE for the vehicle replacement but were told that no funds were available. Another aspect of transportation security concerns equipment containing small, easily transportable sources—typically weighing less than 25 pounds with an average radioactivity level of several curies. DOE estimates that about 10,000 of these smaller sources exist in several different countries. Specifically these sources, such as americium and beryllium, are used in the oil and gas industry for exploration purposes. According to DOE, these sources routinely move from one base camp to another with limited security, making them vulnerable to theft and potential misuse. We saw first-hand how vulnerable these sources were during our visit to one industrial facility where we observed a truck used to transport a cesium-137 source to a remote gas exploration site. Host country officials showed us how easy it would be to remove the sources from the truck as they were being secured with a simple lock. In addition, country officials told us that although some trucks are equipped with mobile phones, many areas along transportation routes are remote, and the phones often have no signal. Figure 4 shows an unsecured truck used to transport radiological sources. DOE has taken some steps to address this problem, but agency officials said that securing mobile sources is too costly and should be the responsibility of private industry. In this regard, DOE initiated efforts with U.S. industry partners to identify better ways to secure sources that have industrial applications and are frequently in transit. In February 2006, DOE attended a forum with NRC and the Society for Petroleum Engineers to discuss security issues and develop best practices within the industry to better control radiological sources used overseas for industrial purposes. In September 2006, as part of the broader reorganization of its Global Threat Reduction Initiative, DOE established new guidance for selecting sites to receive physical security upgrades. Under the new guidance, DOE has combined its radiological and nuclear material security efforts to develop a single threat reduction strategy. This integrated strategy prioritizes security efforts, based most importantly on the attractiveness of the different types of radiological and nuclear material and (1) their proximity to U.S. strategic interests, such as military bases overseas or commercial ports; (2) external threat environment within the country; and (3) internal site vulnerability, which measures existing physical protection on site. This new criteria also increased the level of the design basis threat required to secure each type of material. For example, sources having a curie level exceeding 1,000 could have the same priority for security upgrades as certain amounts of plutonium or highly enriched uranium. As a result, RTG security remains a high priority, while in DOE’s view, some medical radiological sources could also be considered a high priority. However, when we asked DOE officials in September 2006 about the relative priority of medical sites, they said all of the sites that were upgraded under the old guidance would still be considered high priority under the new criteria. DOE’s previous guidance, developed in 2003, based site selection on a minimum threshold level—measured in curies—of radiological sources present at a particular location. In addition, the guidance factored in other conditions such as the location of the site, the security conditions of the site, and evidence of illicit trafficking in the country. According to DOE, in a presentation made to us in September 2006, this guidance gave equal treatment to all sites within countries receiving security upgrades. This guidance did not clearly discriminate between the different types of sites secured and whether they were considered to be the highest priority. For example, securing a waste storage facility, which can contain up to three million curies, was given the same weight as securing an oncology clinic with one source containing 1,000 curies. Security measures recommended for radiological sources were based on a threat scenario of one outsider penetrating the facility, equipped with a handgun while working with one complicit insider. However, the new guidance significantly increases the threat by advancing a more intense scenario, including six outsiders with automatic weapons and 10 kilograms of explosives working with one complicit insider. As a result, DOE officials said that future upgrades to secure radiological sources will have to be strengthened to meet the new protection levels. Additional enhancements at some sites are now being considered to address a more robust design- basis scenario. DOE experienced numerous problems and challenges during program implementation that impeded its efforts to secure radiological sources. As a result, some projects were delayed, and in some extreme cases, DOE was unable to implement its program at all. DOE said it was limited in its ability to enhance physical protection in several countries because IRTR is a voluntary program. For example, high-risk countries such as Nigeria and Turkey were unwilling to cooperate to implement security upgrades. In addition, Mexico declined DOE upgrades, although DOE had identified several vulnerable sites. While Mexico has continued to decline physical security assistance, Mexican officials have since agreed to accept regulatory infrastructure development assistance. In targeting countries to receive assistance, DOE developed a prioritization model that ranked countries as high, medium, and low risk. To date, DOE has initiated work in 49 of the countries identified as priorities for assistance. Our analysis showed that DOE attempted to initiate efforts to secure radiological sources in 31 high-priority, 17 medium-priority and one low-priority country. Consequently, about 40 percent of countries receiving assistance do not represent the highest- priority countries. According to DOE officials, medium and low-priority countries-—more than one-third of the total in DOE’s program—were selected because these countries had expressed a willingness to receive assistance. We found a variety of problems and challenges that affected DOE’s ability to implement its program in several of the countries targeted for assistance. These included, among other things, problems with foreign contractor performance and lack of adequate physical infrastructure to support security upgrades. DOE officials said that various combinations of these and other impediments resulted in delays implementing security upgrades in about 75 percent of all countries participating in the program. DOE also stated that many of these problems were identified and corrected during quality assurance visits by DOE inspection teams. Contractor performance emerged as a key challenge. Six DOE officials told us that contractor performance and selection of reputable, reliable in- country contractors was critical to successful project implementation. DOE asserted that it has to maintain flexibility in selecting foreign contractors because most of the countries do not follow normal Western business practices. In DOE’s view, problems arising from contractor performance resulted from “security culture” and language barriers, which caused miscommunication. Some problems we found with reliable in- country contractors included the following: In Bulgaria, a contractor installed steel security doors—which protected radiological sources—with the hinges on the outside of the door. As a result, a potential transgressor could have unhinged the door and accessed the sources; In Kazakhstan, a contractor provided security manuals and procedures for newly installed equipment in English instead of the native language. As a result, DOE officials found that the hospital staff had not changed the security codes and were not well versed in proper security procedures; and In Georgia, hospital staff told us that the contractor did not train them on operating the alarm systems. DOE did, however, report working with competent contractors in Poland, Lithuania, and Egypt that resulted in timely project implementation. DOE project managers for these countries told us that contractors conducted adequate training and followed up with security upgrades maintenance. Several DOE officials told us that implementing security upgrades also presented challenges due to inadequate physical infrastructure. In these countries, the types of challenges included lack of reliable electricity, a backup power source, and telecommunications at sites containing radiological sources. For example, in both Nicaragua and Tanzania, DOE officials said that frequent power outages diminished the detection capability of security alarms installed and that neither country had a backup source of power to operate the security alarms and security lighting provided by DOE. DOE has not developed an adequate comprehensive strategy to better ensure that physical security upgrades that have been installed, and the security training that has been provided, will be effectively sustained over the long term. DOE’s current guidance states that DOE will sustain upgrades by providing countries with a 3-year warranty on newly installed security equipment and preventative maintenance contracts, as well as providing training on newly installed equipment for operational staff at the sites. However, DOE has not formulated a long-term sustainability plan that identifies expected completion dates for each country, including an exit strategy, and approaches for sustaining upgrades, including how host countries will financially continue maintenance of upgrades following DOE warranty expiration. In fact, a senior DOE official told us that responsibility for drafting and implementing long-term sustainability should be that of the host country. Furthermore, DOE has not adequately addressed the lack of regulatory infrastructure to provide oversight of source security in a majority of countries to receive DOE assistance. DOE officials responsible for program implementation said that they were uncertain that security upgrades installed would be sustained by countries once DOE assistance was no longer available. In fact, our analysis showed that these officials had confidence that the security upgrades would be sustained in only 25 percent of the countries. Specifically, officials pointed out that countries, such as Bangladesh or Tajikistan, would be unlikely to sustain upgrades because they do not have the resources to maintain the equipment and have not identified or allocated funding to maintain them beyond the 3-year warranty period. In addition, several host-country officials with whom we met expressed similar concerns. For example, hospital administrators in three countries told us that hospital budgets were already strained and that they could not be certain that funding would be available once the warranties expired. Moreover, hospital administrators told us it was difficult to estimate the level of resources needed to sustain the upgrades because DOE had not provided them with future maintenance costs. Several sites that received DOE upgrades have already experienced maintenance problems. For example, in Georgia, we found that a storage facility containing RTGs and a seed irradiator—which has thousands of curies of a cesium-137 source—had several large openings in the roof. When we asked host government officials about the cause of the openings, they stated that a recent storm had shifted the metal sheets covering the storage facility’s roof. The officials did not state when the roof would be fixed or how funds would be allocated for the repair. In addition, we found that surveillance monitors were not being used at a medical facility. In fact, according to the hospital staff, the monitors, which were not broken, had been turned off for several days. In Lithuania we visited an oncology clinic and observed that the security cable, used to secure a teletherapy machine’s cobalt-60 source, had been broken for almost a month. According to a DOE physical protection specialist, the cable was the most important security feature because it triggered an alarm directly connected to the teletherapy machine’s “head,” which contains the radiological source. According to DOE, this was subsequently corrected as part of program assurance procedures. In addition, in Poland, we visited a research facility containing a 22,000 curie irradiator. We observed that the motion detection device in the room housing the irradiator was not working because of the high level of radioactivity present. According to the in-country contractor, the device had been disabled at least three times since the equipment was installed about a year earlier. Figure 5 shows the temporary storage facility with large openings in the roof, and figure 6 shows the broken cable at the oncology clinic. In addition to maintenance problems, we also found that a lack of adequate training on newly installed equipment further raised questions about the long-term success of the program. According to the hospital staff at a facility in Georgia, they had not received adequate training from the in-country contractor on how to operate the installed alarm systems. We found similar problems in other countries we visited. For example, at some of the hospitals, security codes allowing entry into rooms where sources were located had not been changed on a regular basis. Also, at one medical site, more than 50 staff had access to the security code for a room storing a radiological source of about 1,250 curies. A DOE physical security specialist reported that the security code had not been changed from the default settings in at least three FSU countries. Furthermore, this specialist noted that staff in charge of protecting the equipment had copied security access codes onto checklists that were readily accessible to unauthorized staff in about 15 countries. According to DOE, another key element of sustaining security of sources is having an organized, competent guard force. In general, the guard force serves as a critical communications link between the facility staff and the response force. We found that several of the 49 countries did not possess adequate guard or response forces, and in several cases, the guard forces in these countries were untrained and unarmed. Specifically, at one site that DOE upgraded, the guard with whom we spoke was unarmed and had no viable form of communication in the case of an emergency. At the same site, the guard told us that he shared responsibility for site security with an individual who served as a guard on a part-time basis in exchange for being able to live at the site. Moreover, we found that the absence of a reliable source of electricity made it difficult to complete and ensure the sustainability of alarms and motion detection devices in some of the countries receiving upgrades. For example, both Ecuador and El Salvador have limited telephone line access. As a result, according to DOE, the local guard forces could not be contacted immediately after an alarm was triggered at a site containing radiological sources. Consequently, security alarms installed in lesser developed countries may have marginal long- term impact. At some of the facilities we visited, there appeared to be a well trained guard force equipped with flashlights, radios, walkie-talkies, or cell phones. However, we also found that even at locations where improved security systems were in place, only a single guard was present and had no reliable method of contacting a response force. In these types of situations, according to DOE, the site is very vulnerable to theft. At one facility in Lithuania, we were told that the police were located about 30 minutes from the site. At that facility, we observed that the guards were not equipped with guns, and officials were not sure they were always present. However, DOE did fund remote monitoring equipment, which allowed the local police force to view the site 24 hours per day from the police station. According to IAEA experts and at least five DOE and NRC senior level officials, a strong and independent nuclear regulatory authority that is able to provide effective radiological source oversight is critical to program sustainability. A key function of a nuclear regulatory body is to establish procedures for the control of radiological sources, including the development of a basic registry of sources. The absence of reliable registries in many countries impeded DOE’s ability to identify a comprehensive list of sites to upgrade. Also, the absence of such a list complicates DOE’s ability to determine when it has completed its program in a particular country. More specifically, DOE physical security specialists told us that sources that had been identified and inventoried at various hospitals were subsequently moved to another location within the facility or are no longer being used. Consequently, some of the upgrades that DOE installed had limited security impact, or DOE has had to fund additional upgrades for the same source. We previously reported that DOE was focusing its source security program too narrowly on physical security upgrades and not taking into account respective countries’ long-term needs to develop better nuclear regulatory infrastructures. DOE recognized the critical role of regulatory infrastructure development midway through the program and subsequently added a small regulatory infrastructure development component that is designed to support the creation and strengthening of effective and sustainable national regulatory infrastructures. DOE officials told us that the department’s regulatory infrastructure development efforts are meant to complement the more comprehensive efforts of IAEA. In 1994, IAEA established a “model project” program to enhance countries’ regulatory capacity, and the program was available to any member state upon request. IAEA continues to provide a variety of regulatory infrastructure support services and training to both member and nonmember states to support radiological source security and safety. The director of the IRTR program said that the long-term impact of DOE’s program would likely have been enhanced had there been a stronger regulatory infrastructure in place to support the recommended security upgrades efforts in many of the countries. However, many countries participating in the IRTR program—specifically lesser developed countries—lack an independent regulator. According to IAEA, as many as 110 countries worldwide lacked the regulatory infrastructure to adequately protect or control sealed sources as of 2003. As of August 31, 2006, DOE spent approximately $108 million to implement the IRTR program. This money was spent to, among other things, conduct vulnerability assessments at a variety of sites containing radiological sources and to install physical security upgrades at these sites, such as hardened windows and doors, motion sensors and surveillance cameras. Russia received almost one-third of total DOE funding—about $33 million—which focused primarily on orphan source recovery, RTG removal and disposal and physical security upgrades at waste storage facilities. However, one-fourth of total expenditures—about $26.5 million—paid for program planning activities such as development of program guidance documents, hiring private consultants, and conducting studies. The program has also carried over large balances of unspent, unobligated funds each fiscal year since its inception in 2002, because of, among other things, large supplemental appropriations at the onset of the program and systemic delays in project implementation. DOE officials told us that securing radiological sources in other countries is a lower priority than securing more dangerous nuclear materials, such as plutonium and highly enriched uranium. As a result, DOE reduced funding for radiological security activities and future funding for the program is uncertain. DOE program officials are concerned that DOE may be unable to meet outstanding contractual commitments to maintain the more than $40 million in upgrades already installed. As of August 31, 2006, DOE had spent about $108 million to implement the IRTR program. A majority of this money—$68 million—was spent to (1) physically secure sites containing radiological sources; (2) locate, recover, and dispose of lost or abandoned sources; and (3) help countries draft laws and regulations to increase security and accounting of sources. In addition, DOE provided $13.5 million to IAEA to support activities to strengthen controls over radiological sources in IAEA member states. However, one-fourth of the total budget—about $26.5 million—was spent on program planning activities not directly attributed to a specific country, such as hiring private consultants, and building a database for international law enforcement officials. Table 3 provides a breakdown of DOE program expenditures. Physical security upgrades to secure sites containing radiological sources accounted for the largest program expenditure—almost $43 million. The majority of DOE-funded upgrades were at hospitals and oncology clinics. DOE also funded upgrades at other types of facilities that utilize or store radiological sources and materials, including waste storage facilities, commercial and industrial facilities, and other research institutes. While DOE estimates that costs for each facility type range from $15,000 to secure a medical facility to $50,000 to secure a waste storage facility, actual expenditures for securing sites varied based on factors such as regional labor rates, conditions of existing infrastructure, and remoteness of location. DOE officials stated that cost estimates of upgrade projects included vulnerability assessments, equipment costs and installation, and warranty contracts covering equipment maintenance for three years. DOE physical security specialists conducted vulnerability assessments to identify security weaknesses at facilities, including adequacy of the local guard force, exposed windows and doors, and access to sources. In some instances, mostly at lower-risk sites, DOE authorized contractors responsible for equipment installation to conduct these assessments with direction from DOE. The contractors provided DOE with reports and photographs that summarized findings and proposed recommended upgrades. Types of upgrades installed varied based on assessment findings and host country laws and policies, but standard equipment packages consisted mostly of hardened windows and doors; motion sensors and alarms; access control systems, such as coded keypads or swipe card entry; security cameras; and video monitoring. At some sites, DOE also provided guard forces with enhanced communication equipment, including radios and mobile panic buttons that send emergency signals to local police or security companies. Installation costs also included training for on-site personnel that would be responsible for operating the equipment. Costs of physical security upgrades also included 3-year warranty contracts that cover maintenance costs, such as the cost of remote monitoring and spare parts. DOE officials told us that contracts are negotiated with contractors responsible for equipment installation and require that countries receiving assistance assume the costs of sustaining the equipment no later than three years after the upgrades have been installed. For the duration of the warranty period, DOE estimated that, on average, it would cost $40,000 per country, per year to maintain equipment. This estimate includes sending one DOE team per country, per year to conduct assurance visits, any equipment contractors have to replace, and costs of remote monitoring systems. DOE also spent $23 million to provide countries with radiation detection equipment and training to locate and recover lost or abandoned radiological sources and secure them in interim or permanent storage facilities. DOE has two programs to support orphan source recovery efforts—the Russian Orphan Source Recovery program, which is focused solely in Russia, and the Global Search and Secure Program, which includes search and recovery efforts in other countries receiving DOE assistance. More than 80 percent of orphan source recovery expenditures were spent in Russia—about $19 million. To support GSSP, DOE spent $4 million in 11 countries—Azerbaijan, Croatia, Estonia, Indonesia, Kazakhstan, Kyrgyzstan, Latvia, Philippines, Romania, Tajikistan, and Tanzania. These funds were spent primarily to provide countries with (1) standard packages of equipment such as hand-held radiation detection monitors and characterization instruments to properly identify recovered sources; (2) training workshops on the appropriate use of the equipment; and (3) physical security upgrades at some facilities storing recovered or disposed sources. In addition, DOE spent about $2 million in ten countries (Bulgaria, Colombia, Indonesia, Iraq, Kazakhstan, Mexico, Moldova, Philippines, Thailand, and Vietnam) to help develop national standards and regulations for the control and accounting of radiological sources. A majority of these funds were spent in the United States—$1.8 million—to develop a set of security-based regulations to be utilized by countries with limited resources and inadequate radiological source inventories. Once countries drafted an initial set of regulations, DOE experts reviewed drafts and provided feedback and proposals for improvement. DOE also provided training workshops and seminars on appropriate regulatory inspection practices for radiological source controls and accounting. In particular, DOE has been working with regional partners, such as the Australian Nuclear Science and Technology Organization (ANSTO), to implement many of its regulatory development activities. For example, DOE and ANSTO have conducted regulatory development training workshops for countries located in East Asia and the Pacific region. DOE also provided about $13.5 million to IAEA’s Nuclear Security Fund to support efforts to strengthen controls over sources with IAEA member states, including technical training on fundamental principles and objectives of radiological source security. IAEA established the fund, which consists of voluntary budget contributions from other countries, after the terrorist attacks of September 11, 2001. The fund is designed to improve nuclear security in IAEA member states by helping countries to protect their nuclear and radiological materials and facilities. Specifically, DOE funded IAEA missions that carried out safety and security assessments at sites identified by member states containing vulnerable radiological sources. Additionally, DOE contributions to IAEA supported training conferences and other advisory services. DOE funds also enabled IAEA to transport several high-risk sources to secure storage facilities and provide conditioning equipment to prepare recovered sources for disposal. Finally, DOE spent one-fourth of total program expenditures—about $26.5 million—on activities not directly attributed to a specific country. Specifically, these costs included, among other things, program planning activities such as the development of program guidance documents. For example, DOE hired an outside contractor to conduct a review of the radiological source security program and to help DOE develop a plan to guide future efforts. The contractor spent several months interviewing agency officials and program staff to assess the strengths and weaknesses of the program and the level of DOE coordination with State, NRC, and IAEA. The final report provided recommendations to improve coordination with other U.S. agencies and within DOE. In addition, DOE spent $1.5 million of these funds to facilitate an information exchange with Interpol, an international agency that coordinates the law enforcement activities of the national police bureaus in each of its member states, in order to obtain information about international arrests involving theft or smuggling of radiological materials. DOE’s intent was to provide Interpol the capacity to contribute law-enforcement data into DOE’s database, which contains country-specific information regarding, among other things, criminal activity. Funds provided to Interpol paid for computers and software and the salaries for two staff located at Interpol headquarters in Lyon, France, to set up and operate the database for two years. A DOE program manager expressed concern about whether providing funds to Interpol would provide tangible results or increase the effectiveness of the radiological sources program. This program manager questioned whether the Interpol project contributed to the program’s core objectives of securing the highest risk, highest priority sources in other countries. A senior DOE official told us that these funds—identified by DOE as strategic development and program integration funds—were established at the onset of the program and were intended to carry out activities not directly related to country-specific physical security upgrade projects and initiatives. This official added that in the early stages of the program, expenditures of this type focused primarily on strategic planning, developing program technical documents and processes, conducting studies, and developing a database of regional country information to support program objectives. While DOE assistance was spread among 49 countries, Russia received the largest amount, $33 million, nearly one-third of total program expenditures. DOE’s cost manager for the IRTR program reported that expenditures in Russia supported three primary program components: (1) orphan source recovery efforts ($18.5 million); (2) RTG removal and disposal, including alternative energy source development ($7 million); and (3) physical security upgrade projects, including waste repository sites ($7.5 million). The 13 other FSU countries received a total of about $11 million, with Ukraine being the largest recipient, receiving about $3.5 million. In addition, about 65 percent of DOE expenditures in FSU countries was spent in these countries for services, equipment, and materials that were used to improve physical security. By comparison, DOE spent significantly less outside the FSU, and expenditures in these countries were both modest by comparison and disproportionately spent in the United States by DOE’s national laboratories for labor, travel, equipment and overhead costs. For example, the 35 non-FSU countries received a total of about $17 million, or just 28 percent of total country-specific expenditures. Two-thirds of funds spent for non-FSU countries were spent in the United States. Furthermore, five countries in Africa received no in-country expenditures. Although many countries in Africa have been defined as high-risk by DOE, countries in this region received a total of about $1.3 million, about two- thirds the amount spent in one European country—Poland. While expenditures in South America were more evenly divided between in- country costs and funds spent in the United States, the region received only about $3.5 million spread among 12 countries. Figure 7 provides a regional breakout of these expenditures. Additionally, see appendix II for more details about regional and individual country expenditures for fiscal years 2002 through 2006. As of August 31, 2006, DOE had carried over almost $23 million in unspent or unobligated funds for the IRTR program from previous years. Moreover, the program consistently carried over a substantial uncosted balance each fiscal year throughout the life of the program. For example, for fiscal years 2003 through 2005, the program carried over uncosted funds totaling $27.4 million, $34.1 million, and $22.4 million, respectively. According to the program’s director, a majority of carryover balances were due to, among other things, large supplemental appropriations at the onset of the program and delays in implementing security upgrade projects. As we reported in 2004, large carryover balances are not uncommon in DOE nuclear nonproliferation programs—especially in Russia—because of, among other things, difficulties in negotiating and executing contracts and the multiyear nature of programs. Table 4 shows DOE total budget and uncosted balances for fiscal years 2002 through 2006. DOE has significantly decreased IRTR program funding since 2003, and DOE officials expect further reductions over the next several years. Specifically, DOE’s internal budget allotments for the IRTR program have gone from a high of $38 million in fiscal year 2003 to $24 million in fiscal year 2006. According to a senior DOE official, priorities within GTRI, which funds DOE’s nuclear and radiological threat reduction efforts, have shifted, and future funding will be redirected to, among other things, securing special nuclear material, such as plutonium and highly enriched uranium (HEU). In particular, DOE has assigned the highest budget priority to three specific GTRI elements that address the threats posed by an attack using an improvised nuclear device: the (1) Reduced Enrichment for Research and Test Reactors program, (2) Russia Research Reactor Fuel Return program, and (3) Foreign Research Reactor Spent Nuclear Fuel program. The goal of the Reduced Enrichment for Research and Test Reactors program is to get research reactors around the world to convert from HEU to low enriched uranium with conversion of all U.S. civilian research reactors to be completed by 2014. The Russia Research Reactor Fuel Return and Foreign Research Reactor Spent Nuclear Fuel programs are designed specifically for returning HEU to the United States or Russia and are expected to be completed by 2013 and 2019, respectively. In contrast, other GTRI elements, including the IRTR program, do not have presidential commitment dates for completion and, as a result, are lower priorities for funding. DOE’s Principal Assistant Deputy Administrator for Defense Nuclear Nonproliferation, told us that DOE initially placed a high priority on securing radiological material and the Secretary of Energy made a personal commitment to this activity. More recently, because of budget reductions affecting the entire agency, DOE has had to review and evaluate program priorities. This official noted that while the likelihood of a dirty bomb attack is much greater than a nuclear attack, the consequences in terms of loss of life and the overall catastrophic impact of the latter would be much greater. He also noted that, if given a choice, he would place more emphasis on securing radiological sources in the United States than in other countries. In his view, there is still a significant amount of work to be done to secure radiological sources in the United States. Future anticipated reductions in funding for the IRTR program will have significant implications for the amount of sources that can be secured in other countries. DOE’s initial target for program completion was to secure 1,500 high-priority sites in 100 countries by 2014. This goal assumed that the program would receive $25 million per year over the life of the program. DOE officials told us that currently projected budget reductions may jeopardize the program’s ability to fund even the existing warranty contracts applied to physical security upgrades already installed. Moreover, DOE has not determined the extent to which the program will fund warranties for future upgrade projects meaning countries will need to assume greater financial responsibility for sustaining upgrades. However, DOE officials who are responsible for project implementation told us they lacked confidence that a majority of countries would be able to maintain upgrades without further DOE assistance, mostly because many recipients do not have adequate resources. For example, DOE officials responsible for project implementation said that neither Ukraine nor Tajikistan, where DOE has spent a total of about $3.5 million, has identified resources for radiological source security once DOE warranties expire. In addition, DOE has not fully addressed the cost implications of the increased levels of physical security required by the new design basis threat assigned to radiological sources under GTRI’s reorganization. Although DOE’s new program guidance says that the radiological security upgrades strategy will continue to focus on inherently sustainable, low- cost upgrades, it specifically states that the revised threat scenario significantly increases the threat that physical security upgrades must withstand. As a result, the new guidance states that upgrades will need to be significantly enhanced to meet the new threat level. DOE officials have raised concerns regarding DOE’s ability to sustain low-cost upgrades already installed. In light of the program’s ongoing budget reductions, the new guidance raises further concern regarding DOE’s ability to sustain the increased cost of enhanced upgrades for future projects. To offset anticipated shortfalls in funding, DOE plans to seek international contributions to secure radiological sources in other countries. DOE officials said that several countries, including, Canada, Japan and Norway, have inquired about contributing funds directly to GTRI but that, until recently, DOE had no authority to accept direct financial support from international partners for GTRI activities or to use funds received outside of the normal appropriations process. In October 2006, Congress authorized DOE to enter into agreements, with the concurrence of State, to receive contributions from foreign countries and international organizations for IRTR and other GTRI programs, and to use those contributed funds without fiscal year limitation. Additionally, Russian officials told us that because of the importance of the IRTR program, they are interested in providing increased financial commitments to secure radiological sources. In particular, the Deputy Head of the Russian Radon waste storage facilities, known officially as the Federal Agency for Construction and Utilities, told us that the organization would be willing to make a sizeable contribution to Radon upgrades. DOE officials stated that international source security is not the sole responsibility of the United States government and that increased foreign cooperation will be necessary to complete program objectives. DOE has improved coordination with State and NRC to secure radiological sources worldwide. Since we reported on this matter in 2003, DOE has involved State and NRC in its international radiological threat reduction activities more often and has increased information-sharing with the agencies. However, DOE has not always integrated its efforts efficiently and coordinated efforts among the agencies have been inconsistent. Moreover, DOE has not adequately coordinated the activities of multiple programs within the agency responsible for securing radiological and nuclear materials in other countries and, at times, this has resulted in conflicting or overlapping efforts. DOE has improved coordination with IAEA to strengthen controls over other countries’ radiological sources and has developed bilateral and multilateral partnerships with IAEA member states to improve their regulatory infrastructures. DOE funding to IAEA has supported, among other things, IAEA missions to assess the safety and security of sites containing radiological sources and IAEA-sponsored training programs and regional workshops focusing on radiological source security. However, significant gaps in information-sharing between DOE and IAEA, and with the European Commission, have impeded DOE’s ability to target the most vulnerable sites for security improvements and to avoid possible duplication of efforts. In recent years, DOE has improved coordination with State and NRC and has taken steps to work more collaboratively with U.S. agencies to secure radiological sources in other countries. An example of improved U.S. coordination is the interagency effort to establish a radiological source regulatory infrastructure in Iraq. Since 2003, with the support of DOE and NRC, State has led the effort to establish the Iraq Radioactive Source Regulatory Authority (IRSRA) and develop a radiological regulatory infrastructure in Iraq. State and DOE provided IRSRA with equipment, training, technical assistance, and funding to help the new agency assume increased responsibility for establishing radiological source regulations and procedures consistent with international standards. Specifically, with funding and logistical support from DOE, State coordinated several meetings in Amman, Jordan, in 2004 and 2005 to provide IRSRA personnel training by IAEA staff. These meetings resulted in the development of new Iraqi laws and regulations for the regulation, transport, import and export of radiological sources, including physical security requirements. DOE experts reviewed draft Iraqi laws and regulations for their relevance to the security of radiological sources, and NRC provided guidance for developing import and export controls for radiological sources. State also funded procurement of mobile radiation detection equipment so that Iraqi regulatory personnel can survey various cities to search for orphaned radiological sources. This equipment, provided by DOD’s Defense Threat Reduction Agency, included radiological handling, measurement, and protective equipment, such as radiation meters, respirators, and protective clothing. Hand-held radiation equipment from DOE has also been transferred to Iraqi agencies for border monitoring. DOE experts also trained IRSRA officials and personnel on how to conduct vulnerability assessments. Finally, to financially support IRSRA’s efforts, State provided a portion of $1.25 million in funding from its Nonproliferation and Disarmament Fund (NDF), to IAEA for training and other assistance to IRSRA, including an IAEA review of Iraq’s draft laws and regulations. State also used a portion of this funding to purchase a specially equipped vehicle that can be driven through neighborhoods to detect unsecured radiological sources. DOE and State officials told us that although the Iraq project is a unique circumstance, it is an example of improved U.S. government coordination to strengthen controls over radiological sources and could provide a model for future efforts. Although coordination among the agencies has improved, these efforts have been inconsistent and there is no comprehensive governmentwide approach to securing radiological sources overseas. We reported in 2003 that DOE’s efforts to secure sources in other countries had not been well coordinated with those of other U.S. agencies. Specifically, DOE had not fully coordinated with State and NRC to leverage program resources, maximize available expertise, avoid potential duplication of efforts, and help ensure the program’s long-term success. We also recommended that DOE take the lead in developing a comprehensive governmentwide plan to strengthen controls over sources in other countries. In response to our report, DOE hired a consultant to determine, among other things, whether gaps exist in agency program activities with respect to securing radiological sources worldwide and what role and responsibilities DOE should assume in coordinating U.S. government efforts. In December 2004, the consultant reported that although DOE had addressed many of its issues with State and NRC, more effective coordination was needed. Moreover, the consultant stated that the lack of effective coordination among these agencies posed the greatest potential for conflict, as a result of differing mandates and conflicting philosophical approaches to radiological source security. Specifically, effective and systematic coordination between U.S. agencies has been impeded at times because individual agency missions differ and, as a result, agency efforts have been, at times, at odds with one another. For example, the consultant reported that NRC had expressed concern that DOE’s regulatory infrastructure development activities infringed on a decades-long NRC function. Furthermore, DOE is primarily concerned with security of sources while NRC has traditionally focused more on safety issues related to the use of sources. The report also concluded that the debate between DOE and NRC over the importance of the safety versus the security of radiological sources had negatively impacted effective coordination between the two agencies. DOE, State, and NRC have differed on, among other things, funding and implementation of regulatory infrastructure development activities in other countries. For example, in May 2003, NRC’s Office of International Programs sought $5 million in appropriated funds to assist its regulatory counterparts in the FSU and countries of central and eastern Europe to enhance (1) existing laws, rules, and regulations governing use of radiological sources; (2) mechanisms used to track radiological sources, such as databases and registries; and (3) day-to-day regulatory oversight of sources. NRC stated in its request that DOE’s physical security enhancements would not likely be sustained in the medium to long-term absent clear, enforceable regulatory requirements. Moreover, NRC sought to assist DOE by providing assistance to regulatory authorities in the FSU, where a majority of DOE’s efforts were focused at the time. NRC officials noted that the biggest challenge they have faced has been identifying adequate, reliable, and predictable funding to support international assistance activities. NRC, unlike other U.S. government agencies, has largely relied upon other agencies—Departments of State, Energy and Defense—to support its international programs and is required by law to recover about 90 percent of its annual budget authority through licensing and inspection fees assessed on the U.S. nuclear industry. Furthermore, the U.S. nuclear industry has raised concerns about using NRC funds to support international assistance. Despite these funding limitations, NRC has a long history of supporting regulatory strengthening efforts in the countries of central and eastern Europe and the FSU. These efforts have included training other countries’ regulators in all aspects of licensing and inspection procedures and developing a control and accounting system for nuclear materials. In July 2003, the Senate Appropriations Committee directed that $5 million out of certain amounts appropriated to NNSA be made available to NRC for bilateral and international efforts to strengthen regulatory controls over radioactive sources that are at the greatest risk of being used in a dirty bomb attack. In September 2003, according to the Director of the NRC Office of International Programs, NRC and the Director of DOE’s International Materials Protection, Control and Cooperation program reached an initial agreement in principle, whereby DOE would provide NRC with $1 million per year for 5 years to conduct regulatory activities in countries outside of Russia. According to DOE officials, the funds were never transferred because the Senate withdrew the direction to allocate the funds to NRC during conference negotiations because the House did not provide comparable language in its report. DOE officials added that the provision directing the transfer to NRC did not appear in the final conference report and was not included in the appropriation legislation. Furthermore, these officials added that DOE was directed by guidance received from House Energy and Water Development Subcommittee staff to not transfer the funds. According to a senior NRC official in the Office of International Programs, the conference report included a joint explanatory statement, which directed that allocations set forth in the House and Senate reports “should be complied with unless specifically addressed to the contrary in the conference report and statement of the managers.” NRC asserts that this reinforced the intent of the original Senate report, and that without language to further clarify or to state otherwise, NRC should have received the funding as originally directed by the Senate Appropriations Committee. The conference report does not specifically address this funding issue. In addition, in 2003, NRC requested $1 million from State to support radiological source-related regulatory strengthening activities in Ukraine. Specifically, NRC proposed to develop a national registry of radiological sources and strengthen Ukraine’s overall radiological source-related laws, rules, and regulations. NRC chose Ukraine because of its relatively large inventory of high-risk radioactive sources; the stability of its existing nuclear regulatory infrastructure; and NRC’s long-standing history of assisting Ukraine’s nuclear regulatory authority, the State Nuclear Regulatory Committee of Ukraine (SNRCU). NRC requested funding for the Ukraine project from State’s Nonproliferation and Disarmament Fund. The total cost of the project was estimated at $2.2 million. The original proposal, as approved by State, stated that the project’s aim was to establish key elements of a national system to provide long-term security of high-risk radioactive sources in Ukraine by utilizing NRC’s overall expertise and experienced contractor personnel. Furthermore, the proposal stated that because NRC and its contractors had been involved in an identical program in Armenia for the previous 2 years the effort in Ukraine would capitalize on those experiences, utilizing much of that background data and materials. However, managers for NDF projects ultimately decided that State would not use NRC resources and would undertake and manage the project itself, even though the agency had no prior experience in directly supporting regulatory infrastructure development in Ukraine. According to a State official, the agency made this decision because, among other things, NRC planned to hire a contractor—the Ukrainian State Scientific and Technical Center—to manage the project, which would have increased the project’s overall cost by about 20 percent. State officials said that their approach departed from that which was originally envisioned by NRC in the original proposal in many respects. However, the NDF has always reserved the right to implement its projects as it deems appropriate. These officials added that State chose to work directly with the Ukrainian regulator instead of the State Scientific and Technical Center because, among other things, the approach streamlined oversight and accountability for project performance and reduced overhead expenses. According to the NDF manager of the Ukraine project through October 2005, the Ukraine project experienced significant delays. However, State officials told us the project is currently on track. Following a November 30, 2006 meeting with State officials to discuss our draft report, State provided us a letter from the Deputy Chairperson for SNRCU dated December 4, 2006. The letter states that SNRCU views the Ukraine project as one of the most successful and efficient international assistance projects between the United States and Ukraine and that the project was implemented in the shortest possible time period. Finally, State and NRC raised concerns when DOE with IAEA developed a set of draft regulations on the physical security of radiological sources. Although the draft regulations had not been through a formal IAEA review process, DOE had intended to distribute them during IAEA-sponsored training workshops to assist member states to strengthen regulatory controls over their sources. Specifically, NRC officials expressed significant concerns that DOE was planning to distribute unofficial guidance to countries that was in conflict with U.S. regulations. In a December 2004 memorandum to the Deputy Director General of Nuclear Safety and Security at IAEA, NRC stated that publishing interim guidance that had not been reviewed in advance, and as a result may need to be substantially modified, was neither efficient nor effective. State officials told us that their chief concern was the manner in which any such guidance would be construed abroad. These officials added that many of the specific problems associated with the original DOE draft guidance lie with internal issues regarding the process for reviewing security documents at IAEA. In addition, they said that concerns over the development of IAEA guidance on security of radioactive sources, which preceded development of the draft regulations, are long standing and that State has worked consistently with IAEA to develop and implement a consistent process for preparation and review of security guidance similar to the established process used by IAEA to develop safety guidance. Following informal discussions with State and NRC, DOE did work with the agencies to ensure that draft guidance was consistent with established domestic and international guidance and protocols. IAEA has since proposed a new Nuclear Security Series and review process, and the DOE draft regulations will now support a new IAEA Security Series document entitled “Security of Radioactive Sources,” which was coordinated with State and NRC. Our 2003 report concluded that DOE has the primary responsibility for helping other countries to strengthen controls over their radiological sources. We recommended that DOE take the lead in developing a comprehensive governmentwide plan to accomplish this goal. In addition, DOE’s consultant report stated that DOE, in its view, is the only U.S. government agency with the resources to focus solely on international source security. Similar to our recommendation, the consultant report recommended that DOE take the lead in adopting an interagency, site- specific approach to international radiological source security, including development of a long-term strategy that leveraged resources and leadership of other agencies. DOE officials said the department has not implemented these recommendations to initiate and lead a governmentwide plan for the security of radiological sources in other countries because it does not have the mandate to instruct other U.S. agencies on how to conduct their efforts, and other agencies’ programs are not within DOE’s control. However, DOE is currently taking steps, as part of the GTRI reorganization, to address several coordination issues within the department, including establishing regional points of contact to interface with other U.S. agencies to coordinate interagency efforts. The 2004 consultant report also concluded that DOE had not adequately coordinated the activities of multiple programs within DOE that are responsible for securing radiological and nuclear materials in other countries. As a result, these programs often worked at cross-purposes. For example, we visited a site in Poland that housed several nuclear facilities including a radiation waste management plant and Poland’s nuclear research reactor. Country officials managing the site told us that DOE had conducted vulnerability assessments of each of the facilities, one of which stored several high-risk radiological sources as well as spent fuel from the research reactor. Although the material was collocated in the same storage facility, we observed that the sources had been secured in a locked cage by the IRTR program, but the spent fuel had no security and was being stored unprotected in underground canisters. Figure 8 shows secured radiological sources collocated with unsecured spent fuel contained in underground storage. Polish officials told us that installation of DOE physical security upgrades at the site had been inconsistent and not adequately coordinated by DOE. Furthermore, security officials that had installed the physical security upgrades told us that the overall security in the facility was inadequate, given the types of nuclear and radioactive material being housed there. The director of the site said that he expressed concern to DOE about the lack of security of the spent nuclear fuel and requested similar upgrade improvements. However, he said that it was his understanding that DOE’s radiological program was only authorized to fund radiological source security upgrades and not the security of spent nuclear fuel, which was the responsibility of DOE’s nuclear security upgrades program. The director of the facility, and his staff, said that it was unclear to them why DOE could not concurrently secure nuclear and radiological material stored at the same site and what can and cannot be secured by different DOE entities. The director added that it sends the wrong signal to host country officials when DOE programs have such different security approaches and time frames for implementing security upgrades. Subsequent to our visit, DOE sent a letter to Polish government officials in March 2006 offering to return to Poland and provide further DOE technical and financial support to protect the nuclear material stored at the facility. Within the IRTR program, different components of the program are led primarily out of two DOE national laboratories, and we found that the laboratories, at times, applied different approaches to securing radiological sources. For example, according to a senior DOE program manager, each laboratory employs its own physical security specialists and in turn, applies its own approach to conducting vulnerability assessments and selecting physical security upgrades. During our site visits, we observed that similar types of facilities varied in terms of the types of upgrades installed and that security measures were not standardized. For example, we toured numerous oncology clinics and found that, although they housed the same equipment and radiological sources, they had received different upgrades as a result of assessments conducted by different laboratory security specialists. Specifically, teletherapy units in certain countries had fiber optic cables attached to the sources that sent alarm signals if the device was tampered with. Security specialists traveling with us at those sites told us that the cable was the key security feature for this type of device. However, during a meeting with a senior security specialist from a different laboratory, we were told that his teams do not install fiber optic cables as part of security upgrades to the same devices because the cables can break. We also found that DOE’s IRTR program components are not well- coordinated. For example, more than one program manager told us that DOE had not consistently coordinated its orphan source recovery efforts or regulatory infrastructure development assistance with physical security upgrades. According to officials responsible for managing the majority of the program’s physical security upgrade projects, IRTR program managers did not coordinate efforts that resulted in multiple visits to the same country. In their view, this caused confusion within the recipient countries because country officials had difficulty understanding why some parts of the same DOE program were being addressed separately. Officials from Sandia National Laboratories, the lead for GSSP, told us that projects were often implemented independently from physical security upgrade projects and that Sandia did not routinely coordinate its efforts with those of PNNL prior to initiating search and secure activities. PNNL officials, who brought this matter to our attention, concurred and stated that GSSP officials did not routinely consult with their physical security specialists prior to visiting countries with which PNNL had already established relationships. Furthermore, according to PNNL officials, DOE’s regulatory infrastructure development team had visited several countries without coordinating with the physical security upgrade teams. According to a DOE program manager, host country officials were frequently uncertain whether these two components were part of the same program. According to PNNL, this fragmented approach created confusion and required them to explain to country officials that the program components were meant to complement one another. The lead official for regulatory infrastructure development activities told us that future visits would be better planned to ensure that an integrated approach to source security was undertaken. Finally, we found coordination problems between IRTR and the U.S. Radiological Threat Reduction program, which is primarily responsible for domestic source recovery efforts, including repatriating U.S.-origin radiological sources in other countries. U.S. Radiological Threat Reduction program officials said there have been limited opportunities to share information or to assess the potential to coordinate international source recovery activities so as to leverage DOE resources. For example, the domestic program recently discovered a large quantity of unsecured radiological sources in South America. The sources were no longer in use and were inadequately secured. Officials managing DOE’s domestic program informed IRTR mangers of the finding and the location of the sources. However, IRTR officials declined to immediately secure the sources because the country where they were discovered, which is considered high risk, is not scheduled for IRTR upgrades until 2011. As a result, the sources will remain unsecured until the international program completes upgrades in this country. In our discussions, DOE officials recognized that coordination within the department needed to be improved and that a comprehensive and consistent approach to threat reduction efforts between its nuclear and radiological programs should be established. They acknowledged that it was inefficient for multiple DOE teams to visit the same sites as part of different programs to address multiple threat reduction activities. To that end, DOE’s recent reorganization of GTRI is designed to create a more streamlined structure that is organized geographically to address all threat reduction activities more effectively. Specifically, DOE plans to increase efficiency and improve coordination by (1) integrating multiple GTRI programs working in the same country or at the same sites; (2) redistributing workloads across the radiological and nuclear programs; and (3) improving relationships with host country officials by tailoring comprehensive strategies and incentives to more effectively meet unique country-specific conditions. DOE has improved coordination with IAEA in recent years to strengthen controls over other countries’ radiological sources and has developed several successful bilateral and multilateral partnerships with countries around the world to support and share the agency’s international efforts. IRTR’s director told us that these partnerships have helped to foster increased awareness of the security of sources through country-specific training and regional workshops. For example, with the assistance of IAEA, DOE has established a partnership with the Australian Nuclear Science and Technology Organization through which DOE has increased opportunities to conduct physical security assessments and strengthen regulatory inventories of radiological sources in Southeast Asia. Specifically, ANSTO has identified and facilitated communication with several high-risk countries, which has helped DOE gain access to countries that DOE had difficulty initiating contact with, like Vietnam. DOE has also provided funding to support, among other things, IAEA- sponsored training programs and regional workshops focusing on radiological source security. DOE also coordinated with Russia and IAEA as part of the Tripartite Initiative to conduct physical security assessments and install upgrades at 102 sites in 13 FSU countries—Armenia, Azerbaijan, Belarus, Estonia, Georgia, Kazakhstan, Kyrgyzstan, Latvia, Lithuania, Moldova, Tajikistan, Ukraine, and Uzbekistan. The objective of the Tripartite Initiative was to improve the security of dangerous radioactive sources in the FSU. We noted in our 2003 report that, in its early stages, the Tripartite Initiative was not well planned, that initial efforts were ad hoc, and a more systematic approach to program activities was needed. However, an IAEA official recently told us that coordination with DOE has improved significantly as the program evolved. Despite the success of the Tripartite Initiative, critical information gaps exist between DOE and IAEA that impede DOE’s ability to target the most vulnerable sites and countries for security improvements. First, according to DOE, IAEA has not shared with them, the countries that IAEA considers the most in need of security assistance. Second, although DOE funds IAEA appraisal missions—known as Radiation Safety and Security Infrastructure Appraisals—to assess the weaknesses in radioactive source security in IAEA member states, IAEA does not provide DOE with the findings of these missions because member state information is considered country-sensitive and confidential. The objective of these missions is to evaluate, among other things, the quality of regulatory controls countries exercise over their radiological sources. Results of the appraisals are formalized into action plans that provide the framework for subsequent IAEA assistance to improve the security of sources. Because IAEA does not provide DOE with the results of the missions, DOE is unable to effectively prioritize those sites that the missions identified to be most vulnerable. DOE officials told us that the lack of country-specific information has been an ongoing problem that limits DOE’s ability to effectively leverage its resources to maximize program impact and effectiveness. We also found that little coordination exits between DOE and the European Commission, which has resulted in the potential for overlap in assistance and duplication of efforts. Specifically, the EC provides financial support through IAEA, and on a bilateral basis, to secure radioactive sources in countries that are candidates for EU membership. EC officials told us that no formal communication exists with the United States on matters related to radioactive source security assistance, and as a result, each is largely unaware of the specific sites and locations the other is securing, or whether recipient countries are receiving too little or too much assistance. DOE officials told us that coordination with the EC has been conducted primarily at IAEA donor meetings. The EC has coordinated with IAEA to provide assistance to its member states to improve control over radiological sources. Specifically, the EC works jointly with IAEA on several action projects to strengthen the security of radiological materials used for nuclear and non-nuclear purposes, including upgrading regulatory infrastructures, installing physical security upgrades and, as appropriate, disposing of vulnerable radiological sources. As a result of these efforts, the EC has worked with IAEA in several regions, but has focused primarily on the Caucasus, Central Asia, Middle East, Africa, and Mediterranean countries. DOE has achieved noteworthy accomplishments in improving the security of radiological sources at hundreds of sites in more than 40 countries. We recognize that DOE faces a considerable challenge in securing other countries’ most dangerous radiological sources, given the number of these sources and their widespread dispersal. However, when DOE decided to expand its program beyond securing sites in Russia and the FSU, it diverted a significant portion of its limited program funding away from securing the highest priority and most dangerous radiological sources. Instead of focusing increased attention on these highest priority threats, such as RTGs, DOE allocated significant program funding resources to securing medical facilities that, in our view—as well as several DOE officials associated with the program—pose considerably less threat to U.S. security interests. While many of the RTGs cannot be removed until alternate energy sources are developed to replace them, removing as many RTGs as possible, or securing them until they can be removed, should be a critical component of DOE’s radiological threat reduction efforts. We believe that DOE’s current reorganization of its nuclear and radiological threat reduction efforts is a step in the right direction toward improving the management of the program. However, there are still many significant management issues that need to be addressed and resolved. DOE has not paid adequate attention to the long-term sustainability of the equipment, which could jeopardize the significant investment made to improve the security of radiological sources in many countries. The security equipment and upgraded storage facilities funded by DOE will require a long-term commitment by the countries to help ensure their continued use and operation, and it is not clear to us that a sustained stream of funding will be made available by DOE or by recipient countries to maintain and/or replace aging or defective equipment. Moreover, there are continuing concerns that many of the countries do not have adequate nuclear regulatory infrastructures in place to promote sustainability. Without a comprehensive sustainability plan that adequately addresses a country’s ability to reliably install and maintain upgrades and provide adequate oversight for source security, DOE risks losing a significant portion of its investment to improve the security of radiological sources in many countries. Furthermore, DOE’s decision to increase physical security requirements for sites selected for upgrades, based on revised threat protection criteria, may have significant cost implications for a program that is already facing severe budget reductions. This raises concerns because DOE has not adequately evaluated the increased costs associated with its elevated threat protection criteria. This may also be an opportune time for DOE to streamline the program, particularly in light of budget reductions. We question, for example, how certain program activities, such as the development of the Interpol database, directly contribute to the program’s core mission of securing radiological sources in other countries. There are other management issues that require DOE’s attention. First, DOE has not developed meaningful performance measurements to demonstrate the extent to which the radiological threat has been reduced as a direct result of its efforts, including measuring the impact of training and distinguishing between the types of sources secured. Second, we recognize the pool of reliable contractors to implement security projects and provide adequate training may be limited in some countries. However, many project delays could be avoided in the future if DOE developed specific selection criteria or a set minimum standard for foreign contractor qualifications. Improving radiological source security is a shared responsibility. DOE’s investment has been significant and reflects a commitment to addressing the problem. However, DOE should not underwrite the majority of the costs on behalf of the international community. Specifically, certain EU accession candidates and FSU countries, most prominently Russia, should be willing to contribute more resources to improve the security of dangerous and vulnerable sources in their own countries. In addition, DOE now has the authority to accept foreign contributions for GTRI programs from other interested countries, such as Canada, Japan, and Norway. However, gaps in communication between DOE and international partners, such as IAEA and the EC, significantly impede effective global radiological threat reduction. Finally, developing foreign countries’ nuclear regulatory organizations is a well recognized and critical component in strengthening radiological source security worldwide. NRC has a long-standing history of promoting regulatory controls in the FSU and should, in our view, play a more prominent role in this regard. DOE’s refusal to transfer $5 million from its appropriations to NRC to conduct regulatory development activities, despite the direction of the Senate Appropriations Committee, underscores NRC’s limited ability to provide international assistance, while reliant on funding from other agencies. Most of the coordination problems we identified between NRC and other agencies could have been avoided if NRC had its own stream of predictable and reliable funding for international regulatory development, rather than having to rely on DOE or State for funds. However, without a direct appropriation, NRC will continue to depend on other agencies for funds, thus increasing the likelihood that similar problems will occur in the future. To help ensure that DOE’s program focuses on securing the highest priority radiological sources and sites, we recommend that the Secretary of Energy and the Administrator of the National Nuclear Security Administration take the following two actions: Limit the number of hospitals and clinics containing radiological sources that receive security upgrades to only those deemed as the highest-risk, and To the extent possible, accelerate efforts to remove as many RTGs in Russia and, as an interim measure, improve the security of those remaining until they can be removed from service. Furthermore, we recommend that Secretary of Energy and the Administrator of the National Nuclear Security Administration take the following seven actions to improve program management: Develop a long-term sustainability plan for security upgrades that includes, among other things, future resources required to implement such a plan; Reevaluate program activities and eliminate those that do not directly contribute to securing the highest priority radiological sources in other countries; Conduct an analysis to determine the projected costs associated with increased security upgrades in light of newly proposed threat protection criteria and limit the number sites to receive increased security upgrades until such an analysis has been completed; Establish meaningful performance measurements that demonstrate real risk reduction and go beyond a quantitative listing of the number countries and sites that have received physical security upgrades; Apply a more rigorous approach to foreign contractor selection to help reduce potential project delays in the future; Seek assurances from recipient countries that plans are in place to maintain security-related equipment and facilities funded by the United States; and Develop strategies to encourage cost sharing with recipient countries, including Russia and EU accession countries. Finally, in an effort to improve coordination, the Secretary of Energy and the Administrator of the National Nuclear Security Administration, in consultation with the Secretary of State and the Chairman of the Nuclear Regulatory Commission, should work with IAEA and European Commission officials to consider ways to systematically improve information sharing to maximize and leverage resources and institutional expertise. If the Congress believes that regulatory infrastructure development is the key to the long-term sustainability of radiological source security efforts, it should consider providing NRC with authority and a direct appropriation to conduct these activities. The appropriation would be provided to NRC in lieu of providing the funds to DOE or another agency to reimburse NRC for its activities. Should the Congress decide to do so, NRC’s efforts need to be fully coordinated with those of State, DOE, and IAEA. We provided DOE and NRC with draft copies of this report for their review and comment. DOE provided written comments, which are presented as appendix III. NRC’s written comments are presented as appendix IV. NRC also provided technical comments, which we incorporated in the report. NRC neither agreed nor disagreed with our matter for congressional consideration, which would provide NRC with the legal authority and a direct appropriation to conduct international regulatory activities for radiological source security. However, NRC stated that if Congress acts upon our matter for consideration, NRC would work closely with State, relevant executive branch agencies, and IAEA to implement the program. In its written comments, DOE agreed with our conclusion that the department faced a considerable challenge in securing other countries’ most dangerous radiological sources, given the number of these sources and how widely dispersed they are. Furthermore, DOE stated that enormous amounts of dangerous material have not been secured, although the IRTR program has achieved a great deal of threat reduction in a short period of time. DOE stated that the recommendations were very helpful and would further strengthen its program. DOE also noted that it had measures in place—as a result of its reorganization of GTRI—to address program challenges and concerns that we raised, such as site prioritization; quality assurance/sustainability; coordination; and transportation. We recognized in the report that the reorganization of the program was a step in the right direction toward improving program management. However, as we noted in our report, many significant management issues still need to be addressed and resolved despite the reorganization. That is why we believe it was important to offer recommendations to improve program management and source prioritization efforts. In other comments, DOE stated that the IRTR program uses a number of factors to determine priority levels for the sites it selects to upgrade in addition to the amount of radioactivity contained in radiological sources. These other factors include (1) known terrorist threat in the country/region; (2) current level of security at the site; and (3) the proximity of the site in relationship to potential strategic targets of U.S. interest. In our report, we stated that site selection was based on a number of factors, including those specifically noted by DOE in its written comments. We also pointed out in our report that DOE’s guidance on site selection has not clearly discriminated between the different sites secured and which sites were to be considered the highest priority. We are encouraged that DOE is explicitly linking its prioritization guidelines to a site’s proximity to potential strategic targets of U.S. interest. However, it remains to be seen how consistently DOE will apply this criteria to its site selection process in the future. In a related comment, DOE stated that it will continue to accelerate RTG recoveries but must also address high priority medical and other sources. In our view, this action by DOE would be consistent with the key conclusions and recommendations in our report. Our recommendations specifically state that DOE should, to the extent possible, remove as many RTGs in Russia and limit the number of hospitals and clinics containing radiological sources that receive security upgrades to only those deemed to be the highest risk. With regard to quality assurance and program sustainability issues, DOE stated that it employs a standard process that ensures quality assurance for the security equipment that it installs. This process includes, among other things, conducting post-installation visits by technical experts for the purpose of assuring that all equipment and systems are installed as agreed upon. DOE also noted that despite these measures, it would further investigate its process to identify and implement additional improvements. We think DOE should take these steps because, as discussed in our report, we identified several problems with malfunctioning equipment and other maintenance problems at sites containing radiological sources. DOE also noted that it has a short-term sustainability program for every site that it upgrades that includes a 3-year warranty as well as preventative maintenance contracts and training for operational staff. DOE believes that we should revise the report to indicate the existence of the 3-year warranty. Our report recognizes that DOE’s program guidance calls for preventative maintenance contracts and training. We also noted that DOE provides a 3-year warranty, and we gave DOE credit for providing this coverage. Our main point remains—which DOE explicitly agreed with— that DOE has not developed a long-term sustainability plan for the equipment it has installed. Nevertheless, we clarified our report language, as appropriate, to state that DOE does have a short-term sustainability plan but has not developed a long-term plan to maintain the security upgrades completed. Regarding coordination, DOE cited numerous examples in its written comments of close cooperation with other U.S. government agencies, other DOE elements, and international partners on matters pertaining to international radiological source security. We believe the report fairly characterized DOE’s coordination efforts in each of these areas. Specifically, we noted that DOE had improved coordination with State and NRC since we reported on this matter in 2003 and has increased information-sharing with the agencies. In addition, we believe our characterization of coordination problems within the department is correct. Our evaluation was based on information provided by an independent consultant’s report as well as our own analysis of conditions we found within the department pertaining to inconsistent and, at times, inadequately coordinated efforts by different DOE programs responsible for threat reduction activities in the same country. As we noted in the report, DOE officials recognized that coordination within the agency needs to be improved and that a comprehensive and consistent approach to threat reduction efforts between nuclear and radiological threat reduction activities should be established. We also noted in the report that DOE’s September 2006 reorganization of its GTRI efforts is designed to create a more streamlined structure that is organized along three geographic regions, which could improve program coordination. On a related matter, DOE stated that we should have given IAEA an opportunity to review and address some of the issues raised in our report about limited information sharing, which impeded DOE’s ability to target the most vulnerable sites and countries for security improvements. Since this information was provided to us by DOE officials, it is unclear to us what benefit would have been achieved by providing a draft of this report to IAEA for review and comment of DOE’s views. Our report notes that DOE has, despite some information-sharing problems with IAEA, improved coordination with the agency in recent years to strengthen controls over other countries’ radiological sources. Finally, with regard to transportation of sources, DOE commented that, among other things, it had been working with the U.S. Department of Transportation, IAEA, and key IAEA donor countries to strengthen transport security regulations. We added this information to our report based on DOE’s comments. DOE also stated that it was working with Russia to enhance the security of radioactive materials, including providing cargo trucks and escort vehicles for the Moscow waste storage facility. We had already recognized this fact in the report. More broadly, however, we believe that the report accurately and fairly depicts the limitations of DOE efforts regarding transportation security. A primary source of information for our observation came directly from a DOE analysis—cited in the report—which concluded that the department was addressing transportation security on an ad-hoc basis and that the existing method of providing transportation security had serious limitations and lacked a commitment to integrate transport security into all countries participating in the IRTR program. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. We will then send copies of this report to the Secretary of Energy; the Secretary of State; the Administrator, National Nuclear Security Administration; the Chairman, Nuclear Regulatory Commission; the Director, Office of Management and Budget; and interested congressional committees. We will also make copies available to others upon request. In addition, the report will be made available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have questions concerning this report, please contact me at (202) 512-3841 or aloisee@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs can be found on the last page of this report. Key contributors to this report include Erika D. Carter, Glen Levis, Mehrunisa Qayyum, Keith Rhodes (GAO’s Chief Technologist), and Jim Shafer. We focused our review primarily on the Department of Energy (DOE), since it is the lead federal agency for improving the security of radiological sources worldwide and provides significant funds for that purpose. We also performed work at the Nuclear Regulatory Commission (NRC) and Department of State (State) in Washington, D.C., which also provide assistance to help other countries secure their sealed radiological sources. In addition, we reviewed program-related activities and interviewed program officials from Argonne National Laboratory in Argonne, Illinois; the Los Alamos National Laboratory in Los Alamos, New Mexico; Pacific Northwest National Laboratory in Richland, Washington; Sandia National Laboratories in Albuquerque, New Mexico; the International Atomic Energy Agency (IAEA) in Vienna, Austria; and the European Commission (EC) in Brussels, Belgium. We also met with nongovernmental organizations, including, the Council on Foreign Relations and the Carnegie Endowment for International Peace. In November 2005, we attended the Trilateral Commission meeting held in the United Kingdom, which discussed international approaches to securing radiological sources against terrorism. We visited four countries to determine how DOE has implemented its program to secure radiological sources overseas. We selected these countries based on several criteria, including where DOE has spent the most funds since 2002. Overall, these four countries represented about $37.4 million, or about 35 percent, of overall program expenditures. We selected Lithuania and Poland since, among other reasons, DOE officials told us that these were model countries in securing radiological sources and implementing effective physical security upgrades. Also, we selected Russia and Georgia because they received significant program funds, totaling about $34.2 million of the $107.7 million. In addition, thousands of radiological sources are located in these two countries. In the case of Russia, it contains the majority of RTGs worldwide and operates 44 percent of all Radons in the former Soviet Union. During our review, we observed physical security upgrades at all types of sites: medical, industrial, research, storage facilities, and RTGs. For instance, we visited numerous medical and industrial sites throughout Lithuania and Poland. Specifically in Lithuania, we visited the Radiation Protection Center, Vilnius Oncology Institute Clinic, Klaipeda City Hospital, the Kaunas Oncology Clinic, and Saiuliu Oncology Hospital, as well as the Lithuanian Institute of Physics and the Maisiagala Repository. In Poland, we visited the Regionaine Centreem Kriwodawstwa I Krwiolecznictwa (Children’s Hospital) as well as the Glowny Urzad Miar (Main Measurement Office), Polytechnic Institute of Lodz, Radioisotope Center (Polatom), Geofizyka Krakow, Radioisotope Waste Management Plant in Swierk, Technical University Institute of Applied Radiation Chemistry, and the Technical Institute of Applied Physics. At each location, we interviewed facility staff who were responsible for implementing radiological source security procedures and using the monitoring equipment funded by DOE. Facility staff included—but was not limited to—doctors, clinical technicians, and other medical support staff. At each site, we met with local guards to determine how well they were trained and equipped. We also interviewed host country contractors who were responsible for installing and maintaining physical security upgrades. We also met with host government officials in both countries. In Lithuania we met with officials from the Ministry of Economy; RATA (Lithuanian Radioactive Waste Management Agency); the Radiation Protection Center (nuclear regulatory organization); and the Ministry of Environment. In Poland, we interviewed officials from the National Atomic Energy Agency (Poland’s nuclear regulator), the Department of Environmental Hygiene, and the Ministry of Health. We also visited Russia and Georgia to obtain a first-hand look at waste facilities that contain radiological sources. Specifically, we visited the Moscow Radon site at Sergiev Posad, located about 90 kilometers from Moscow and the St. Petersburg Radon site, located about 80 kilometers from St. Petersburg. While in Russia we also met with the key federal agencies responsible for radiological source management and oversight. Specifically, we met with several high-level officials from Rostechnadzor, Russia’s nuclear regulator (the Federal Environmental, Industrial and Nuclear Supervision Service of Russia); the Federal Agency for Construction and Utilities; and the Department for Nuclear and Radiation Safety at the Federal Atomic Energy Agency. Additionally, we interviewed directors of both the Moscow and St. Petersburg Radon facilities; officials of the IBRAE Institute (Russian National Academy of Sciences); and directors of VNIITFA (Russian National Technical Physics and Automation Research Institute), the designer of RTGs. Moreover, after meeting with officials from the Kurchatov Institute, which is primarily responsible for the RTG removal, we visited three sites where RTGs had been removed and replaced with alternative energy sources. In Georgia, we visited the Mtsheta national repository located at the Institute of Physics near Tbilisi, Georgia, as well as Georgia’s temporary national storage facility that stores many high-risk radiological sources, including six RTGs and a seed irradiator. Regarding Georgia’s medical sites, we also visited the National Cancer Center of Georgia and the Kutaisi Oncological Center and interviewed staff and guards who were responsible for source security. We met with officials from the Nuclear and Radiation Safety Service of the Ministry of Environmental Protection and Natural Resources (Georgia’s nuclear regulator), the Nuclear and Radiation Safety Department, the Institute of Radiobiology, and the Chamber of Control. To assess the progress of DOE’s efforts to help other countries secure their sealed radiological sources, we obtained and analyzed documentation on DOE’s International Radiological Threat Reduction Program (IRTR), including project work plans for each country and program activity; strategic planning documents; and internal briefings. For example, we reviewed DOE’s Action Plan to Secure and Control Foreign- Origin Source Materials for Radiological Dispersal Devices (April 2003), and Programmatic Guidelines for Site Prioritization and Protection Implementation (September 2006). We supplemented the documentation with interviews with senior level DOE officials responsible for implementing the IRTR program. To specifically determine the status of efforts across the 49 countries receiving DOE’s assistance, we reviewed DOE’s Project Management Information System database to construct a summary table that included factors, among other things, the number of sites completed; host country agencies and international organizations involved in radiological source security; and program accomplishments and challenges. To identify challenges DOE faces in securing sources in other countries and to assess sustainability efforts, we collected and analyzed (1) IRTR program trip reports for all countries participating in the program, and (2) testimonial evidence obtained from project managers, security specialists, and contracting officers to identify all programmatic and management challenges. Furthermore, we performed a comprehensive review and analysis of trip reports from fiscal year 2004 through fiscal year 2006. To assess current and planned program costs of U.S. programs that provide assistance to secure radiological sources in other countries, we reviewed budget documents from DOE and NRC detailing program expenditures from fiscal year 2002 through fiscal year 2006. We obtained responses from key agency database officials to a number of questions focused on data reliability, covering issues such as data-entry access and the accuracy and completeness of the data. For DOE specifically, to determine how much DOE had budgeted and spent through August 31, 2006, to secure radiological sources in other countries, we reviewed element of cost reports detailing program expenditures by country, national laboratory, and program objective per fiscal year to determine the amount spent in-country and the overall carryover of unspent and unobligated funds. Furthermore, to determine planned program costs for DOE, we reviewed DOE’s congressional budget request for fiscal year 2007 and met with senior DOE officials to learn about DOE’s plans for addressing reduced program funding. Follow-up questions were added whenever necessary. Caveats and limitations to the data were noted in the documentation, where necessary. We determined that the data were sufficiently reliable for the purposes of this report, based on work we performed to ensure the data’s reliability. To assess the extent to which coordination has occurred within DOE as well as on an interagency basis, we obtained and analyzed documents from DOE, NRC, and State regarding their radiological threat reduction and nonproliferation activities. We interviewed several senior officials at NRC, including the Senior Advisor for Nuclear Security, a senior foreign policy advisor for the Office of International Programs, and a Senior Engineer. At State, we interviewed several high-level officials, including the Senior Coordinator for Nuclear Safety from the Bureau of International Security and Nonproliferation. We also reviewed State, NRC, and DOE documents regarding Iraq work to highlight interagency coordination. To address the level of coordination with international organizations, we met with senior officials at the International Atomic Energy Agency and the European Commission, including the Director of Nuclear Safety, and a senior official from the External Relations Directorate, respectively. Finally, we met with the Director of the Nuclear and Radiation Safety Centre from the Armenian Nuclear Regulatory Authority to learn about NRC’s role in providing regulatory assistance to Armenia. We performed our review in Washington, D.C., and other locations, from November 2005 to December 2006 in accordance with generally accepted government auditing standards.

Summary: Following the terrorist attacks of September 11, 2001, U.S. and international experts raised concerns that unsecured radiological sources were vulnerable to theft and posed a significant security threat to the United States and the international community. Radioactive material is encapsulated or sealed in metal to prevent its dispersal and is commonly called a sealed radiological source. Sealed radiological sources are used worldwide for many legitimate purposes, such as medical, industrial, and agricultural applications. However, the total number of these sources in use worldwide is unknown because many countries do not systematically account for them. It is estimated that thousands of these sources have been lost, stolen, or abandoned--commonly referred to as orphan sources. If certain types of these sources were obtained by terrorists, they could be used to produce a simple and crude, but potentially dangerous, weapon--known as a radiological dispersion device, or dirty bomb. In 2001, a congressional report directed DOE to use a portion of its fiscal year 2002 supplemental appropriation to address the threat posed by dirty bombs. In response to the congressional requirement, the National Nuclear Security Administration (NNSA) established the Radiological Threat Reduction Task Force to identify, recover, and secure vulnerable, high-risk radiological sources, budgeting $20.6 million for the program in fiscal year 2002. The program initially focused on securing sources in the countries of the former Soviet Union (FSU) because DOE officials determined this region had the greatest number of vulnerable sources. In 2003, at the direction of the Secretary of Energy, DOE expanded the scope of the program to secure sealed sources worldwide, ultimately establishing the International Radiological Threat Reduction (IRTR) Program. The program's primary objective is to protect U.S. national security interests by (1) implementing rapid physical security upgrades at vulnerable sites containing radioactive sources; (2) locating, recovering, and consolidating lost or abandoned high-risk radioactive sources; and (3) supporting the development of the infrastructure necessary to sustain security enhancements and supporting regulatory controls, including the development of regional partnerships to leverage international resources. In addition, DOE has established a program to recover sealed sources produced and distributed in the United States, known as the U.S. Radiological Threat Reduction program. Part of this program's mission is to recover U.S.-origin sources on a case-by-case basis that were supplied by DOE to other countries under the Atoms for Peace program. The IRTR program is administered by NNSA with support from multiple national laboratories. The national laboratories' responsibilities include (1) assessing the physical security requirements of countries participating in the program, (2) recommending specific upgrades to strengthen radiological source security, and (3) ensuring that recommended upgrades are properly installed. In 2003, we issued a report at Congress' request focusing on U.S. and international efforts to secure sealed radiological sources. We recommended, among other things, that the Secretary of Energy take the lead in developing a comprehensive plan to strengthen controls over other countries' sealed sources. This report (1) assesses the progress the Department of Energy (DOE) has made in implementing its program to help other countries secure their sealed radiological sources, (2) identifies DOE's current and planned program costs, and (3) describes DOE's coordination with other U.S. agencies and international organizations to secure radiological sources in other countries. DOE has improved the security of hundreds of sites that contain radiological sources in more than 40 countries since the program's inception in 2002. However, many of the highest-risk and most dangerous sources still remain unsecured, particularly in Russia. In 2003, when DOE decided to broaden the program's scope beyond the former Soviet Union, it also expanded the types of sites that required security upgrades. As a result, as of September 2006, almost 70 percent of all sites secured were medical facilities, which generally contain one radiological source. Several DOE and national laboratory officials with whom we spoke questioned the benefit of upgrading such a large number of medical facilities, while higher priority sites--such as waste storage facilities and Radioisotope Thermoelectric Generators (RTGs)--remained unsecured. In addition, DOE's program does not address the transportation of radiological sources from one location to another, a security measure that DOE and international officials have identified as the most vulnerable link in the radiological supply chain. DOE has experienced numerous problems and challenges implementing its program to secure radiological sources worldwide, including a lack of cooperation from some countries and access to sites with dangerous material. Furthermore, some high-risk countries have not given DOE permission to undertake security upgrades at all. Finally, DOE has not developed a plan to ensure that countries receiving security upgrades will be able to sustain them over the long term. From its inception in 2002 through August 31, 2006, DOE spent approximately $108 million to implement its program to secure radiological sources worldwide. A majority of the funds spent--$68 million--was to (1) conduct vulnerability assessments at a variety of sites containing radiological sources; (2) install physical security upgrades at these sites, such as hardened windows and doors, motion sensors and surveillance cameras; and (3) help countries draft laws and regulations to increase security and accounting of sources. In addition, DOE provided $13.5 million to IAEA to support activities to strengthen controls over radiological sources in IAEA member states. The remainder, or $26.5 million, paid for program planning activities such as developing program guidance documents, hiring private consultants, and conducting studies. To offset anticipated shortfalls in funding, DOE plans to obtain international contributions from other countries but efforts to date have produced limited results. DOE has improved coordination with the Department of State (State) and the Nuclear Regulatory Agency (NRC) to secure radiological sources worldwide. Since we reported on this matter in 2003, DOE has involved State and NRC in its international radiological threat reduction activities more often and has increased information-sharing with the agencies. Additionally, DOE and NRC supported a State-led interagency effort to establish the Iraq Radioactive Source Regulatory Authority and develop a radiological regulatory infrastructure in Iraq. However, DOE has not always integrated its nuclear regulatory development efforts efficiently. In addition, DOE has not adequately coordinated the activities of multiple programs within the agency responsible for securing radiological and nuclear materials in other countries. DOE has generally improved coordination with IAEA to strengthen controls over other countries' radiological sources and has developed bilateral and multilateral partnerships with IAEA member states to improve their regulatory infrastructures. However, significant gaps in information-sharing between DOE and IAEA, and with the EC, have impeded DOE's ability to target the most vulnerable sites for security improvements and to avoid possible duplication of efforts.